A fraud detection API that checks each signup, login and checkout in one call

Your server sends the visit to /v1/evaluate, with the email, phone and account ID when it has them. Maskbreak checks the connection and the browser behind it and answers allow, review or block, with the reasons. Your code decides what happens next.

Create free account Try the API playground

Free plan: 10,000 visitor checks a month
No card
Paid plans from €29 a month

Example checkA signup from a scripted browser

Blockrisk_score 83

IP address: 203.0.113.55
VPN: Not detected
Proxy: Not detected
Automation: Detected
Fake browser: Detected
visitor_id: demo_visitor_a8c91b

"decision": "block""reasons": ["antidetect_browser", "automation_detected"]

The public bot sample: a clean home connection, and a browser that gives it away. See the JSON

What one call checks

A fraud detection API is a service your server asks about a visit before it creates an account, signs someone in or takes an order. It reads evidence your app can’t easily gather itself, such as whether the connection runs through a proxy or a script is driving the browser, and answers with a decision your code acts on. It doesn’t replace your login or your payments: it sits in front of them.

decision, reasons: Allow, review or block, with short codes such as proxy_detected or automation_detected to log and route on. risk_score, from 0 to 100, is for sorting; it isn’t the probability that someone is a fraudster.
network: VPN, proxy, Tor exit and cloud server, read from the visit’s own connection, home and mobile proxies included. A proxy or a Tor exit blocks (Apple’s iCloud Private Relay is review), a VPN on its own is review and a cloud server on its own is allow. network.service names the VPN or proxy service when it’s known.
device: The browser: automation such as headless Chrome, Puppeteer or Playwright, a fake (antidetect) browser and an emulated phone each block; a virtual machine on its own is review. Present when the browser check completes.
visitor_id, account: A visitor ID built to survive cleared cookies and private windows. Send your own accountId and the answer says how many of your accounts this device and this address were used for; three or more accounts on one device within 24 hours turn allow into review. The links never cross to another customer.
email, phone: A throwaway email domain turns allow into review. With email and phone intelligence on, the address and the number also get a score from 0 to 100 and signals such as disposable, no_online_accounts or fraud_reports; a score of 80 or more turns allow into review. Each one scored uses one of your plan’s daily email and phone checks (3 a day on Free).
account_takeover: Send event: "login" with the accountId from your login handler and get a takeover score from 0 to 100. 80 or more raises allow to review, never to block. Included in every plan.

You can change any default per signal under Rules in the dashboard. A rule changes the answer only for the signal it names, so allowing VPNs never lets a proxy or a bot through. Webhooks send detected threats, and any block your own rules make, to Slack, Discord or your own endpoint, signed so your receiver can check where they came from.

Add it in front of your signup

Load https://maskbreak.com/assets/sentinel.js on the page and give the form the class monocle-enriched; your server sends the fields it adds, with the email, to /v1/evaluate before the account is created. The example starts in watch mode: it logs each verdict and lets every signup through, even when Maskbreak can’t be reached. Once the log matches Events in your dashboard, uncomment the enforce line; the integration guide has the full checks and the login fields, and rolling out fraud detection in stages covers the switch.

Your server

// Before your signup handler creates the account
// Watch mode first: log the verdict, always continue, fail open
const body = req.body || {};  // sentinel.js adds monocle + sentinel_fp to your form
let risk = null;
try {
  const verdictRes = await fetch('https://maskbreak.com/v1/evaluate', {
    method: 'POST',
    signal: AbortSignal.timeout(5000),
    headers: {
      'Authorization': 'Bearer ' + process.env.MASKBREAK_API_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      token: body.token || body.monocle,  // network evidence
      fingerprintEventId: body.fingerprintEventId || body.sentinel_fp,  // device evidence
      tz: body.tz || body.sentinel_tz,
      email: body.email  // throwaway check, and a score with email intelligence on
    })
  });
  if (verdictRes.ok) risk = await verdictRes.json();
} catch {}  // unreachable or timed out: your handler still runs
console.log('[maskbreak]', JSON.stringify({
  decision: risk?.decision ?? null, reasons: risk?.reasons ?? null,
  risk_score: risk?.risk_score ?? null, degraded: risk ? !!risk.degraded : null
}));
// Enforce later: if (risk?.decision === 'block') return res.status(403).json({ error: 'Signup declined' });

With the public key sk_test_sandbox and no account, the token test_clean answers allow, test_vpn review, and test_proxy and test_tor block, so you can run each path before real traffic.

What it can’t see

The card itself: Maskbreak doesn’t see card numbers, chargebacks or payment history, and doesn’t score a payment. In front of checkout it catches the proxy, the bot or the reused device behind a card-testing run; keep your payment provider’s own checks for the card.
Fraud done by hand: A person at a real browser on a home connection looks like a customer. What can give it away is a device or an address shared across several of your accounts, which needs the accountId you send.
A visit without the script: A bot that posts straight to your server never runs the script, so the answer has no device part and says degraded: true: treat it as unverified, not clean. A bare IP lookup covers only Tor exits and cloud servers.

Fraud detection API questions

Is there a free fraud detection API?

Yes. Maskbreak’s Free plan has 10,000 visitor checks and 100,000 IP address lookups a month, and 3 email and phone checks a day, with every signal and no card. Paid plans start at €29 a month for 50,000 checks; the pricing page has the rest.

Is it a fraud detection API or a fraud prevention API?

Both halves are there, split on purpose. Maskbreak detects: it answers allow, review or block, with the reasons. Your server prevents: it lets the visitor in, asks for one more step such as an email code, or refuses them. Maskbreak never blocks anyone by itself, which is why setup can start in watch mode.

Can it stop signup fraud without a CAPTCHA?

It checks each signup for proxies, bots, fake browsers and throwaway email addresses and, when you send your own account ID, for a device already used for several of your accounts. The answer goes to your server and the visitor sees no puzzle; you choose what a review means, such as an email code.

How accurate is it?

We haven’t published a detection rate, because we haven’t run a controlled benchmark we’d stand behind. Run it in watch mode on your own traffic, and count real customers who were flagged as well as fraud that got through.

Check your signups, logins and checkouts for fraud

Setup starts in watch mode, so nobody is blocked until you turn blocking on.

Create free account Read the docs