---
title: "Screen a chat message for fraud intent"
method: POST
path: "/v1/ai/fraud/chat-scam"
tags: ["fraud:chat-scam"]
---

# Screen a chat message for fraud intent

`POST /v1/ai/fraud/chat-scam`

## Request

- Base URL: `https://api.intura.co` (the document declares no server; this is the origin it was published from)
- URL: `https://api.intura.co/v1/ai/fraud/chat-scam`
- Auth: none declared

## Request body

- ModulesV1AiFraudChatScamSchemasDetectRequest: One chat message to screen. `message` is required; history raises recall.
  - `message` string, required: The message to screen — WhatsApp, SMS, Telegram, in-app chat, any of them. Bounded by the module's MAX_CHARS.
  - `history` string[], nullable: Previous turns in the conversation, oldest first. The last 20 are read. Worth sending: half of chat fraud is an arc rather than a message, and none of the lines that build it is a scam on its own.
  - `sender` string, nullable: Who the message is from — a phone number, a handle, a display name. Read as a weak signal only; a number is trivially spoofed and is never the reason a message is blocked.
  - `thresholds` object, nullable: Move the cuts for this one call: `block` (default 0.75) and `review` (default 0.4). Either alone is fine; the other keeps Intura's default. The console's playground is where to find the bar that suits your traffic; this field is where to put it.

## Response `200`

Successful Response

- ModulesV1AiFraudChatScamSchemasDetectResponse
  - `status` string: Always `success` on a 2xx
  - `code` integer: Mirrors the HTTP status code
  - `data` ModulesV1AiFraudChatScamSchemasDetectResponseData, required: `data` for POST /v1/ai/fraud/chat-scam.
    - `label` string, required: `benign`, or which kind of scam: `otp_theft`, `phishing_link`, `impersonation`, `investment_scam`, `job_scam`, `prize_scam`, `loan_scam`.
    - `score` number, required: The number this endpoint measured and decided on, 0..1, rounded to 4 dp — P(injection), P(scam), how strongly the frame reads as the card. Compare it against `thresholds` and you have `label`. This is the only number to threshold on; what it means on a given route is documented there.
    - `thresholds` object: The cuts this answer was decided by, after your saved settings and anything sent in `thresholds` on the request. Published on every response so a verdict can be compared with an older one: a score means nothing without the bar it was held to. Empty on an endpoint with nothing to tune.
    - `result` ModulesV1AiFraudChatScamSchemasDetectResultData: `result` for a screening call: the spread, and what to do.
      - `scores` object, required: Probability mass per class, summing to 1. Read it to answer 'which kind of scam', not 'is there one' — `label` is the banded decision and no scam class is ever named below the review threshold.
      - `scam` boolean, required: True when the score crossed your block cut. The single boolean a caller needs if they do not want to reason about bands.
      - `action` string, required: `block` (score >= `thresholds.block`), `review` (>= `thresholds.review`), or `allow`. `review` means warn the recipient, not delete the message — the band exists so a check that fires on a real invoice does not get switched off.
      - `guidance` string, required: One line to show the person who received the message, written for them rather than for an operator. Empty for `benign`.
      - `history_used` integer, required: How many previous turns were actually read. Two verdicts with different values here did not see the same evidence.
      - `languages` string[], required: The languages this input was screened in. Every supported language when none could be identified.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/intura/apis/intura-ai-api.md) - [All operations](https://skmtc.dev/intura/apis/intura-ai-api/llms.txt) - [OpenAPI document](https://skmtc.dev/intura/apis/intura-ai-api/revisions/7cb6af4c6390?raw)