Should we check every booking?

Most travel brands check at logins from new devices and before redemptions or sensitive changes, not on every search or booking. That keeps costs low and the guest experience smooth.

Can breach checks help with refund fraud?

They add context. A breached email combined with a refund redirected to a new payment method is a stronger signal than either on its own.

How quickly can we integrate?

It is a single POST with a JSON body. The quickstart at docs.finowl.co/quickstart covers authentication and a first request.

Email breach checks · Travel and hospitality

Email breach checks for loyalty and booking accounts

In travel, the most damaging account takeovers happen at redemption time. Checking a member's email against Finowl Intelligence before a large points redemption, a change of traveler name or a refund to a new payment method gives your fraud team a useful signal. The response lists each breach, when it happened and which data classes were exposed, so you can tell an old spam list from a breach that leaked passwords.

Use the result to add proportionate checks. A member with a breached address redeeming points for a gift card could receive a one-time code by email, while a routine booking goes through without friction. For guest services, seeing that an address appears in recent breaches helps agents decide whether a disputed redemption looks like takeover and how to restore the member's balance.

Try it in the sandbox About email breaches

USE CASES

Where it fits in travel and hospitality

Redemption step-up
Before points are redeemed for gift cards, partner transfers or high-value stays, check the member email and require a one-time code if it appears in breaches that exposed passwords.
Traveler name change review
When a booking's traveler name or contact details change shortly before departure, combine breach status with device signals to decide whether to confirm the change with the original account holder.
Dormant account reactivation
When a member logs in after a long gap, check their email and prompt a password refresh if it has appeared in breaches since their last visit.
Guest services investigations
Give guest services agents breach context when members report missing points or unknown bookings, helping them recognize account takeover patterns quickly and prioritize restoring balances for affected members.

HOW TO INTEGRATE

The workflow

1
Store FINOWL_API_KEY in your loyalty platform's backend configuration, not in mobile or web clients.
2
Call POST /v1/breaches/email before redemptions, traveler changes and logins from new devices.
3
Use breached, DataClasses and BreachDate to rate risk alongside session, device and velocity signals.
4
Trigger a one-time code or a short redemption hold when risk crosses your threshold.
5
Respect 429 Retry-After values during seasonal peaks and cache results briefly for repeat events.

POST /v1/breaches/email

curl https://api.finowl.co/v1/breaches/email \
  -H "Authorization: Bearer $FINOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "frequent.flyer@example.com"
}'

Runs before a loyalty member redeems points for a gift card. If the address appears in a password-exposing breach, send a one-time code before the redemption completes.

GOOD PRACTICE

Before you ship

Most members with breached emails are legitimate travelers. Use the signal to add a quick verification step, not to cancel bookings or freeze balances without review.
Guest data is personal data under many privacy laws. Disclose breach checks in your privacy notice and keep results in fraud systems, not marketing profiles.
Time friction carefully. Prompting at redemption or on new devices protects members without slowing down searches, check-in or routine booking.

Read the API reference for every field and error code. Each lookup costs 1 credit; see pricing.

A FEW GOOD QUESTIONS

Common questions