Should we ban accounts with breached emails?

No. Breached emails are very common among genuine members. Use the result to require a second factor or a check-in when other signals suggest takeover, not to remove people.

Can breach checks help with fake profiles?

They help mostly with taken-over genuine profiles. Fake profiles created from scratch need other signals, so treat breach data as one input in your wider safety system.

How should we tell members about exposure?

Send a private, calm in-app or email notice suggesting a new password and two-factor authentication. Avoid naming specific breaches in the app interface.

Email breach checks · Dating apps

Email breach checks for dating app account safety

Romance scams increasingly rely on taken-over profiles rather than obviously fake ones. A login from a new country, followed by changed photos and a wave of new conversations, is a familiar pattern. Checking the member’s email against known breaches at that first login gives your safety systems a reason to ask for verification before the profile is used to contact others.

The Finowl email breach API returns breach names, dates and exposed data classes, so your trust and safety team can see whether passwords leaked and how recently. The result is one signal among many: it should prompt a second factor or a check-in with the member, never an automatic ban or a public flag on their profile.

Try it in the sandbox About email breaches

USE CASES

Where it fits in dating apps

New-device login checks
When a member signs in from an unfamiliar device or country, check their email and require a one-time code if it appears in breaches that exposed passwords, before messages load.
Profile change monitoring
Sudden changes to photos, bio and location after a risky login are classic takeover signs. Add breach status to the rules that decide when to pause a profile pending member confirmation.
Safety team investigations
When matches report a profile for suspicious messages, show investigators the account email’s breach history to help distinguish a compromised genuine member from a deliberately fake profile.
Subscription change protection
Before changing the email or payment method attached to a paid subscription, check the email and ask for re-authentication when exposure and session risk both look elevated.

HOW TO INTEGRATE

The workflow

1
Keep FINOWL_API_KEY in the backend service that handles authentication and safety rules.
2
Call POST /v1/breaches/email for new-device logins, contact email changes and profiles reported by other members.
3
Summarize the result into a breached flag, password-exposing breach count and latest BreachDate.
4
Combine that summary with device, location and messaging signals to decide on step-up verification.
5
Notify affected members privately with clear steps to secure their account.

POST /v1/breaches/email

curl https://api.finowl.co/v1/breaches/email \
  -H "Authorization: Bearer $FINOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "member.safety@example.com"
}'

Returns breached and a list of breaches with exposed data classes. Use it to trigger private verification, not public flags. 1 credit per lookup.

GOOD PRACTICE

Before you ship

Never expose breach status to other members or show it on profiles. It is sensitive context about a person and belongs only in private safety workflows.
Dating data is especially sensitive. Mention breach screening in your privacy notice, limit staff access and keep only the summary your safety rules need.
Communicate gently. A message that explains you noticed unusual activity and want to keep conversations private works better than alarming language about breaches.

Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.

A FEW GOOD QUESTIONS

Common questions