scam_check

The scam_check command provides real-time indicators to identify if a subscriber is currently being targeted by Authorised Push Payment (APP) fraud. This threat occurs when a victim is socially engineered, typically via a telephone call, into knowingly making a funds transfer under a false narrative. Because telephony is the primary vehicle for this fraud, the scam_check API identifies active high-risk sessions by verifying if a call is in progress, its direction, and its duration.

Organizations use these signals to combat fraud by detecting active calls during sensitive transactions, allowing for immediate intervention such as triggering security prompts or pausing transfers. Analyzing call direction is critical because fraudsters usually initiate contact, making an "Inbound" status a high-risk indicator. Furthermore, monitoring call duration helps identify the "on the hook" tactic where scammers occupy the victim for extended periods to prevent them from questioning the situation or seeking outside advice.

Note: The service is initially active in the UK market for all four major mobile operators (EE, Telefonica O2, 3 UK, and Vodafone), as well as all EE (BT) landlines. Use of this data point is subject to operator approval of the specific customer use case.

Response Reference

Field Name	Data Type	Output Values	Description
call_in_progress	Boolean	TRUE / FALSE	Indicates if the MSISDN is currently engaged in a telephony session.
call_direction	String	Inbound / Outbound	Indicates the direction of the current call from the subscriber's perspective. Higher risk if "Inbound".
call_duration	String	HH:MM:SS	The length of time the current call has been active. Risk increases with longer durations.

Table Summary

Command	Description	Response Values
`scam_check`	Provides real-time indicators to detect and prevent subscribers from becoming victims of Authorised Push Payment (APP) fraud.	call_in_progress: Boolean indicating if the MSISDN is currently in a call call_direction: Identifies if the active call is Inbound or Outbound call_duration: The length of time the current call has been active (HH:MM:SS)

Read this in the portal, with search and the reference beside it: Scam Check