Documentation

Report fraud

Learned later that an approved request was fraud — a chargeback, a confirmed account takeover, a scam the user was talked into? Report it. It is the strongest signal Touchque's risk engine learns from, and it stays in your audit log. The request's status does not change, and reporting twice is safe.

reasonWhen
chargebackCard holder disputed the payment
account_takeoverSomeone else controlled the account
social_engineeringThe user was talked into approving
otherDefault
How a report is used across Touchque. A report, or the user tapping "This wasn't me" on the phone, marks the approving phone for 24 hours across every Touchque integration on that phone, and the user for 14 days in your integration: their next push then needs number matching. A report counts for this only within 7 days of the request. Separately, pseudonymised counts of how many accounts one address signs in to (kept 1 hour) are compared across customers, and pseudonymised features of past assessments train a model that runs in shadow mode and does not change decisions. No names, e-mail addresses or raw IP addresses are shared: identifiers are keyed hashes. Purpose: fraud prevention. Legal basis: legitimate interest (KVKK art. 5/2-f, GDPR art. 6(1)(f)). Retention: 1 hour (address counts), 24 hours (phone mark), 14 days (user mark), 365 days (assessment records). Mention this in your privacy notice.
Report a request
// e.g. when a chargeback arrives
await tq.login.reportFraud(requestId, { reason: 'chargeback', note: 'Disputed by card holder' });
// reason: 'chargeback' | 'account_takeover' | 'social_engineering' | 'other'