Anti-Fraud API: Detect fraud at registration and checkout.
The LOX24 Anti-Fraud Check API analyzes IP address, email address, phone number, and postal address, and returns a risk score from 0 to 100 within seconds. This helps you spot fake B2B registrations, fraudulent orders, and suspicious logins before damage is done. You decide how to respond to the score.
- GDPR-compliant with DPA
- LOX24 servers in Europe
- Results in seconds
Submit data
Get a risk score
Set your own rules
Four data points, one risk score
The API evaluates each submitted data point and combines the results into a single score. You can send all four data points or just some of them; the price per request stays the same. The more data you submit, the more reliable the assessment.
Pay per request, no base fee
No base fee, no minimum purchase, no contract term. You top up your balance and pay per request, regardless of how many data points you submit. Choose the plan that fits your use case:
€0,02/query
- Risk score 0–100
- For logins and simple checks
€0,03/query
- Risk score 0–100
- Priority processing
- 24/7 Support
€0,04/query
- Risk score 0–100
- Detailed data on IP, email, phone, and address
- For new customer and B2B registrations
Integrated with just a few lines of code
#!/usr/bin/env bash
curl -X POST https://api.lox24.eu/fraud-checks \
-H 'Content-Type: application/json' \
-H 'X-LOX24-AUTH-TOKEN: 1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx' \
-d '{
"service_code": "pro",
"phone": "+49751234567",
"email": "test@lox24.de",
"ip": "1.1.1.1",
"address": {
"iso2": "DE",
"city": "Berlin",
"postcode": "13353",
"street_number": "109",
"street_name": "Seestraße"
}
}''direct',
'phone' => '+49751234567',
'email' => 'test@lox24.de',
'ip' => '1.1.1.1',
'address' => [
'iso2' => 'DE',
'city' => 'Berlin',
'postcode' => '13353',
'street_number' => '109',
'street_name' => 'Seestraße',
],
];
if (!$body = json_encode($body)) {
die('JSON encoding error!');
}
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_POST => true,
CURLOPT_URL => $uri,
CURLOPT_POSTFIELDS => $body,
CURLOPT_HTTPHEADER => [
"X-LOX24-AUTH-TOKEN: $token",
'Accept: application/json',
'Content-Type: application/json',
],
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 20,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
]);
$response = curl_exec($curl);
$code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);
$data = json_decode($response, JSON_OBJECT_AS_ARRAY);
if (201 === $code) {
echo 'Success: response data = ' . var_export($data, true);
} else {
echo "Error: code = $code, data = " . var_export($data, true);
}package main
import (
"bytes"
"encoding/json"
"fmt"
"io/ioutil"
"log"
"net/http"
)
func main() {
const Method = "POST"
const URL = "https://api.lox24.eu/fraud-checks"
const Token = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx"
address := map[string]interface{}{
"iso2": "DE",
"city": "Berlin",
"postcode": "13353",
"street_number": "109",
"street_name": "Seestraße",
}
payload := map[string]interface{}{
"service_code": "pro",
"phone": "+49751234567",
"email": "test@lox24.de",
"ip": "1.1.1.1",
"address": address,
}
jsonPayload, _ := json.Marshal(payload)
client := &http.Client{}
req, err := http.NewRequest(Method, URL, bytes.NewBuffer(jsonPayload))
if err != nil {
log.Fatal(err)
}
req.Header.Add("X-LOX24-AUTH-TOKEN", Token)
req.Header.Add("Content-Type", "application/json")
res, err := client.Do(req)
if err != nil {
log.Fatal(err)
}
defer res.Body.Close()
body, err := ioutil.ReadAll(res.Body)
if err != nil {
log.Fatal(err)
}
switch res.StatusCode {
case 201:
fmt.Println((string(body)))
case 400:
fmt.Println("Error: code = 400 - Invalid input")
case 401:
fmt.Println("Error: code = 401 - Client ID or API key isn't active or invalid!")
default:
fmt.Printf("Error: code = %d\n", res.StatusCode)
}
}using Newtonsoft.Json;
using System;
using System.IO;
using System.Net;
namespace Lox24.Api
{
class client
{
static void Main()
{
string key = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx";
string url = "https://api.lox24.eu/fraud-checks";
var data = new {
service_code = "direct",
phone = "+49751234567",
email = "test@lox24.de",
ip = "1.1.1.1",
address = new {
iso2 = "DE",
city = "Berlin",
postcode = "13353",
street_number = "109",
street_name = "Seestraße"
}
};
string postdata = JsonConvert.SerializeObject(data);
var httpWebRequest = (HttpWebRequest)WebRequest.Create(url);
httpWebRequest.ContentType = "application/json; charset=utf-8";
httpWebRequest.Accept = "application/json";
httpWebRequest.Method = "POST";
httpWebRequest.Headers.Add("X-LOX24-AUTH-TOKEN", key);
using (var streamWriter = new StreamWriter(httpWebRequest.GetRequestStream()))
{
streamWriter.Write(postdata);
}
using (HttpWebResponse resp = (HttpWebResponse)httpWebRequest.GetResponse())
{
if (resp.StatusCode == HttpStatusCode.Created)
Console.WriteLine("Success: request resource created");
}
}
}
}import json
import requests
token = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx"
url = 'https://api.lox24.eu/fraud-checks'
data = {
'service_code': 'pro',
'phone': '+49751234567',
'email': 'test@lox24.de',
'ip': '1.1.1.1',
'address': {
'iso2': 'DE',
'city': 'Berlin',
'postcode': '13353',
'street_number': '109',
'street_name': 'Seestraße'
}
}
headers = {
'Accept': 'application/json',
'Content-Type': 'application/json',
'X-LOX24-AUTH-TOKEN': token,
}
try:
res = requests.post(url, headers=headers, json=data, timeout=100)
if res.status_code != 201:
print("Error: Wrong response code")
res.raise_for_status()
else:
print(f'Success: code = {res.status_code} - Fraud request resource created')
print("Response: ", json.dumps(res.json(), indent=4))
except requests.HTTPError:
print(f"Error: code {res.status_code}")const token = "1234567:e3f3a759b6677959b6ebfcxxxxxxxxxx";
let postObj = {
"service_code": "pro",
"phone": "+49751234567",
"email": "test@lox24.de",
"ip": "1.1.1.1",
"address": {
"iso2": "DE",
"city": "Berlin",
"postcode": "13353",
"street_number": "109",
"street_name": "Seestraße"
}
};
let postdata = JSON.stringify(postObj);
const https = require('https');
const options = {
hostname: 'api.lox24.eu',
path: '/fraud-checks',
method: 'POST',
headers: {
'Accept': 'application/json',
'Content-Type': 'application/json',
'Content-Length': postdata.length,
'X-LOX24-AUTH-TOKEN': token
}
}
const req = https.request(options, res => {
if (res.statusCode == 201) {
console.log("Success: code = 201 - request resource created");
res.on('data', d => { process.stdout.write(d) })
}
else if (res.statusCode == 400) console.log("Error: code = 400 - Invalid input");
else if (res.statusCode == 401) console.log("Error: code = 401 - API key isn't active or invalid!");
})
req.on('error', error => { console.error(error) })
req.write(postdata);
req.end();Where businesses use the Anti-Fraud Check
Frequently asked questions about the anti-fraud check
What does the LOX24 Anti-Fraud Check API verify?
The LOX24 API checks IP address, email address, phone number, and postal address. Among other things, it detects VPNs, proxies, Tor, suspicious email domains, and implausible details, and combines everything into a risk score from 0 to 100.
How quickly are results available?
Usually within a few seconds. The check runs asynchronously: LOX24 sends the result via webhook (event fraud-check.done) or by email. Alternatively, you can query the status using the request ID.
At what score should I block a user?
That's up to you, depending on your use case and risk appetite. Many companies work with tiers: approve low scores, manually review or additionally verify medium scores, and reject high scores. LOX24 provides the assessment; you define the rule.
What plans are available?
LOX24 offers three plans: Economy at 2 cents per request delivers the risk score. Direct at 3 cents offers priority processing and 24/7 support. Pro at 4 cents also delivers detailed data on IP, email, phone number, and address.
Does a request cost more if I submit more data?
No. With LOX24, a request always costs the same within a given plan, whether you send one or all four data points. However, more data improves the accuracy of the result.
Can the check be combined with SMS verification?
Yes. Many companies use the score to request an additional factor only in suspicious cases, for example a code via SMS or voice call. Both run through the same LOX24 API with the same account access.
Is the Anti-Fraud API GDPR-compliant?
Yes. Fraud prevention is a legitimate interest under Art. 6(1)(f) GDPR. LOX24 enters into a data processing agreement (DPA) with you. LOX24 servers are located in Europe, and we use external service providers exclusively in compliance with GDPR.
Does the check also work with data from abroad?
Yes, the API also processes international IP addresses, phone numbers, and addresses. How informative the result is may vary depending on the country and available data.
Can I test the API for free?
Yes. You can register with LOX24 without obligation and receive a starting credit of 50 cents, which is enough for up to 25 test requests.
Is there a contract term?
No. With LOX24, you pay per request using prepaid credit, with no base fee and no contract term.
Additional factor via SMS
Add security with SMS
Combine the anti-fraud check with verification codes and SMS notifications, all through one account and one API.
Try the anti-fraud check now
Sign up for free, connect the API, and test with 50 cents of starting credit. There is no base fee and no contract term.
