Verdicts

What each ScamVerify™ verdict means, how to interpret them in your application, and how verdict floor promotion works.

Verdict Scale

Every ScamVerify™ API response includes a verdict string that maps directly to the risk_score. There are five verdict levels:

Verdict	Risk Score Range	Meaning
`safe`	0 to 19	No indicators of fraud detected
`low_risk`	20 to 39	Minor indicators present, likely legitimate
`medium_risk`	40 to 59	Concerning signals detected, exercise caution
`high_risk`	60 to 79	Strong fraud indicators, likely malicious
`dangerous`	80 to 100	Confirmed scam, multiple high-confidence sources agree

The number, URL, message, or email shows no indicators of fraud. For phone numbers, this typically means no FTC or FCC complaints, a valid number on a major carrier, and a registered caller ID. For URLs, this means an established domain with valid SSL, no threat feed listings, and no brand impersonation.

Recommended action: Allow the interaction to proceed normally. No user warning is needed.

{
  "risk_score": 8,
  "verdict": "safe",
  "confidence": 0.92,
  "explanation": "This landline number is registered to Verizon with a verified business caller ID. No complaints exist in FTC or FCC databases, and the number is not flagged in any robocall detection systems."
}

low_risk (20 to 39)

Minor risk indicators are present, but the overall assessment leans toward legitimate. Common causes include a small number of FTC complaints (which could be from a legitimate business that called the wrong person), a VoIP line type without other negative signals, or a domain that is relatively new but otherwise clean.

Recommended action: Allow the interaction but consider showing a subtle informational notice. Do not block or flag as suspicious.

{
  "risk_score": 32,
  "verdict": "low_risk",
  "confidence": 0.71,
  "explanation": "This VoIP number is registered with a known business carrier and has a valid caller ID. Three FTC complaints were filed in 2024, but no recent activity has been recorded. The complaint volume is consistent with a legitimate business that may have contacted consumers who were on the Do Not Call list."
}

medium_risk (41 to 59)

Meaningful risk signals are present. The system cannot confirm whether this is a scam or legitimate, but there is enough evidence to warrant caution. This verdict often appears when signals are mixed, such as a number with moderate FTC complaints but a legitimate carrier, or a URL with a new domain but valid SSL and no threat feed listings.

Recommended action: Show a visible warning to the user. Suggest they verify the identity of the caller, sender, or website through an independent channel before sharing personal information. In automated systems, consider routing to a review queue.

{
  "risk_score": 52,
  "verdict": "medium_risk",
  "confidence": 0.58,
  "explanation": "This number has 12 FTC complaints with the most recent filed 45 days ago. The carrier is a VoIP provider, and no caller ID is registered. While the complaint volume is moderate, the recent activity and anonymous VoIP setup warrant caution."
}

high_risk (60 to 79)

Strong fraud indicators are present. Multiple data sources agree that this entity is likely malicious. For phone numbers, this typically means high FTC complaint volumes, robocall flags, or a high-risk VoIP carrier. For URLs, this might mean threat feed listings combined with a new domain and brand impersonation.

Recommended action: Display a prominent warning. In automated systems, consider blocking the interaction or requiring additional verification. For phone numbers, recommend that the user not answer or call back. For URLs, recommend that the user not visit the site.

{
  "risk_score": 73,
  "verdict": "high_risk",
  "confidence": 0.85,
  "explanation": "This VoIP number has accumulated 38 FTC Do Not Call complaints since January 2025, with 72% of complaints reporting robocalls. The carrier is on the high-risk VoIP provider list, and no caller ID is registered. The number is actively generating complaints, with 8 filed in the last 90 days."
}

dangerous (80 to 100)

The system has high confidence that this is a confirmed scam. Multiple independent data sources corroborate the assessment. For phone numbers, this means massive FTC complaint volumes, robocall database flags, and often an invalid or spoofed number. For URLs, this means active threat feed listings combined with other high-confidence signals.

Recommended action: Block the interaction entirely if possible. Display a strong, unmissable warning. For phone numbers, recommend immediate blocking. For URLs, prevent navigation or display an interstitial warning page. In B2B applications, reject the transaction or escalate to fraud review.

{
  "risk_score": 95,
  "verdict": "dangerous",
  "confidence": 0.97,
  "explanation": "This is an invalid phone number that does not exist in any telecom network, indicating it is being spoofed. The number has 247 FTC complaints with 91% reporting robocalls. It is flagged in the industry robocall detection database. Multiple community reports confirm this number is associated with an IRS impersonation scam."
}

Verdict Floor Promotion

In some cases, a high-risk sub-lookup can force a minimum verdict even when the primary analysis suggests a lower risk level. This is called verdict floor promotion and applies to text and email channels.

How It Works

When a text message or email contains embedded URLs or phone numbers, the ScamVerify™ pipeline extracts and verifies them through the phone and URL pipelines. If any sub-lookup returns a high-risk result, the overall verdict is promoted to at least medium_risk.

Floor promotion triggers when:

An extracted URL has a risk score above 70
An extracted phone number is flagged as invalid or spoofed
Email authentication (SPF or DKIM) fails

Why This Matters

A well-crafted scam message might use polite, professional language that the AI model rates as low risk. But if that message contains a link to a known phishing domain, the overall result should reflect that risk. Floor promotion ensures that high-confidence threat intelligence from sub-lookups is never hidden by a low AI analysis score.

Example

A text message reads: "Your account has been temporarily locked. Please verify your identity at secure-login.example.com to restore access."

The AI might rate the language as low_risk (score 25) because it does not contain the most aggressive urgency tactics. But if secure-login.example.com is listed in URLhaus as a malware distribution URL with a risk score of 88, the final text verdict is promoted from low_risk to at least medium_risk.

Mapping Verdicts to Your Application

How you handle each verdict depends on your use case. Here are common patterns:

Consumer-facing app (caller ID, browser extension)

safe and low_risk: Green indicator, no action needed
medium_risk: Yellow warning, suggest caution
high_risk and dangerous: Red alert, recommend blocking

Fintech / payment processing

safe and low_risk: Auto-approve
medium_risk: Route to manual review
high_risk: Require additional verification (step-up auth)
dangerous: Auto-reject

Contact center / CRM

safe and low_risk: Normal handling
medium_risk: Flag for agent awareness
high_risk and dangerous: Route to fraud team, do not disclose account information

The confidence field should inform how strictly you enforce these rules. A high_risk verdict with 0.9 confidence warrants stronger action than one with 0.4 confidence.