Verify users at signup without adding friction
One call per signup — phone, email and IP validated together, signals named, verdict signed — fast enough to sit inline in the form and honest enough to audit a year later.
Every field a signup form asks for is a promise you will act on it. If the email is never verified, support answers dead mailboxes; if the phone is never checked, onboarding SMS dies silently; if the IP is never looked at, trial abuse arrives in bulk.
The constraint is latency: a check that adds seconds to signup costs more users than it filters bots. Validation answers from data we host, so the common path is a local read — fast enough to run inline, before the account exists.
The endpoints, and what each costs
POST /api/fraud-score
{ "email": "[email protected]", "phone": "+12125550100", "ip": "203.0.113.9" }{
"risk": 12,
"signals": { "email": { "valid": true }, "ip": { "datacenter": false } },
"receipt": { "resultSha256": "…", "signature": "…" }
}The receipt is the part nobody else ships: months later you can prove what was checked at signup and what the answer was — recompute the hash from the response text alone.
The part a use-case page usually skips
Signals, not gatekeeping
We return what we found; whether 'VPN detected' means block, challenge or ignore is your policy. A verification vendor making that call for you is making your product decisions.
Latency depends on the check
Phone, IP and domain answer from local data. Email runs a live SMTP conversation with the receiving server, and a slow mail server is slow for everyone — run it async after the form if every millisecond matters.
Does this replace OTP verification?
No — it decides whether OTP is worth sending. Validating the number first means your OTP provider bills you for messages that could actually arrive, and the line-type basis tells you when to distrust the destination.
What do the receipts give me at signup time?
An audit trail that survives arguments. When an account turns out fraudulent, the signed receipt shows exactly what was checked and answered at signup — evidence you ran your controls, verifiable from the response text without trusting us.