DEV Community

Olly
Olly

Posted on

A fraud risk score for signups and orders in one API call

#security #api #webdev #saas

Fake signups and card-testing orders tend to share the same tells: a throwaway email, a datacenter IP, a phone number from a different country to the IP, and a headless browser. FraudKit checks all of them in one request and returns a 0–100 risk score with the reasons spelled out.

curl -G "https://fraudkit-fraud-risk-score-for-signups-orders.p.rapidapi.com/score" \
  -d email=jane@mailinator.com -d ip=104.28.1.1 \
  --data-urlencode "phone=+447911123456" -d country=GB \
  --data-urlencode "user_agent=HeadlessChrome/126.0" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: fraudkit-fraud-risk-score-for-signups-orders.p.rapidapi.com"
Enter fullscreen mode Exit fullscreen mode

The response gives a risk_score, a risk_level and a plain-English reasons list, for example:

  • disposable email domain
  • IP is in a hosting/datacenter network
  • IP country differs from billing country
  • user-agent is a bot or automation tool

Send whichever signals you have. Every field is optional, and the score only uses what you pass.

Typical setup

  • Signup: score above 70, require email verification. Above 90, block.
  • Checkout: score above 60, send to manual review or step-up auth.
  • Free trials: use /disposable alone to stop throwaway emails.

/user-agent parses any UA string into browser, OS, device and an is_bot flag.

As an MCP tool

Agents can call it too: the MCP endpoint is https://fraudkit-fraud-risk-score-for-signups-orders.p.rapidapi.com/mcp, using the same RapidAPI headers.

There's a free plan. FraudKit on RapidAPI

Top comments (0)