--- title: "Get Card Transaction Fraud" method: POST path: "/prp/1.0/getCardTransactionFraud" tags: ["Risk"] --- # Get Card Transaction Fraud `POST /prp/1.0/getCardTransactionFraud` ## Request - Base URL: `risk-{corename}.{env}.gpsrv.com/` (relative, and the document’s source URL is not known) - URL: `risk-{corename}.{env}.gpsrv.com/prp/1.0/getCardTransactionFraud` - Auth: none declared Use the Get Card Transaction Fraud endpoint to evaluate the risk associated with specific card transactions and understand if a transaction is fraudulent, then take appropriate action based on predefined criteria. This endpoint provides detailed fraud detection insights, including rules triggered, actions taken, and supplementary fraud prevention decisions. See About the Payment Risk Platform for more details. ## Request body `application/x-www-form-urlencoded` - object - `apiLogin` string, required: Web service username, as provided by SoFi Tech Solutions. Pattern: Max 50 characters Example: `"AbC123-9999"` - `apiTransKey` string, required: Web service password, as provided by SoFi Tech Solutions. Pattern: Max 15 characters Example: `"4sb62fh6w4h7w34g"` - `providerId` string, required: Your unique provider identifier from SoFi Tech Solutions. Pattern: Max 10-digit numeric string Example: `"9999"` - `transactionId` string, required: Supply a globally unique ID to identify this endpoint request ("transaction"). A UUID is preferred. Pattern: Max 60 characters Example: `"9845dk-39fdk3fj3-4483483478"` - `riskServiceId` string, required: Unique identifier provided by SoFi Tech Solutions during implementation to obtain client PRP configuration details. Pattern: Up to 50 characters Example: `"EPRP-test-1231231:1"` - `eventType` 'debit', required: Specifies the type of the transaction event. Pattern: `Debit` Example: `"Debit"` - `eventTs` string, date-time, required: Timestamp for when the transaction event occurred in our system time. May be the same timestamp as `authTs`. Pattern: YYYY-MM-DD hh:mm:ss Example: `"2020-10-28 00:00:24"` - `personId` string, required: Unique identifier of the account holder/customer associated with the event. Pattern: Up to 20 characters Example: `"p54789641"` - `accountId` string: Unique identifier of your customer account with which the related event is associated. Pattern: Up to 20 characters Example: `"a125483"` - `cardId` string: An identifier of the card with which the related event is associated. Pattern: Up to 20 characters Example: `"card_123"` - `authId` string: Internal card authorization identifier associated with card transaction event. Pattern: Up to 4 characters Example: `"8989"` - `authTs` string, date-time: Authorization timestamp. Can specify any timezone. Pattern: YYYY-MM-DD hh:mm:ss Example: `"2024-01-23T04:56:07.000+00:00"` - `acctOpenToBuy` number: The cardholder's available funds, also known as open to buy. Amount is checked during authorization validation to confirm the cardholder has sufficient funds to perform a transaction. Pattern: Integer or decimal amount Example: `'200.00'` - `acctCity` string: Cardholder’s city. Pattern: Up to 30 characters: letters, spaces, hyphen and period Example: `"Salt Lake City"` - `acctState` string: Cardholder’s state or province for non-U.S. countries. Pattern: Up to 60 characters Example: `"Washington"` - `acctZip` string: Cardholder’s postal code: U.S. ZIP code or local postal code. Pattern: 5–20 characters Example: `"98101"` - `acctCountry` string: Cardholder’s two-digit country code. See the IBAN Alpha-2 codes for details. Pattern: Up to 2 characters Example: `"US"` - `acctStartDate` string, date-time: Start date-time for the account was marked ready to use (e.g. account open or account funded date). Pattern: YYYY-MM-DD hh:mm:ss Example: `"2020-10-12T10:45:21.000+00:00"` - `cardActivateDate` string, date-time: Date-time for when the card was activated. Pattern: YYYY-MM-DD hh:mm:ss Example: `"2020-10-10T08:12:35.000+00:00"` - `cardStatus` string: Status for the card. Pattern: Up to 10 characters Example: `"Active"` - `cardCredLim` number: Credit limit of the cardholder’s account as whole or decimal amount. Pattern: Integer or decimal number Example: `'1000'` - `merchantAssertsAuthenticationAttempted` boolean: Specifies whether the merchant/acquirer attempted to authenticate the buyer using 3-D Secure. `True` if attempted, `False` if the merchant/acquirer did not attempt. Pattern: `true` or `false` Example: ``True`` - `transactionCity` string: Merchant's city. Pattern: Up to 60 characters Example: `Seattle` - `transactionZip` string: Postal code (US zip code or local postal code) where the transaction or event was performed. Pattern: 5–20 characters Example: `"98102"` - `isCardNotPresent` boolean: Whether a card was present during a transaction or event. `True` is card-not-present; `False` is card-present. Pattern: `true` or `false` Example: ``True`` - `isCardholderNotPresent` boolean: Whether a card was present during a transaction or event. `True` is card-not-present; `False` is card-present. Pattern: `true` or `false` Example: ``True`` - `isDomestic` boolean: Whether this is a domestic transaction. `True` is a domestic transaction; `False` for an international transaction. Definition of domestic at the discretion of the client. Pattern: `true` or `false` Example: ``True`` - `merchantDesc` string: Card acceptor name/location. See Data element 43 of the ISO message. Pattern: Up to 50 characters Example: `"ROSS"` - `merchantId` string: Card acceptor identification code. See Data element 42 of the ISO message. Pattern: Up to 15 characters Example: `"Ross_1234"` - `networkName` string, required: The card network. Acceptable values are: Visa, Mastercard, Discover, American Express, JCB, UnionPay, Accel, Star, Allpoint. Pattern: Up to 20 characters Example: `"Visa"` - `requestedAmount` number: The requested amount. Pattern: Integer or decimal amount Example: `'85'` - `isContactless` boolean: Whether this is a transaction is contactless. `True` is a contactless transaction. Definition of contactless is at the discretion of the client. Pattern: `true` or `false` Example: ``True`` - `isMagStripeRead` boolean: Whether the card’s magnetic stripe was swiped. `True` is yes. Pattern: `true` or `false` Example: ``True`` - `isRecurring` boolean: Whether the transaction is a recurring bill payment.`True` is for a recurring bill payment. Pattern: `true` or `false` Example: ``True`` - `isTransactionEmv` boolean: Whether the transaction used an EMV chip.`True` for when an EMV chip was used. Pattern: `true` or `false` Example: ``True`` - `threedsecureIndicator` boolean: Whether the transaction is 3-D Secure. `True` if the transaction was authenticated using 3-D Secure. Pattern: `true` or `false` Example: ``True`` - `acquirerInstitutionIdCode` string: Acquiring institution identification code. See Data element 32 of the ISO message. Pattern: Up to 6 characters Example: `"INST_12"` - `mcc` string: Merchant category code, also known as the MCC. This indicates the type of merchant at the point of sale, such as supermarket, auto supply, etc. Codes are defined in the ISO 18245. See Data element 18 of the ISO message. Pattern: Up to 4 characters Example: `"6011"` - `messageTypeIndicator` string: Message type indicator for the authorization message being sent by the card network.See Data element 22 of the ISO message. Pattern: Up to 4 characters Example: `"0180"` - `posEntryModeFull` string: Point of service (POS) entry mode code. See Data element 22 of the ISO message. Pattern: Up to 2 characters Example: `"05"` - `transTypeCode` string: Cardholder transaction type code. See Data element 3 subfield 1 of the ISO message. Pattern: Up to 2 characters Example: `"01"` - `aav` string: Result from validating the 3-D Secure Accountholder authentication value. Accepted values: 'Y'- Validated, 'F' - Failed, 'N' - Not present. Pattern: Up to 1 character Example: `"Y"` - `avs` string: Result from validating the 3-D Secure Accountholder authentication value. Accepted values: 'Y'- Validated, 'F' - Failed, 'N' - Not present. Pattern: Up to 1 character Example: `"Y"` - `pin` string: Indicates the status of the pin. Accepted values: 'Y' - Validated, 'F' - Failed, 'N' - Not present, 'L' - Locked, 'M' - PIN not set, 'B' - Blocked). Pattern: Up to 1 character Example: `"N"` - `riskCode` string: Risk code sent by card network. Pattern: Up to 3 characters Example: `"675"` - `transactionCountry` string: Two character identifier for the country where the transaction was performed. Pattern: Up to 2 characters Example: `"US"` - `transactionState` string: State where the transaction was performed. Pattern: Up to 20 characters Example: `"Washington"` - `transactionStateFull` string: Full province name where transaction occurred. This is only for international transactions. Leave empty for US based transactions. Pattern: Up to 20 characters Example: `"Ontario"` - `riskScore` integer: Visa Advanced Authorization (VAA) risk score ranging from 0 to 99 or Mastercard Decision Intelligence (DI) score ranging from 0 to 999. Pattern: Up to 4 digits Example: `56` - `accountAttackIntelligenceScore` string: The account attack intelligence score provided by Visa. Range: 01–99. Higher values indicate higher risk. Returns "None" if not populated in the ISO message. Pattern: 2-digit string from 01 to 99 Example: `"15"` - `acctStatus` string: Status of the account. Pattern: Up to 15 characters Example: `"Active"` - `acctActive` boolean: Whether the account is active. `True` for when the account is active. Pattern: `true` or `false` Example: ``True`` - `cardholderAppDate` string, date-time: Date-time the cardholder applied for an account. Pattern: YYYY-MM-DD hh:mm:ss Example: `"2020-10-10T08:12:35.000+00:00"` - `pinFailDate` string, date-time: Date of last PIN failure. Pattern: YYYY-MM-DD hh:mm:ss Example: `"2023-05-10T02:48:38.000+00:00"` - `isEcommerce` boolean: Whether this was an ecommerce transaction. `True` is for ecommerce transactions. Pattern: `true` or `false` Example: ``True`` - `isMerchantAuthAssertionsValidated` boolean: Whether the AAV card value was validated and passed validation. `True` when the AVV card is validated and passed. Pattern: `true` or `false` Example: ``True`` - `aavIndicator` string: Indicates whether the AAV was authenticated or if an authentication attempt was made. Pattern: `Y` or `N` Example: `'Y'` - `rawEci` string: The ECI sent in the transaction message. This is specific to the card network. Possible values include: `05` (Visa), `212` (MasterCard), `5` (Discover), etc. See Data element 48 Sub Element 42. Pattern: Up to 3 characters Example: `"05"` - `merchantAssertsDataProtection` boolean: `True` if the merchant/acquirer asserts that the communication channel between the buyer and the merchant is encrypted (e.g. with TLS/HTTPS). `False` if the merchant/acquirer makes no guarantee about the security of the communication channel with the buyer (e.g. uses HTTP). Proceed with caution when this field is `False`. A malicious third party could have compromised the transaction. Pattern: `true` or `false` Example: ``True`` - `merchantAssertsAuthenticated` boolean: Whether the merchant authenticated the buyer with 3-D Secure. `True` if the merchant/acquirer asserts that it authenticated the buyer using 3-D Secure and obtained a valid CAVV/AAV from the card network or SoFi Tech Solutions. `False` if the merchant/acquirer makes no assertion whether the buyer is fully authenticated using 3-D Secure. Pattern: `true` or `false` Example: ``True`` - `emvCvn` string: Cryptogram version number for the EMV transaction. Pattern: Up to 2 characters Example: `"20"` - `emvCvr` string: Card verification results for the EMV transaction. Pattern: Up to 12 characters Example: `"a00120400400"` - `emvDki` string: Derivative Key Index (DKI) for the EMV transaction. See Data element 55 for 9F10 value. Pattern: Up to 2 characters Example: `"65"` - `provisioningDeviceType` string: _Visa only_. Type of device used at the provisioning time from ISO8583. See Data element 125. Pattern: Up to 60 characters Example: `"dtype_123"` - `provisioningDeviceLanguage` string: Three letter code for `device_language` at the provisioning time. See ISO 639.2 standards. Pattern: Up to 3 characters Example: `"eng"` - `provisioningDeviceId` string: Device ID at the time of provisioning. Pattern: Up to 60 characters Example: `"108998A103804F45740927FF9984ML91J43R"` - `provisioningDeviceNumber` string: Device phone number at the provisioning time when applicable. See Data element 125 for Visa or DE 124 for Mastercard. Pattern: Up to 12 characters Example: `"+18888888888"` - `provisioningLocation` string: Latitude and longitude with 2 digits of precision. Pattern: Up to 20 characters Example: `"+37.78/-122.43"` - `provisioningDeviceIp` string: IP address of the device at the provisioning time. Pattern: Up to 60 characters Example: `"12.45.65.123"` - `provisioningDeviceScore` string: Wallet device score at the provisioning time. See Data element 125 for Visa or DE 124 for Mastercard. Pattern: Up to 2 characters Example: `"78"` - `provisioningAccountScore` string: Account score at the provisioning time. See Data element 125 for Visa or DE 124 for Mastercard. Pattern: Up to 2 characters Example: `"5"` - `provisioningPanSource` string: Identifies the method which the cardholder is attempting to tokenize a primary account number. See Data element 125 for Visa or DE 124 for Mastercard. Pattern: Up to 2 characters Example: `"02"` - `provisioningAccountEmailAddr` string: Account email address at the time of provisioning. Pattern: Up to 60 characters Example: `"someemail@gmail.com"` - `provisioningCorrelationId` string: `correlation_id` at the time of provisioning. Pattern: Up to 20 characters Example: `"D0000000000000"` - `provisioningPaymentAppInstanceId` string: `payment_app_instance_id` at the time of provisioning. Pattern: Up to 60 characters Example: `"98HAKDSFNQ84R8109R412IU3NRKABSF230"` - `provisioningCardholderName` string: Cardholder name at the time of provisioning. Pattern: Up to 60 characters Example: `"Sam Smith"` - `provisioningTokenizationRecommendation` string: Tokenization decision suggested by the wallet provider. See Data element 125 for Visa or DE 124 for Mastercard. Pattern: Up to 1 character Example: `"2"` - `provisioningTokenizationRecommendationStandardVer` string: The version of the standards the wallet provider is using to determine the suggested tokenization recommendation. See Data element 125 for Visa or DE 124 for Mastercard. Pattern: Up to 60 characters Example: `"tokenstdvar_345"` - `provisioningTokenizationRecommendationReasonCode` string: Indicates the specific reason the wallet provider is suggesting the tokenization recommendation. See Data element 125 for Visa or DE 124 for Mastercard. Pattern: Up to 20 characters Example: `"00088C"` - `provisioningActiveTokens` string: `active_tokens` at the time of provisioning. Pattern: Up to 2 characters Example: `22` - `provisioningTokenType` string: _Mastercard only_. Contains a value indicating the type of requested token. See DE 124 for Mastercard. Pattern: Up to 1 character Example: `"C"` - `provisioningConsumerIdentifier` string: `consumer_identifier` at the time of provisioning. Pattern: Up to 60 characters Example: `"cid_777"` - `isPartialAuthSupported` boolean: Whether the account supports partial authorizations. `True` for an account that supports partial authorization. Pattern: `true` or `false` Example: ``True`` - `isCardEmv` boolean: Whether the card is EMV capable. `True` if card is EMV enabled. Pattern: `true` or `false` Example: ``True`` - `isEmvFallback` boolean: Whether the transaction is when a card product is EMV and the terminal where the transaction is performed is EMV enabled but the transaction is non-EMV. Pattern: `true` or `false` Example: ``True`` - `isFinalCompletion` boolean: Whether it is the last preauthorization after multiple preauths that are tied together have been performed and acts as a complete advice/authorization. Pattern: `true` or `false` Example: ``True`` - `isIncrementalAuth` boolean: Whether it is part of an incremental authorization tied to other purchases that will settle at the same time (e.g. multiple purchases from a mini-fridge in a hotel). Pattern: `true` or `false` Example: ``True`` - `isTerminalEmv` boolean: Whether the terminal is EMV capable. `True` when EMV is enabled. Pattern: `true` or `false` Example: ``True`` - `avsRequested` boolean: Whether AVS was requested. `True` when requested. Pattern: `true` or `false` Example: ``True`` - `currencyCodeBilling` string: Currency Code, Cardholder billing. See Data element 51 of the ISO message. Pattern: Up to 3 characters Example: `"371"` - `currencyCodeTransaction` string: Currency Code, Transaction. See Data element 49 of the ISO message. Pattern: Up to 3 characters Example: `"304"` - `merchantTerminalId` string: Card Acceptor Terminal Identification Code. See Data element 41 of the ISO message. Pattern: Up to 8 characters Example: `"05940594"` - `posConditionCode` string: _Visa only_. SMS POS Condition. See Data element 25 of the ISO message. Pattern: Up to 2 characters Example: `"89"` - `posData` string: _Mastercard only_. POS Data. See Data element 61 of the ISO message. Pattern: Up to 30 characters Example: `00000000030000040000012039410324` - `isHighRisk` boolean: Flag to indicate whether card is high risk. Pattern: `true` or `false` Example: ``True`` - `arqc` string: A cryptogram that is generated by the chip on a card during a chip transaction and sent to SoFi Tech Solutions to validate that the source of the transaction is legitimate. Pattern: Up to 1 character Example: `N` - `cvv1Status` string: Indicates status of CVV1. Accepted values: 'Y' - Verified, 'N' - Failed, 'None' - No CVV1 Passed. Pattern: Up to 4 characters Example: `'Y'` - `cvv2Status` string: Indicates status of CVV2. Accepted values: 'Y' - Verified, 'N' - Failed, 'None' - No CVV2 Passed. Pattern: Up to 4 characters Example: `'N'` - `cvv3Status` string: Indicates status of CVV3. Accepted values: 'Y' - Verified, 'N' - Failed, 'None' - No CVV3 Passed. Pattern: Up to 4 characters Example: `'N'` - `offlinePinStatus` string: Indicates the status of the offline pin. Accepted values: 'Y' - Verified, 'N' - Failed, 'E' - Offline Pin Try Count Exceeded, 'P' - Failed or tries exceeded, but within risk parameters, 'None' - No Offline PIN verification performed. Pattern: Up to 4 characters Example: `'N'` - `cashbackAmount` number: Cashback amount that was requested. Pattern: Integer or decimal amount Example: `354` - `level1` string: Hierarchy level 1 of your program. Pattern: `Consumer` Example: `level 1` - `level2` string: Hierarchy level 2 of your program. Pattern: Up to 60 characters Example: `Division - HSA` - `level3` string: Hierarchy level 3 of your program. Pattern: Up to 60 characters Example: `Client` - `level4` string: Hierarchy level 4 of your program. Pattern: Up to 60 characters Example: `SoFi Tech Solutions` - `level5` string: Hierarchy level 5 of your program. Pattern: Up to 60 characters Example: `Cohort` - `level6` string: Hierarchy level 6 of your program. Pattern: Up to 60 characters Example: `Group` - `level7` string: Hierarchy level 7 of your program. Pattern: Up to 60 characters Example: `Account ID` - `level8` string: Hierarchy level 8 of your program. Pattern: Up to 60 characters Example: `level 8` - `level9` string: Hierarchy level 9 of your program. Pattern: Up to 60 characters Example: `Card ID` - `level10` string: Hierarchy level 10 of your program. Pattern: Up to 60 characters Example: `Card Type` - `customField1` string: Optional custom field containing additional data elements to send to SoFi Tech Solutions. Pattern: Up to 60 characters Example: `"field1val"` - `customField2` string: Optional custom field containing additional data elements to send to SoFi Tech Solutions. Pattern: Up to 60 characters Example: `"field2val"` - `customField3` string: Optional custom field containing additional data elements to send to SoFi Tech Solutions. Pattern: Up to 60 characters Example: `"field3val"` - `customField4` string: Optional custom field containing additional data elements to send to SoFi Tech Solutions. Pattern: Up to 60 characters Example: `"field4val"` - `customField5` string: Optional custom field containing additional data elements to send to SoFi Tech Solutions. Pattern: Up to 60 characters Example: `"field5val"` ## Response `default` - object - `status_code` integer, required: The response status code. May return a string for some statuses. - `status` string, required: The condition of a process or response - `errors` string[]: A list of errors generated while the request was processed - `rtoken` string, nullable: A system-generated ID used for tracking - `processing_time` number, nullable: The time elapsed in processing the request - `echo` object, nullable: A structure that contains transaction ID information - `transaction_id` string: An ID that represents an API transaction - `provider_timestamp` string, date-time: Store a related timestamp for reporting and troubleshooting purposes - `provider_transaction_id` string: Secondary transaction identifier (generated by a provider) - `system_timestamp` string, date-time, nullable: A system generated timestamp - `response_data` object: A structure for the response data. It can be empty but usually will contain information. - `person_uuid` string, required: System-generated UUID of the account holder associated with the transaction event - `success_msg` object, required: Details about the transaction event - `subtenant_data` object, nullable: Consists of multiple components provide details on PRP's performance and your fraud policy: - `features`— Contains data for specific features that you choose to return as a record of specific transaction metrics, utilized in your fraud rule policy and to measure your cardholder behavior. For each feature returned, you receive the feature name in `feature_name`, the feature value in `feature_value`, and data type in `feature_type`. - `rule_execution`— Contains all rules triggered within your fraud policy and the associated data that is configured in PRP for that rule. Includes `rule_id`, `rule_name`, `rule_action`, and other helpful information. - `supplementary_action`— Contains data on additional actions, excluding the primary action of running fraud rules. For example, sending the transaction to the review queue (`action = REVIEW QUEUE`). - `event_id` string, nullable: Unique identifier of the transaction event - `galileo_data` object, required: A structure that contains transaction information from PRP - `reject` boolean, required: Whether a transaction is recommended to be rejected by PRP. Returns `true` if rejected. - `freeze` boolean, required: Whether the account was frozen. Returns `true` if frozen. - `override` boolean: Whether PRP approved a cardholder-confirmed override of the rejecting fraud rule. Returns `true` if approved; does not change `reject` or `freeze`. - `notes` string[]: Notes provided associated with the fraud rules of a transaction event - `rules_denied` string[]: Specifies fraud rules concerning the transaction event that triggered a denied message - `rules_warned` string[]: Specifies fraud rules concerning the transaction event that triggered a denied message - `actions` object[]: List of PRP specific data - `fn_name` string, required: Name of the rule from PRP - `fn_result` string, required: Result of the results of the rule from PRP - `fn_note` string, nullable: Description of risky acitivity associated with the rule trigger from PRP - `freeze` boolean, required: Whether the fraud rule that was triggered contains a freeze flag. Returns `true` if the freeze flag is triggered. - `card_uuid` string, nullable: System-generated UUID that identifies the card of the account holder - `account_uuid` string, nullable: System-generated UUID that identifies the account of the account holder --- [API](https://skmtc.dev/galileo-ft/apis/risk-api-1-0.md) - [All operations](https://skmtc.dev/galileo-ft/apis/risk-api-1-0/llms.txt) - [OpenAPI document](https://skmtc.dev/galileo-ft/apis/risk-api-1-0/revisions/e1d98d205e14?raw)