FAQ

What data sources does ScamVerify™ use?

Every lookup is checked against multiple government and threat intelligence sources:

• FTC Do Not Call Registry with 2.79M+ complaint records, synced hourly
• FCC Consumer Complaints from the FCC's Socrata API
• Twilio Carrier Intelligence for carrier name, line type (mobile, landline, VoIP), and CNAM data
• URLhaus for malware URL detection
• ThreatFox for Indicators of Compromise (54,000+ malicious domains)
• IPQS (IP Quality Score) for phone and URL reputation scoring
• Community Reports from user-submitted scam reports on scamverify.ai

Raw data from these sources is synthesized by AI into a risk score, verdict, and plain-English explanation.

---

Is the API rate limited?

Yes. Rate limits are measured in requests per minute (RPM) and vary by plan:

If you exceed your RPM, the API returns a 429 response with a Retry-After header. Batch requests count as a single request regardless of how many items they contain.

---

Do cached lookups consume quota?

No. If you look up the same phone number, URL, text, or email within 24 hours, the API returns the cached result without consuming any quota. The cached: true field in the response confirms when a result came from cache.

Additionally, the same API key looking up the same target multiple times only decrements quota once.

---

Can I use test keys in production?

Test keys (sv_test_) are designed for development and integration testing. They return realistic mock data and do not consume quota. They should not be used in production because:

• They do not query real data sources
• Results are synthetic and do not reflect actual risk
• They are clearly marked as test responses

Use sv_live_ keys for all production traffic.

---

What phone number formats are accepted?

The API accepts US phone numbers in several formats:

• E.164: +12025551234 (preferred)
• With country code: 12025551234
• 10-digit: 2025551234
• Formatted: (202) 555-1234 or 202-555-1234
• With dots: 202.555.1234

For best results, normalize to E.164 format before calling the API.

---

How fresh is the FTC data?

FTC Do Not Call complaint data is synced automatically every hour via the FTC's public API. New complaints typically appear in ScamVerify™ within 1 to 2 hours of being published by the FTC.

The database currently contains 2.79M+ records dating from 2021 onward.

---

What happens when my quota runs out?

The API returns a 402 Payment Required error for new lookups. Cached lookups (re-checking a target you already looked up within 24 hours) continue to work because they do not consume quota.

You can:

• Upgrade your plan for more monthly lookups (takes effect immediately)
• Wait for your quota to reset at the start of your next billing cycle

Paid plans include a 10% grace buffer to prevent disruption from minor overages.

---

Can I upgrade or downgrade my plan mid-cycle?

Yes.

Upgrades take effect immediately. You are billed a prorated amount for the remainder of the current cycle, and your new quota limits apply right away.

Downgrades are deferred to the end of the current billing cycle. You keep your current limits until the cycle ends, then switch to the lower plan. Pending downgrades can be cancelled at any time.

---

Is there an SLA?

A formal SLA is not available at this time. The API runs on Vercel's infrastructure with automatic scaling and global edge distribution. We monitor uptime and performance continuously.

The /api/v1/status endpoint returns the current system health and can be used for your own uptime monitoring.

Enterprise customers can negotiate custom SLAs as part of their contract.

---

Do you support international phone numbers?

Not yet. The ScamVerify™ API currently supports US phone numbers only. International number support is on our roadmap.

URL verification, text analysis, and email analysis work with content from any country. Only the phone lookup channel is restricted to US numbers.