Should a fintech app block signups from breached emails?

Usually not. Most active email addresses appear in at least one breach. Use the result to require stronger authentication and to inform risk scoring, and keep blocking decisions for combinations of strong fraud signals.

How much does an email breach check cost?

Each lookup costs 1 credit. Every account gets 100 free credits each month, and prepaid packs start at 10,000 credits for $29 with credits that never expire.

What happens if we exceed the rate limit during a login spike?

The API allows 60 requests per minute per account and returns 429 with code rate_limited and a Retry-After header. Check only higher-risk events and fall back to your standard controls when throttled.

Email breach checks · Fintech

Email breach checks for fintech signups and logins

When a customer signs in from a new device or asks to change a payout account, knowing that their email address shows up in several breaches is a useful risk signal. The Finowl email breach API returns each breach with its date and the data classes exposed, such as passwords or phone numbers, so your risk engine can weigh how likely it is that credentials were leaked alongside the address.

Fintech teams typically call the endpoint at signup, on suspicious logins and inside support tooling. A breached result should not block a customer on its own; it raises the bar. Combine it with device signals, velocity checks and multi-factor prompts, and treat a clean result as the absence of known exposure rather than proof that the account is safe.

Try it in the sandbox About email breaches

USE CASES

Where it fits in fintech

Step-up authentication on risky logins
If the email has breaches that exposed passwords and the login comes from an unfamiliar device, require a one-time code or passkey before showing balances or allowing transfers to new payees.
Payout and bank-change reviews
Before changing the bank account that receives withdrawals, check the customer’s email and route requests with recent password-exposing breaches to an additional confirmation step or a manual review queue.
Onboarding risk scoring
Add breach count, most recent BreachDate and exposed DataClasses as features in your onboarding risk model, alongside device and velocity signals, rather than relying on any single input to decide.
Proactive customer security notices
Prompt customers whose email appears in a newly added breach to review their password and enable multi-factor authentication, with clear in-app guidance instead of alarming language.

HOW TO INTEGRATE

The workflow

1
Create an API key in the Finowl dashboard and store it as FINOWL_API_KEY in your secrets manager.
2
Call POST /v1/breaches/email from your authentication service when a login or payout change crosses your risk threshold.
3
Filter the breaches array on IsVerified and on DataClasses that include Passwords to build a weighted signal.
4
Feed the signal into your existing rules engine to decide between allowing, stepping up or queuing for review.
5
Handle 429 responses by waiting for the Retry-After seconds, and fail open to your normal controls if Finowl is unavailable.

POST /v1/breaches/email

curl https://api.finowl.co/v1/breaches/email \
  -H "Authorization: Bearer $FINOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "payments.customer@example.com"
}'

Returns breached true or false plus a breaches array with dates and exposed data classes. Each lookup costs 1 credit.

GOOD PRACTICE

Before you ship

A breached email is common and does not mean fraud. Use it to add friction such as multi-factor prompts, not to deny accounts or freeze funds on its own.
Treat the email address as personal data, mention breach screening in your privacy notice and keep only the derived signal you need for risk decisions and audit trails.
Unverified breaches are included in results. Weight entries with IsVerified false lower so customers are not challenged repeatedly because of uncertain data.

Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.

A FEW GOOD QUESTIONS

Common questions