FinowlEmail breach checks · Crypto exchanges
Email breach checks for crypto exchanges
An exchange account tied to an email that appears in breach data is more likely to face credential stuffing, phishing and SIM-swap follow-up attacks. Finowl checks the address against Finowl Intelligence and returns each breach with its date, data classes and verification status. A breach that exposed passwords, or a stealer log entry flagged by IsStealerLog, is a strong signal that the account deserves stricter controls.
Exchanges can turn that signal into proportionate friction. Require hardware key or authenticator app enrollment for exposed accounts, lengthen the cooling-off period after a withdrawal address change, or route new API key creation through extra confirmation. The response is plain JSON that fits easily into an existing rules engine, so the risk team can tune thresholds without redeploying the onboarding flow.
USE CASES
Where it fits in crypto exchanges
Withdrawal address change holds
When an account with a breached email adds a new withdrawal address, apply a longer hold and email confirmation, giving the real owner time to react before funds can move on chain.
Stronger two-factor at onboarding
At signup, require authenticator app or hardware key enrollment instead of SMS codes when the email appears in breaches that exposed passwords or in stealer logs.
API key creation review
Before generating trading API keys with withdrawal or trade permissions, check the account email and require additional confirmation if new exposure has appeared since the account was created.
Support-led recovery
When users report unauthorized trades, support agents can see whether the account email appears in recent breaches, which helps them prioritize takeover investigations and guide recovery.
HOW TO INTEGRATE
The workflow
- 1
Add FINOWL_API_KEY to the secrets used by your risk service and call Finowl only from the backend.
- 2
Call POST /v1/breaches/email at signup and again before withdrawal address changes or API key creation.
- 3
Score the result using breached, IsVerified, IsStealerLog and BreachDate alongside device and IP signals.
- 4
Apply a step-up policy such as a withdrawal hold or hardware key requirement when the score crosses your threshold.
- 5
Retry rate-limited calls after Retry-After, and avoid resending requests that returned 5xx since they may already be charged.
curl https://api.finowl.co/v1/breaches/email \
-H "Authorization: Bearer $FINOWL_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"email": "satoshi.trader@example.com"
}'Runs before a user adds a new withdrawal address. If breached is true with Passwords or IsStealerLog, apply a withdrawal hold and require authenticator confirmation.
GOOD PRACTICE
Before you ship
Do not block signups solely on breach status. Many legitimate users have old breached addresses, so use the result to require stronger authentication rather than to deny service.
Breach data about customers is personal data. Disclose the check in your privacy notice, keep results in your risk system only, and retain the minimum needed for audit.
Explain holds clearly. Users accept a withdrawal delay more readily when the message says their email appeared in a public breach and the delay protects their funds.
Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.
A FEW GOOD QUESTIONS
Common questions
More for crypto exchanges
Email breach checks for crypto exchanges
Start with 100 free credits every month and test the request above in the sandbox.