Will email breach checks slow down checkout?

Only if you call them on every order. Most stores check at login, address change or redemption time, and cache results, so the typical checkout path never waits on the API.

What if the shopper’s email is not breached?

The API returns breached false with an empty breaches array. That means no known exposure, not a guarantee of safety, so keep your usual device and velocity checks in place.

How should we budget credits for a busy store?

Each check costs 1 credit after the 100 free monthly credits. Prepaid packs range from 10,000 credits for $29 to 1,000,000 for $399, and credits never expire.

Email breach checks · E-commerce

Email breach checks for online stores and shopper logins

Most account takeovers at online stores start with an email address that already sits in a breach dump. The Finowl email breach API returns whether an address appears in known breaches, which ones, and what data each exposed. A store can use that context to decide when a login, a new shipping address or a large loyalty redemption deserves a second look.

The goal is precision, not suspicion. A shopper with a long breach history who logs in from their usual device and ships to their usual address is fine. The same shopper redeeming every point to a new address from a new country is a different story, and that is where a quick one-time code earns its place.

Try it in the sandbox About email breaches

USE CASES

Where it fits in e-commerce

Guarding loyalty redemptions
Before a large points redemption or gift card transfer, check the account email and require a one-time code when it appears in breaches that exposed passwords and the session looks unfamiliar.
New shipping address confirmation
When an account adds a delivery address and places a high-value order, combine the breach result with order value and device history to decide whether to send a confirmation email first.
Guest-to-account conversion
When a guest shopper creates an account after checkout, use the breach result to encourage a strong unique password or passkey with a short, positive security message.
Customer service verification
Show agents a simple breach indicator inside the help desk so requests to change email, address or payment details on exposed accounts get one extra verification question.

HOW TO INTEGRATE

The workflow

1
Store your Finowl API key as FINOWL_API_KEY in the environment of your account or fraud service.
2
Trigger POST /v1/breaches/email on events that matter, such as redemptions, address changes and logins from new devices.
3
Cache the result per email for a sensible period so repeat events in one session do not spend extra credits.
4
Convert breach count and exposed DataClasses into a risk score your checkout rules already understand.
5
Show friction only when the combined score crosses your threshold, and log the decision for later tuning.

POST /v1/breaches/email

curl https://api.finowl.co/v1/breaches/email \
  -H "Authorization: Bearer $FINOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "loyal.shopper@example.com"
}'

A breached result lists each breach with BreachDate and DataClasses. Use it with order and device signals, not on its own. 1 credit per lookup.

GOOD PRACTICE

Before you ship

Seasonal traffic can push lookups past 60 requests per minute. Check only risk-relevant events and honor the Retry-After header on 429 responses instead of hammering the API.
Breach data is linked to a shopper’s email, so mention breach screening in your privacy notice and avoid storing full breach details longer than your fraud review needs.
Never tell a shopper their email was in a specific breach at checkout. Use neutral wording such as we need to confirm it is you to keep the experience calm.

Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.

A FEW GOOD QUESTIONS

Common questions