Real-time fraud detection, scoring, and watchlist screening
Analyze transaction for fraud
Runs real-time fraud analysis on a transaction using geolocation signals, velocity checks, device fingerprinting, and network graph analysis. Returns a risk score (0–100) and recommended action.
Headers
Idempotency-KeystringUnique key to safely retry this request without duplicate analysis
Request Body
transaction_idstring · requiredExample: TXN123456789sender_accountstring · requiredExample: 0123456789receiver_accountstring · requiredExample: 9876543210amountnumber · float · requiredExample: 125000.5channelstring · enum · requiredEnum values:mobileussdwebatmposExample: web
currencystring · enumEnum values:NGNUSDDefault: NGNip_addressstringExample: 102.89.23.45device_idstringExample: dev_fingerprint_abcmetadataobjectOptional key-value context
Responses
transaction_idstringis_fraudbooleanrisk_scorenumber0 (safe) to 100 (high risk)
Example: 45.7risk_levelstring · enumEnum values:lowmediumhighcriticalExample: mediumrecommended_actionstring · enumEnum values:approvereviewdeclinestep_up_authExample: approvesignalsobject[]request_idstring
Get account fraud score
Retrieves the current aggregated fraud risk score for a bank account or wallet. Scores are recalculated when new signals arrive via webhooks or API calls.
query Parameters
account_numberstring · required10-digit NUBAN account number
bank_codestringCBN bank code (e.g. 058 for GTBank)
Responses
account_numberstringExample: 0123456789fraud_scorenumberExample: 73.2risk_levelstring · enumEnum values:lowmediumhighcriticalExample: highlast_updatedstring · date-timereport_countintegerNumber of network fraud reports
Example: 2
Screen against watchlists
Screens an identity or account against Scrub's consolidated watchlist including reported fraudsters, PEP lists, and sanctioned entities relevant to the Nigerian financial ecosystem.
Request Body
subject_typestring · enum · requiredEnum values:accountbvnninphoneemailExample: bvnidentifierstring · requiredExample: 22345678901
full_namestringExample: Adebola James
Responses
matchedbooleanmatch_countintegermatchesobject[]request_idstring
Assess device fingerprint risk
Evaluates device fingerprint signals (IP, user agent, timezone, emulator detection) to detect account takeover, SIM swap, and multi-accounting patterns common in Nigerian mobile fraud.
Request Body
device_idstring · requiredExample: dev_abc123ip_addressstring · requiredExample: 102.89.23.45user_agentstring · requiredExample: Mozilla/5.0 (Linux; Android 14)...
account_numberstringExample: 0123456789timezonestringExample: Africa/Lagosis_emulatorboolean
Responses
device_idstringrisk_scorenumberExample: 62risk_levelstring · enumEnum values:lowmediumhighExample: mediumflagsstring[]Example: ["NEW_DEVICE","VPN_DETECTED"]known_devicebooleanrequest_idstring
Check transaction velocity
Detects abnormal transaction velocity — rapid transfers, burst login attempts, or geographic impossibility — within a configurable time window.
Request Body
account_numberstring · requiredExample: 0123456789event_typestring · enum · requiredEnum values:transferlogincard_txnbvn_lookupExample: transfer
window_minutesintegerExample: 60Default: 60thresholdintegerMax events before flagging
Example: 5Default: 5
Responses
exceededbooleanevent_countintegerExample: 2thresholdintegerExample: 5window_minutesintegerExample: 60request_idstring
Report confirmed fraud
Submits a confirmed fraud case to the Scrub network. Reports are shared (with consent) across participating institutions to improve collective fraud detection.
Request Body
reporter_emailstring · email · requiredExample: report@fraudwatch.ngaccount_numberstring · requiredExample: 0123456789fraud_typestring · enum · requiredEnum values:phishingaccount_takeoversim_swapidentity_theftchargebackotherExample: phishing
amount_lostnumberExample: 50000descriptionstringExample: User tricked into sending money under false pretenses.evidence_urlsstring[]
Responses
report_idstringExample: frd_rpt_8x2k9mstatusstring · enumEnum values:receivedunder_reviewverifiedExample: receivedcreated_atstring · date-timerequest_idstring