About the Device Fraud Risk Reasons API

The Device Fraud Risk Reasons API retrieves the current list of reasons a device may be considered risky by the Device Fingerprint API. The Device Fingerprint API returns a reasons array containing enums that identify the detected risk factors. You can use the Device Fraud Risk Reasons API to programmatically retrieve detailed descriptions of these reasons as needed. Keeping these descriptions in a separate API prevents the Device Fingerprint API from returning unnecessary data that could increase response times.

Using the API

The Device Fraud Risk Reasons API can provide data in JSON or raw format.

JSON

https://www.ipqualityscore.com/api/json/deviceriskreasons/list

Raw

https://www.ipqualityscore.com/api/raw/deviceriskreasons/list

Example Response

Below is an example of the JSON response. The raw response is similar but uses a new line delimited colon-separated list instead.

{
   "message":"Device Fraud Risk Reasons",
   "success":true,
   "reasons":{
      "FR_RECENT_ABUSE":"User has engaged in recent abuse",
      "FR_DEVICE_ABUSE":"This device has engaged in recent abuse across the IPQS network",
      "FR_MALICIOUS":"Malicious browser settings detected",
      "FR_BROWSER_SETTINGS":"Abnormal browser settings detected",
      "FR_SUSPECT_BROWSER":"Suspicious browser configuration",
      "FR_BROWSER_SPF":"Suspicious device settings, possible browser spoofing",
      "FR_LOW_RISK_SPF":"Possible Browser Spoofing - Low Risk",
      "FR_COUNTRY":"User is likely to be located in another country",
      "FR_LOCATION":"Suspicious device settings, likely spoofing location",
      "FR_LOCATION_SPOOF":"User is likely spoofing their location",
      "FR_PROXY":"Proxy connection or anonymizer detected",
      "FR_CONN_LATENCY":"User exhibiting abnormal connection latency, likely VPN\/Proxy",
      "FR_HIGH_RISK":"This device is exhibiting higher risk behavior patterns",
      "FR_PACKETS":"User is sending random packets to server",
      "FR_RISKY_CONNECTION":"User has an abnormal connection",
      "FR_CONNECTION":"Irregular connection detected",
      "FR_RISKY_BOT":"Bot Detected - High confidence of being an automated request by a bot or malicious program",
      "FR_HUMAN_BOT":"Human-like bot detected with risky behavior",
      "FR_BOT":"Bot Detected - High confidence of being an automated request by a bot or program",
      "FR_RES_PROXY":"High confidence of a residential proxy in use",
      "FR_FRAUD_RING":"User active in a known fraud ring",
      "FR_CONFIG":"Irregular Configuration Settings",
      "FR_BOT_BEHAVIOR":"User is exhibiting behavior of a bot",
      "FR_DEVICE_SWAP":"User is frequently changing devices",
      "FR_DEVICE_SETTINGS":"User has suspicious device settings",
      "FR_DEVICE_SPOOFING":"Suspicious device settings indicating possible device spoofing",
      "FR_MOBILE_EMU":"Mobile emulator detected, user is spoofing their device settings",
      "FR_CLICKJACK":"Request generated via iframe, possible clickjacking or misleading placement",
      "FR_RANDOMIZER":"User has software enabled to randomize their digital footprint",
      "FR_SPOOFING":"User is intentionally spoofing their device and digital signature",
      "FR_SOFTWARE":"Software enabled to facilitate device spoofing and fraudulent behavior",
      "FR_ADBLOCK":"User has AdBlock enabled",
      "FR_TOR":"User is on a TOR connection",
      "FR_VPN":"VPN connection or anonymizer detected",
      "FR_UNIQUE":"User is not unique",
      "FR_ABNORMAL":"User made an abnormal request",
      "FR_VM":"Virtual machine detected, likely a fraudulent user",
      "FR_EMULATOR":"Emulator detected, user is spoofing their device settings",
      "FR_FAKE_DEVICE":"Suspicious device settings, user is likely using a fake device",
      "FR_IP_SWITCH":"User frequently changes IP addresses and devices",
      "FR_IP_DANGER":"User is changing IP and devices extremely frequently.",
      "FR_DNT":"User has do not track enabled",
      "FR_SOURCE":"Traffic source is exhibiting fraudulent patterns.",
      "FR_OS_SPOOFING":"User is spoofing their true operating system",
      "FR_OS_RESET":"Suspicious device configuration, device recently reset",
      "FR_RULE_VIOLATION":"Request flagged by custom rule."
   }
}

j/d