INDICATORS REFERENCE

Fraud & Scam Detection Indicators

Fraud & Scam Detection covers 200 indicators across 4 fraud groups. Each signal has a stable slug and code for programmatic access. Representative signals are shown publicly; the complete reference is available to customers.

View Fraud Groups Features

200

Indicators

Fraud Groups

Languages

Avg / Group

Overview Fraud Groups Indicators Features

4 results

Showing 4 representative indicators of 200. The complete taxonomy is available to customers.

Request access

#	Indicator	Slug	code	Fraud Group
001	imp id theft basic	`imp_id_theft_basic`	`impersonation.imp_id_theft_basic`	Impersonation
002	pd bec ceo request	`pd_bec_ceo_request`	`payment_diversion.pd_bec_ceo_request`	Payment Diversion
003	fi fake supplier invoice	`fi_fake_supplier_invoice`	`fake_invoice.fi_fake_supplier_invoice`	Fake Invoice
004	se mass phishing	`se_mass_phishing`	`social_engineering.se_mass_phishing`	Social Engineering

Browse by Fraud Group

Alternatively, explore indicators grouped by their parent fraud group:

Impersonation

impersonation

50 Indicators

The complete signal list for this fraud group is available to customers. Request access to view it.

Payment Diversion

payment_diversion

50 Indicators

The complete signal list for this fraud group is available to customers. Request access to view it.

Fake Invoice

fake_invoice

50 Indicators

The complete signal list for this fraud group is available to customers. Request access to view it.

Social Engineering

social_engineering

50 Indicators

The complete signal list for this fraud group is available to customers. Request access to view it.

Reading Fraud & Scam Detection output

What you can safely infer from a result - and what you must not.

Intended task

Flag documented fraud and scam patterns - payment diversion, impersonation, advance-fee lures - in text before money or credentials move.

Input requirements

text - the only field analyzed; up to 4,096 Unicode code points. Over the limit is rejected with input_too_long, never truncated.
language - must be a language this analyzer supports. Unsupported codes are rejected with 400 unsupported_language, never analyzed as a different language.
analyzers - include "fraud-scam"; up to 2 analyzers per request, one billed run each.
No context beyond text - no user IDs, history, profiles, or attachments are read or inferred.
Analyzes the submitted text only - sender identity, headers, and account relationships are not inputs.

Ordinary positive

“Please update our payment details - our account is under audit, so wire this month's invoices to the new account below.”

paydiv_vendor_supplier very high

paydiv_bec_ceo high

Safe inference: The text matches documented payment-diversion patterns - hold the payment change and verify out-of-band before any wire.

Confusing negative · Quotation

“Security bulletin: watch for emails like "wire this month's invoices to the new account below" - report them to finance.”

What happens: Payment-diversion signals can fire on the quoted lure. Training material, bulletins, and forwarded suspect emails all contain the same language as the attack itself - the signal describes the text, not whether this message is itself an attack.

Why it's tricky: A bare request like "can you send me $200?" may also be too thin to match strongly - fraud patterns are contextual. Treat flagged text as a verify-first trigger, and unflagged payment changes as "not detected" rather than verified-safe.

What you can safely infer

Which documented fraud patterns the text matched, and at what signal-match strength.
That the same message on the same pinned configuration replays identically - the receipt supports your audit trail.

What you must not infer

✕That a flagged message proves fraud or wrongdoing - signals route verification, they do not determine guilt.
✕That the sender is a criminal - impersonation signals describe the language, not the person.
✕That an unflagged payment request is verified-safe - always confirm payment changes out-of-band regardless of the result.

Boundary: Fraud signals are not proof of wrongdoing. They flag language consistent with documented schemes so an analyst or control step can verify - payment changes should always be confirmed out-of-band regardless of the result.

Signal reference Evaluation evidence Understanding signals API reference Evaluate on your data

Using Indicators in API Responses

When you call /v1/analyze, the response includes matched indicators with signal-match scores. Each signal is identified by its code and includes a level field (“category” or “label”). A score expresses signal-match strength under a particular analyzer configuration. It is not a probability that the signal or a downstream action is correct. Validate action thresholds on representative labeled data.

{
    "language": "en",
    "language_source": "declared",
    "signals": [
        {
            "analyzer": "fraud-scam",
            "code": "payment_diversion",
            "label": "Payment Diversion",
            "score": 0.94,
            "level": "category"
        },
        {
            "analyzer": "fraud-scam",
            "code": "pd_bec_ceo_request",
            "label": "CEO Urgent Payment Request BEC",
            "score": 0.92,
            "level": "label",
            "parent": "payment_diversion"
        },
        {
            "analyzer": "fraud-scam",
            "code": "pd_bec_attorney_confidential",
            "label": "Attorney Confidential Payment BEC",
            "score": 0.89,
            "level": "label",
            "parent": "payment_diversion"
        }
    ],
    "meta": {
        "analyzers": [
            {
                "name": "fraud-scam",
                "status": "completed",
                "applicability": "analyzable",
                "assessment": "signals_detected",
                "signal_count": 3,
                "billed": true
            }
        ]
    },
    "usage": {
        "analyzer_runs": 1
    },
    "verification": {
        "configuration": "sqcfg_CQ8CN62V",
        "fingerprint": "fp_8a72...19f",
        "input_commitment": "ic_31bd...a42",
        "signature": "sig_ed25519_4c1f...e2a",
        "key_id": "edk_af4f218e"
    }
}

Back to Fraud & Scam Detection Docs View Fraud Groups

Quickstart Guide

First API call in under 5 minutes

API Reference

Full endpoint documentation

Benchmark Results

Per-language Top-3 Hit Rate

Pricing

From Free to Enterprise

Playground

Test detection live - no API key

Indicator Dictionary

Browse all 200 indicators

Benchmark Methodology

How we measure Top-3 Hit Rate

Request access5,000 analyzer runs/month · No card required