Buyer’s guide

How to choose a fraud detection API

Five questions that decide it, what to check for each, and the cases where you should buy from someone else.

We make LayerCall, so we are not a neutral referee — read this as an interested party’s guide. What we can do is keep it checkable: every claim below is about the category, not a swipe at one vendor, and you can verify each one against whichever providers you are shortlisting in about a minute each.

Can you actually spend the free tier?

A free tier is an evaluation budget, and the headline number is usually monthly. Several providers also enforce a daily cap underneath it. A thousand lookups a month metered at thirty-five a day cannot be spent in a burst — which is exactly what a day of integration work is — so the allowance that sold you is not the allowance you get.

What to check

Find the daily or per-minute cap, not just the monthly figure.
Check whether the free tier covers every endpoint or only the cheapest one.
Check whether a card is required before the free tier starts.
Check what happens at the limit: hard stop, throttle, or silent billing.

Where we stand: 1,000 lookups a month across every endpoint, no daily cap, no card. At the limit it stops rather than billing you.

One vendor, or several stitched together?

Some providers sell each check as its own product: IP geolocation here, email validation there, phone lookup somewhere else, each with a separate key, quota, dashboard and invoice. Screening one signup across three signals then means three integrations, three bills, and correlation logic you write and maintain yourself.

What to check

Does one key cover every signal, or one key per product?
Is there a single combined verdict, or three unrelated answers you reconcile?
Does the quota pool across checks, or does each product meter separately?
If you add a fourth signal later, is that a new contract?

Where we stand: One key, one quota, one bill, one verdict across IP, email, phone, domain and device. Cross-signal patterns — a device reappearing on a new email and IP — only exist because the signals share a system.

Do you get a score, or the reasons behind it?

A bare number is unappealable. When a customer writes in asking why they were blocked, 'our vendor said 87' is not an answer you can give them, and it is not something you can tune. It also makes the vendor impossible to evaluate: you cannot tell a good score from a lucky one without seeing what drove it.

What to check

Does the response include the individual signals, or only a total?
Can you see which signal moved the score, and by how much?
Can you set your own thresholds, or is the verdict fixed?
Can you replay a past decision to see why it went that way?

Where we stand: Every signal behind the score is returned, with an explicit allow/review/block verdict and adjustable strictness. You can reconstruct any decision.

What does the price do when you grow?

Per-lookup pricing and credit pricing look comparable at the tier you are shopping and diverge sharply above it. Credits are often weighted per endpoint, so a 'lookup' costs a different amount depending which one you call — which makes your bill unpredictable precisely when volume is rising.

What to check

Is overage published, or do you find out at renewal?
Do all endpoints cost the same, or are credits weighted?
Is there a cap you can set so a bad month cannot run away?
What happens if you cancel mid-cycle having already overrun?

Where we stand: Flat published per-lookup overage, the same for every endpoint, with a spend cap you set yourself.

Can you test without spending or polluting?

CI runs the same request hundreds of times a week. If test traffic bills like production, evaluation costs real money before you have shipped anything. If test traffic also writes to a shared fraud network, your fixtures start teaching the vendor's model that a made-up address is suspicious.

What to check

Is there a test key, and does it bill?
Does test mode return real data or clearly-marked synthetic data?
Does test traffic write to any shared or reputation dataset?
Are the test fixtures documented, so you can assert on them?

Where we stand: Test keys return deterministic synthetic data, labelled as such in the response. They never bill, never hit live data sources, and never write to the shared network.

When you should buy from someone else

A general trust API is the wrong purchase in at least four situations. If you are in one of them, a specialist will serve you better and we would rather say so.

Device identification

If recognising a returning browser through cleared cookies and evasion is the whole problem you are solving, a dedicated device-identity vendor will beat a general trust API at it. Plenty of teams run one for the browser and a trust API for everything else about the signup.

IP data itself

If you want accurate geolocation or ASN as data — or a database to host and query offline at volume — an IP data specialist is the right purchase. We score addresses; we do not sell you the atlas.

Bulk list cleaning

If you are validating a marketing list of millions of addresses in one pass, a dedicated verification vendor is priced for that shape of work. A per-lookup trust API is not.

A single check, forever

If you genuinely only ever need one thing — say, email syntax and deliverability, and nothing else — a single-purpose API will be cheaper than a platform whose value is breadth.

Where LayerCall fits

One call scores a whole signup — IP, email, phone, domain and device — and returns an allow/review/block verdict with every signal behind it. One key, one quota, one bill. 1,000 lookups a month free, no card, no daily cap.

Get a free key Try it without signing up

Questions

What should I check first when comparing fraud detection APIs?

The daily cap on the free tier. Providers advertise a monthly allowance, and several meter it daily underneath — a thousand lookups a month capped at thirty-five a day cannot be spent in the burst that real integration testing looks like. It is the single most common gap between the number that sold you and the number you get.

Is it better to use one API or separate ones for IP, email and phone?

Separate APIs are cheaper if you genuinely only need one check forever. Once you need two or more on the same signup, separate vendors mean separate keys, quotas, invoices and integrations, plus correlation logic you write yourself — and cross-signal patterns, like a device reappearing on a new email and IP, are invisible to any of them individually.

Why does it matter whether an API returns the signals or just a score?

A bare score is unappealable and untunable. When a customer asks why they were blocked, a number is not an answer you can give them, and without the underlying signals you cannot tell a well-reasoned score from a lucky one, or adjust thresholds to fit your own risk appetite.

How much does LayerCall cost?

Free is 1,000 lookups a month with no card and no daily cap. Starter is $49 a month for 20,000 lookups, then $0.004 per extra lookup — the same rate for every endpoint, with a spend cap you set yourself.

Can I evaluate an API without being billed for test traffic?

You should insist on it. Test keys here return deterministic synthetic data, labelled as such in the response — they never bill, never hit live data sources, and never write to the shared fraud network, so CI can run freely without teaching the model that your fixtures are real.