Signal Score for Email API Reference Guide

May 21, 2026 22:33

This guide outlines the key data points returned by the Signal Score for Email API. This document categorizes the data into logical segments to help you understand how email addresses are evaluated for risk, trustworthiness, and identity verification.

Transaction Details

General identifiers used for tracking, auditing, and matching your specific API requests.

Field Name	Description
Request ID	A unique reference number for this specific check. Use this if you need to contact support regarding a specific request.
Email Address	The email address that was submitted for evaluation.
Found	A simple Yes/No (True/False) indicating if this email address exists within our Global Identity Network.

Domain Assessment

These fields evaluate the email domain (gmail.com, company.com) to determine domain-level validity and risk.

Field Name	Description
Top-Level Domain	The suffix of the email (.com, .net, .org).
Domain Risk Level	A summary of the domain's reputation: Low, Medium, or High.
Domain Risk Score	A numeric value (0.1–99.9). Higher numbers equals higher risk.

Email Risk and Trustworthiness

The primary scores and categories used to determine if the specific email address is safe, legitimate, and human-operated.

Field Name	Description
Risk Score	The threat level of this specific email. Higher numbers indicate higher risk.
Risk Level	The category of threat (Low, Medium, High).
Legitimacy Score	The probability that this email belongs to a real person. Higher numbers indicate a more trustworthy, human-like account.
Legitimacy Level	A category of the legitimacy (Low, Medium, High).
Analysis Codes	Short codes (like SF001) that explain why the score was given. See our [Analysis Code Guide] for details.

Reason Codes

This table maps the analysisCode returned in the emailAssessment object to its functional definition.

Data Name (Code)	Definition
E001	The email address is identified as safe overall.
E002	The email address is identified as risky overall.
SF001	The email address exists in the Equifax Global Identity Network.
RF001	The email address does not exist in the Equifax Global Identity Network.
RF003	A component of the email address is blank, invalid, or mislabeled.
RF004	The email address contains an unrealistic pattern of characters.
RF005	The email address fails at least one validation check.
RF010	High risk for charging back online transactions.
SF010	Low risk for charging back online transactions.
RF014	High risk for being declined by the bank.

Velocity

Insights into how often and how long this email has been active in the global network. Sudden spikes in activity can often signal abuse or bot patterns.

Field Name	Description
Date First Seen	The very first time our network encountered this email address.
Date Last Seen	The most recent time this email was active in our network.
Total Occurrences	The total number of times this email has been seen historically across our entire network.
30-Day Occurrence	How active the email has been in the last month. High spikes can sometimes indicate bot activity.
Usage Score	A measure of how well-established and active accounts are. Higher scores indicate more well-established accounts.

Identity Footprint

This section helps confirm if the email is linked to a consistent real-world identity, which is crucial for fraud prevention.

Field Name	Description
Distinct Names	The number of different names associated with this email. A high count might suggest shared or fraudulent use.
Distinct Addresses	The number of physical mailing addresses linked to this email.
Distinct Regions	The number of states or provinces associated with this email's history.
Distinct Countries	The number of different countries where this email identity has appeared.

Was this article helpful?

0 out of 0 found this helpful