Should we check buyers and sellers differently?

Usually yes. Sellers control payouts and listings, so check them on more events. Buyers can be checked at login from new devices or before high-value orders.

What do the breach flags mean?

Each breach includes flags such as IsVerified, IsSpamList, IsMalware and IsStealerLog. They describe the source and reliability of the breach, so you can weigh entries differently.

How fast can we run checks during a fraud wave?

Each account can make 60 requests per minute. During spikes, prioritize the riskiest events and queue the rest, respecting the Retry-After header on any 429 response.

Email breach checks · Marketplaces

Email breach checks for marketplace trust and safety

On a marketplace, takeover risk concentrates around a few actions: a seller changing payout details, a dormant seller suddenly listing many items, or an account starting to send unusual volumes of messages. Checking the account email against known breaches at those moments helps your trust and safety rules tell ordinary account activity apart from a likely takeover.

The Finowl email breach API returns each breach with its date and exposed data classes, so reviewers can see whether passwords were part of the leak and how recent it was. That detail helps a trust and safety analyst decide quickly whether to ask the seller for confirmation or to let a payout change proceed.

Try it in the sandbox About email breaches

USE CASES

Where it fits in marketplaces

Payout method changes
Check the seller’s email whenever payout details change. If it appears in password-exposing breaches and the session is new, hold the change until the seller confirms it through an existing trusted channel.
Dormant seller reactivation
When a seller account that has been quiet for months suddenly creates many listings, add a breach check to the review rules and request re-authentication before listings go live.
Messaging abuse detection
Combine breach status with message volume and link patterns to spot compromised accounts used for off-platform payment scams, and require verification before more messages are sent.
Seller onboarding guidance
At seller signup, use the breach result to encourage multi-factor authentication with a short explanation of why protecting payouts matters, before the first sale is made.

HOW TO INTEGRATE

The workflow

1
Put FINOWL_API_KEY in the trust and safety service that evaluates sensitive account events.
2
Call POST /v1/breaches/email for payout changes, reactivations and messaging anomalies.
3
Extract the number of breaches with Passwords in DataClasses and the most recent BreachDate.
4
Feed those fields into your review rules or case management tool as supporting context.
5
Record outcomes of reviewed cases so you can tune how much weight breach data receives.

POST /v1/breaches/email

curl https://api.finowl.co/v1/breaches/email \
  -H "Authorization: Bearer $FINOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "vintage.seller@example.com"
}'

Use the breach list as supporting context for payout and listing reviews. Each lookup costs 1 credit, and a not-breached result is also returned normally.

GOOD PRACTICE

Before you ship

Breach exposure is common among legitimate sellers. Use it to trigger confirmation steps, and avoid suspending accounts or withholding earnings based on breach data alone.
Limit internal access to breach details to trust and safety staff, and describe breach screening in your privacy notice for both buyers and sellers.
Explain friction in plain words. Sellers accept a confirmation step for payout changes more readily when you say it protects their earnings.

Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.

A FEW GOOD QUESTIONS

Common questions