Frequently asked questions
Everything about fraud detection, VPN and disposable-email checks, IP risk scoring, and using the LayerCall API. Can't find your answer? Ask us.
Getting started
What is LayerCall?
LayerCall is a risk-scoring and fraud-detection API for developers. You send an IP address, email, phone number, or domain — or a whole signup at once — and LayerCall returns a 0–100 risk score plus a clear allow, review, or block verdict, along with every underlying signal, in a single API call. It's built to stop fake signups, bots, and fraud without slowing down or blocking your real users.
What is a fraud-detection or trust-signals API?
A fraud-detection API is a service you call from your backend to check whether a user or transaction looks risky before you let it through. Instead of building and maintaining your own blocklists, geolocation, and abuse databases, you send the data point (IP, email, phone, or domain) to the API and get back a risk assessment. It's the fastest way to add fraud prevention to a signup form, checkout, or login flow.
How does LayerCall work?
Your server makes a single HTTPS request to a LayerCall endpoint with the value you want to check and your API key. LayerCall evaluates dozens of signals — VPN/proxy/Tor detection, IP reputation, disposable-email and domain-age checks, phone validity, and its own first-seen reputation network — then returns a JSON response with a risk score, a verdict, and the reasons behind it. You then decide what to do: allow the user in, challenge them with extra verification, or block.
Is there a free tier, and do I need a credit card?
Yes. Every account includes 1,000 free lookups per month with no credit card required — you can integrate and ship to production entirely on the free tier. Paid plans start at $49/month for 20,000 lookups with transparent, published overage rates when you grow.
How do I get an API key and integrate LayerCall?
Sign in with Google or a one-time email link, and your account and API key are created instantly. From there it's a single request — for example a GET to /v1/score/ip or a POST to /v1/score/user with an IP, email, and phone. Most teams are live in about five minutes; every endpoint in the docs has copy-paste code.
How much does a fraud-detection API cost?
Pricing across the market ranges from free tiers up to enterprise contracts. LayerCall keeps it transparent: Free ($0, 1,000 lookups), Starter ($49, 20,000), Growth ($199, 100,000), and Scale ($749, 500,000), each with a published per-lookup overage rate. Cached and test-mode lookups are always free and never count toward your limit.
IP intelligence
How do I detect if an IP address is a VPN or proxy?
Send the IP to LayerCall's /v1/score/ip endpoint and it returns whether the address belongs to a known VPN, public proxy, or anonymizing service, along with a risk score. LayerCall combines commercial VPN/proxy ASN data, a maintained list of VPN and datacenter IP ranges, and its own proxy-reputation layer that grows from network reports — so it catches services that a single static list would miss.
What is an IP reputation or IP risk score?
An IP risk score is a 0–100 rating of how likely traffic from that IP is to be fraudulent or abusive, based on signals like whether it's a VPN, proxy, Tor exit, or datacenter IP, its geolocation and ASN, and any history of abuse reports. A higher score means higher risk. LayerCall returns this score plus the specific reasons, so you can set your own thresholds for allow, review, and block.
Can you detect Tor exit nodes?
Yes. LayerCall flags connections coming from Tor exit nodes and scores them as elevated risk, because Tor is frequently used to hide identity during fraud and abuse. Tor is treated as a strong signal but is configurable via strictness levels, so you can choose to review Tor traffic rather than block it outright.
What is a datacenter IP and why does it matter for fraud?
A datacenter IP belongs to a hosting or cloud provider (like AWS, Google Cloud, or a VPS host) rather than a residential ISP. Real human customers almost never sign up directly from a datacenter IP — bots, scrapers, and automated fraud usually do. LayerCall identifies datacenter ranges and factors them into the risk score, while being careful not to over-penalize legitimate VPN users.
How accurate is IP geolocation, and where does the data come from?
IP geolocation reliably identifies the country and region of most IP addresses, and is less precise at the city level — that's an industry-wide limitation, not specific to any vendor. LayerCall uses DB-IP's geolocation database plus ASN data, refreshed regularly. Geolocation is one input to the risk score, combined with reputation and network signals for a fuller picture.
Email & signups
How do I detect disposable or temporary email addresses?
Send the email to LayerCall's /v1/verify/email endpoint and it flags whether the domain is a known disposable or temporary email provider (like Mailinator or 10-minute-mail services). Disposable emails are a top signal of throwaway accounts used for free-trial abuse and spam. LayerCall maintains an up-to-date disposable-domain list and combines it with domain age and other signals.
What is email verification and how is it different from validation?
Email validation checks that an address is correctly formatted and that its domain can receive mail (valid MX records). Verification goes further — assessing whether the address is disposable, role-based, from a risky domain, or otherwise high-risk for fraud. LayerCall returns both: syntactic and domain validity, plus risk signals like disposable detection, typo suggestions, and domain age.
Can you catch fake email addresses at signup?
LayerCall catches the fake-email patterns that actually matter for fraud: disposable domains, newly-registered throwaway domains, risky TLDs, and addresses tied to abusive history in the reputation network. It's deliberately calibrated not to block legitimate new founders using a fresh domain — new-domain signals cap at 'review' rather than an automatic block, so you don't lose real customers.
What is a role-based email and should I block it?
A role-based email is an address tied to a function rather than a person — like info@, support@, or admin@. They're normal for businesses but are more likely to be shared or unmonitored, so many teams treat them as slightly elevated risk rather than blocking them. LayerCall flags role-based addresses so you can decide based on your use case.
Phone & domain
How do I validate a phone number with an API?
Send the number to LayerCall's /v1/lookup/phone endpoint and it checks whether the number is valid and correctly formatted for its country, identifies unassigned or impossible number ranges, and returns a risk assessment. This catches made-up numbers and clearly invalid inputs at signup before they pollute your database or CRM.
How do I check if a domain is newly registered?
LayerCall's /v1/score/domain endpoint looks up the domain's registration date via RDAP (the official successor to WHOIS) and returns its age in days. Very new domains are a meaningful fraud signal — fraudsters often register a domain minutes before creating an email on it. LayerCall grades domain age gradually and caps its impact at 'review' so genuine new startups aren't blocked outright.
What is a risky TLD?
A risky TLD is a top-level domain (the part after the last dot, like .top, .xyz, .click, or .online) that is disproportionately used for spam and fraud because it's cheap or loosely regulated. LayerCall flags risky TLDs as one input to the domain and email risk score — not as an automatic block, since plenty of legitimate businesses use them.
Use cases & how-to
How do I stop fake or bot signups on my website?
Add one API call to your signup backend: send the visitor's IP, email, and (optionally) phone to LayerCall's /v1/score/user endpoint, then act on the verdict — allow the user in, require email or captcha verification on 'review', or reject on 'block'. This filters out bots and fake accounts invisibly, without adding friction for your real users, and typically pays for itself the first time it stops a signup-spam wave.
How do I prevent free-trial abuse?
Free-trial abuse usually comes from disposable emails, VPN/proxy IPs, and users creating many accounts. LayerCall detects all three: disposable and throwaway domains, anonymizing IPs, and repeat/abusive values via its first-seen reputation network. Score each trial signup and require extra verification or block the ones that look like abuse before they consume your resources.
How can a fraud API reduce chargebacks and payment fraud?
Card-testing bots and fraudulent buyers often share tells — anonymizing IPs, disposable emails, and mismatched signals. By scoring the signup or checkout with LayerCall and challenging or blocking high-risk attempts, you stop many fraudulent transactions before they happen, reducing chargebacks and the fees and account risk that come with them.
How do I integrate a fraud-detection API into my signup flow?
On your server, when a signup is submitted, make a single request to LayerCall with the visitor's IP (from the request headers), email, and phone, using your secret API key. Read the returned verdict: 'allow' → create the account, 'review' → send an email/OTP or captcha challenge, 'block' → reject with a friendly message. The whole check adds only a few milliseconds and is completely invisible to the end user.
Data, privacy & accuracy
Is LayerCall GDPR compliant, and do you store personal data?
LayerCall is designed to minimize personal data. Its reputation network stores only a one-way SHA-256 hash of observed values — never raw IP addresses, emails, or phone numbers — so there is no personal data in it to expose. See our Privacy Policy for how account and usage data are handled and how to exercise your data rights.
How fast is the LayerCall API?
Repeat lookups are served from cache in under 0.003 seconds, and first-time lookups typically complete in well under a second. The check runs server-to-server and is invisible to your end users. Cached and test-mode lookups never count toward your quota or bill.
What data sources power the risk scores?
Most signals come from authoritative, first-party sources rather than resold aggregates: registration data straight from the registries over RDAP, exit-node lists published by the VPN operators themselves, the Tor Project's official exit list, IP ranges published by AWS, Google Cloud, Oracle, Cloudflare and other hosts, ASN records verified against RIPE, DB-IP geolocation, libphonenumber numbering plans, and maintained disposable-email domain lists. LayerCall also runs its own first-seen reputation network, which records how often a hashed value has been seen and any confirmed-fraud reports; it starts empty for a new deployment and strengthens as traffic grows, so it adds little on day one and more over time.
How is LayerCall different from other fraud-detection APIs?
LayerCall keeps the instant, self-serve, transparent-pricing model developers expect, and focuses on what actually reduces friction and cost: a genuinely clear card-free free tier, one-click Google sign-in, separate live and test API keys, and fair billing where cached and test lookups never count. It's developer-first with public pricing and no mandatory sales demo — you can evaluate and ship the same day, rather than sitting through an enterprise onboarding.
Start free — 1,000 lookups/month
No credit card. Score any IP, email, phone, or domain for fraud in one API call.
Get your free API key →