Report fraud

Report a request you later learned was fraud. The strongest training signal for the risk engine; kept in your audit log; the request's status does not change. Idempotent.

POST/login/{id}/report-fraud

Field	Type	Description
`reason`	string	See the table below (default other)
`note`	string	Optional, at most 500 characters

reason	When
`chargeback`	Card holder disputed the payment
`account_takeover`	Someone else controlled the account
`social_engineering`	The user was talked into approving
`other`	Default

How a report is used across Touchque. A report, or the user tapping "This wasn't me" on the phone, marks the approving phone for 24 hours across every Touchque integration on that phone, and the user for 14 days in your integration: their next push then needs number matching. A report counts for this only within 7 days of the request. Separately, pseudonymised counts of how many accounts one address signs in to (kept 1 hour) are compared across customers, and pseudonymised features of past assessments train a model that runs in shadow mode and does not change decisions. No names, e-mail addresses or raw IP addresses are shared: identifiers are keyed hashes. Purpose: fraud prevention. Legal basis: legitimate interest (KVKK art. 5/2-f, GDPR art. 6(1)(f)). Retention: 1 hour (address counts), 24 hours (phone mark), 14 days (user mark), 365 days (assessment records). Mention this in your privacy notice.

Request

curl -X POST https://api.touchque.com/login/<requestId>/report-fraud \
  -H "x-api-key: tq_abc123" -H "x-timestamp: $TS" -H "x-nonce: $NONCE" -H "x-signature: $SIG" \
  -H "Content-Type: application/json" \
  -d '{"reason":"chargeback","note":"Disputed by card holder"}'

// e.g. when a chargeback arrives
await tq.login.reportFraud(requestId, { reason: 'chargeback', note: 'Disputed by card holder' });
// reason: 'chargeback' | 'account_takeover' | 'social_engineering' | 'other'

tq.login.report_fraud(request_id, reason='chargeback', note='Disputed by card holder')

$tq->login->reportFraud($requestId, 'chargeback', 'Disputed by card holder');

_, err := tq.Login.ReportFraud(requestID, touchque.ReportFraudOptions{Reason: touchque.FraudChargeback, Note: "Disputed by card holder"})

await tq.Login.ReportFraudAsync(requestId, "chargeback", "Disputed by card holder");

tq.login().reportFraud(requestId, "chargeback", "Disputed by card holder");

tq.login.report_fraud(request_id, reason: "chargeback", note: "Disputed by card holder")

Response 200

{
  "reported": true,
  "alreadyReported": false,
  "requestId": "…"
}