> For the complete documentation index, see [llms.txt](https://docs.caf.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.caf.io/caf-api/connect/available-resources/joint-resolution-6/suspected-fraud-creation.md).
# Suspected Fraud Creation
{% hint style="info" %}
**Authentication Requirements:**
* Regular endpoints use `OAuth2` authentication with base URL: `https://api.us.prd.caf.io`
* For enhanced security, some endpoints may also support `mTLS` authentication with base URL: `https://mtls.us.prd.caf.io`
* For information on implementing `mTLS`, access [Using mTLS](/caf-api/connect/authentication/using-mtls.md)
{% endhint %}
A suspected fraud creation request inserts a suspected fraud into your peer's database and this data becomes available to other peers in the network.
{% openapi src="/files/J8iqm5NWDI0JBS28CSBQ" path="/suspected-fraud" method="post" %}
[fraud.yaml](https://3218940882-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbVxCOSyBojfSIE5fcpfH%2Fuploads%2Fgit-blob-af815f97f3b6503a7b2dbd230f373614ea0a8abd%2Ffraud.yaml?alt=media)
{% endopenapi %}
## Occurrence Data Model
As demonstrated in the example request, a suspected fraud occurrence is composed of the following properties:
* `instituicao_responsavel`: it is a **required** field and is represented by the [responsible institution object schema](#responsible-institution-object-instituicao_responsavel);
* `informacoes_bancarias_destino`: it is a **conditional** field and is represented by the [destination bank account object schema](#destination-bank-account-object-informacoes_bancarias_destino);
* `informacao_executor`: it is a **conditional¹** field and is represented by the [fraudster information object schema](#fraudster-information-object-informacao_executor);
* `informacao_reclamante`: it is a **conditional¹** field and is represented by the [claimer information object schema](#claimer-information-object-informacao_reclamante);
* `registro`: it is a **required** field and is represented by the [occurrence object schema](#occurrence-object-registro).
> **¹**: At least one of the objects, `informacao_executor` or `informacao_reclamante`, must be present.
### Responsible Institution Object: `instituicao_responsavel`
This object describes the financial institution submitting the occurrence. It's a **required object**.
| Field | Description | Field Requirement | Data type | Options | Examples |
| --------------------- | ---------------------------------------------------------------------- | ----------------- | --------- | ------- | ------------------- |
| cnpj\_origem | CNPJ of the financial institution submitting the fraud evidence. | Required | string | - | "52337497000131" |
| razao\_social\_origem | Legal name of the financial institution submitting the fraud evidence. | Required | string | - | "Empresa XYZ Ltda." |
### Destination Bank Account Object: `informacoes_bancarias_destino`
This object describes the banking information of the destination account of the occurrence, when applicable. It's a **conditional object**: if `registro.atividade_relacionada` is equal to: 4, 5, 6, 7 or 8, the `informacoes_bancarias_destino` object is **required**.
| Field | Description | Field Requirement | Data type | Options | Examples |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| agencia | Destination bank branch code. It must consist of the branch prefix and the check digit without a separator/hyphen. | Conditional
This field is required when chave\_pix.tipo is equal to: 6
| string | - | "0123" |
| codigo\_instituicao | **Deprecated** ISPB of the destination institution. | Conditional
This object is required when ispb is not provided
| integer | - | 00000000 |
| ispb | ISPB of the destination institution. | Conditional
This object is required when codigo\_instituicao is not provided
| string | - | "00A0Z000" |
| conta | Destination bank account details. | Conditional
This object is required when registro.atividade\_relacionada is equal to: 4, 5, 6, 7 or 8;
Or when chave\_pix.tipo is equal to: 6
| object | - | - |
| conta.numero | Destination bank account number. It must consist of the account prefix and the check digit without a separator/hyphen. | Required | string | - | "1234567890" |
| conta.tipo | Type of destination bank account. | Required | integer | 1 - CV Sight deposit account (checking account)
2 - CP Savings deposit account (savings account)
3 - PP Prepaid Payment account
| 1 |
| conta.titular | Destination account holder details. | Conditional
This field is required when registro.atividade\_relacionada is equal to: 4, 5, 6, 7 or 8
| object | - | - |
| conta.titular.documento | Destination account holder identification document. | Optional | object | [schema](#document-object) | - |
| conta.titular.nome\_completo\_razao\_social | Destination account holder full name. | Optional | string | - | "Maria Silva" |
| conta.titular.nome\_fantasia | Destination account holder company name, when applicable. | Optional | string | - | "Empresa XYZ" |
| conta.documento\_representante\_legal | Identification documents of the account holder's legal representatives, when applicable. | Optional | array | [schema](#document-object) | - |
| chave\_pix | PIX key of the destination account suspected of fraud. | Conditional
This object is required when registro.atividade\_relacionada is equal to: 7
| object | - | - |
| chave\_pix.tipo | Type of PIX key. | Required | integer | 1 - CPF
2 - CNPJ
3 - Phone Number
4 - E-mail
5 - Random
6 - Bank Account
| 4 |
| chave\_pix.valor | Value of PIX Key. | Conditional
This field is required when chave\_pix.tipo is not equal to: 6
| string | - | "" |
| linha\_digitavel\_boleto | Digitable line of the payment slip linked to suspected destination account fraud. | Conditional
This field is required when registro.atividade\_relacionada is equal to: 9
| string | - | "00190500950448160698093503143373700000001000" |
### Fraudster Information Object: `informacao_executor`
This object represents the fraudster's information, when available. It's a **conditional object**: if the `informacao_reclamante` object is not provided, the `informacao_executor` object is **required**. After [GMUD Unauthorized Betting Operators | BCB 569](/caf-api/connect/available-resources/joint-resolution-6/changelog.md#2026-12-01---rs6-gmud-unauthorized-betting-operators--bcb-569), this object is **required** when `registro.classificacao_irregularidade` is equal to: 1.
| Field | Description | Field Requirement | Data type | Options | Examples |
| ------------------------------- | ----------------------------------------------------------------------------------- | ----------------- | --------- | -------------------------- | ------------------- |
| nome | The fraudster's full name or corporate name. | Required | string | - | "João Silva" |
| documento | The fraudster's identification document. | Required | object | [schema](#document-object) | - |
| razao\_social | The fraudster's company name, when applicable. | Optional | string | - | "Empresa XYZ Ltda." |
| documento\_representante\_legal | Identification documents of the fraudster's legal representatives, when applicable. | Optional | array | [schema](#document-object) | - |
### Claimer Information Object: `informacao_reclamante`
This object represents the claimer's information. It's a **conditional object**: if the `informacao_executor` object is not provided, the `informacao_reclamante` object is **required**.
| Field | Description | Field Requirement | Data type | Options | Examples |
| ------------------------------- | --------------------------------------------------------------------------------- | ----------------- | --------- | -------------------------- | -------- |
| documento | The claimer's identification document. | Required | object | [schema](#document-object) | - |
| documento\_representante\_legal | Identification documents of the claimer's legal representatives, when applicable. | Optional | array | [schema](#document-object) | - |
### Occurrence Object: `registro`
This object describes the general data from occurrence. It's a **required object**.
| Field | Description | Field Requirement | Data type | Options | Examples |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| data\_hora | Timestamp in ISO format "YYYY:MM::DDThh:mm:ss.sTZD" denoting the occurrence of the suspected fraud attempt. | Required | string | - | "2024-04-03T12:00:00Z" |
| atividade\_relacionada | Activity related to the occurrence or attempted fraud, as per the list. | Required | integer | 1 - Opening a deposit account or payment account
2 - Maintenance of a deposit account or payment account
3 - Contracting a credit operation
4 - Transfers between accounts within the same institution
5 - Electronic Funds Transfer (TED)
6 - Payment transactions using checks
7 - Instant payment transactions (Pix)
8 - Transfers through Credit Document (DOC)
9 - Payment slips
10 - Withdrawals of funds in cash
11 - Virtual asset service provision
| 5 |
| classificacao | Occurrence classification. | Required | integer | 1 - Confirmed Fraud
2 - Suspected Fraud
3 - Irregularity
| 1 |
| classificacao\_irregularidade | Irregularity type classification. | Conditional
This field is required and exclusive when registro.classificacao is equal to: 3
| integer | 1 - Activity as an unauthorized betting operator | 1 |
| envolvimento\_reclamante | Indicates whether there was the involvement of the client in the occurrence or attempted fraud. The client's involvement is independent of whether it was by third parties or not. | Required | integer | 1 - Yes
2 - No
| 1 |
| valor\_transacao | If the fraud indication is a payment operation, indicate the transaction amount. | Conditional
This field is required when registro.atividade\_relacionada is equal to: 4, 5, 6, 7, 8, 9, 10 or 11
| number | - | 1000.00 |
| valor\_contrato | If the fraud indication is a credit operation, indicate the contract amount. | Conditional
This field is required when registro.atividade\_relacionada is equal to: 3
| number | - | 5000.00 |
| canal | Interaction form or channel used for the execution of the occurrence or attempted fraud. | Optional | integer | 1 - Internet
2 - Mobile
3 - Self-service
4 - Partner Network
5 - Social Media
6 - Interbank
7 - Others
| 3 |
| local | Location where the activity was realized, when applicable. | Optional | string | - | "Agência X" |
| motivo | Description of the cause or procedure that led to the occurrence or attempted fraud, when applicable. | Conditional
This field is required when registro.modalidade\_fraude is equal to: 98 or 99;
or registro.classificacao is equal to: 3
| string | - | "Cobrança indevida" |
| modalidade\_fraude | Modality related to the occurrence or attempted fraud, as per the list. | Required
This field is required when registro.classificacao is not equal to: 3
| integer | 1 - Self Fraud
2 - Mule Account
3 - Identity Theft (ITO)
4 - Synthetic Identity
5 - Account Takeover - ATO
6 - Friendly/Family/Second-Party Fraud
7 - Buyer Fraud
8 - Seller Fraud
9 - SIM Swap
10 - Fraud with Altered Payment Slips
11 - Benefits Fraud
12 - Kidnapping or Extortion
98 - Inconclusive
99 - Unlisted Modality
| 5 |
| dispositivo | Information about the device used. | Optional | object | - | - |
| dispositivo.identificacao | Identification of the device used in the execution of the occurrence or attempted Fraud. | Optional | string | - | "ID-1234" |
| dispositivo.ip | Description of information regarding the Internet Protocol (IP) address of the device used in the occurrence or attempted fraud, when applicable. | Optional | string | - | "192.168.0.1" |
| operadora\_aposta\_dominio | Domain/URL related to the irregular betting operator | Conditional
This field is optional and exclusive when registro.classificacao\_irregularidade is equal to: 1
| string | - | "irregular-bet.com" |
| ativo\_virtual | Information about the virtual asset. | Conditional
This field is required when registro.atividade\_relacionada is equal to: 11
| object | - | - |
| ativo\_virtual.tipo\_operacao | Classifies the nature of the reported operation. | Required | integer | 1 - Purchase
2 - Sale
3 - Transfer / withdrawal to external wallet
4 - Receipt from external wallet
5 - Internal transfer between clients
6 - Exchange between virtual assets
7 - Deposit
99 - Other
| 1 |
| ativo\_virtual.moeda | Currency symbol of the moved virtual asset. | Required | string | Regular expression: ^\[A-Z0-9]{1,10}$
Must also match a canonical virtual asset symbol (e.g., BTC, ETH, LTC, DOGE).
| "BTC" |
| ativo\_virtual.quantidade | Quantity of the virtual asset associated with the fraud indication. | Required | string | Regular expression: `^\d+[.,]\d+$` | "0,00000001" |
| ativo\_virtual.transacao\_id | Unique transaction identifier (hash). | Optional | string | - | "1843b174549cfbe3f6ba979df44c5b1b4632876b6aa99b1a51057c79219b2fd8" |
#### Relation Fraud Modality <> Related Activity
The `registro.modalidade_fraude` has a dependent relation with `registro.atividade_relacionada`. The relationships in the table below are allowed, any relationship outside the table is invalid. Additionally `registro.modalidade_fraude` is **blocked** when `registro.classificacao` is equal to: 3.
| **atividade\_relacionada** | **modalidade\_fraude** |
| -------------------------- | ----------------------------------------- |
| **1** | 1, 2, 3, 4, 6, 9, 11, 12, 98, 99 |
| **2** | 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 98, 99 |
| **3** | 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 98, 99 |
| **4** | 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 98, 99 |
| **5** | 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 98, 99 |
| **6** | 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 98, 99 |
| **7** | 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 98, 99 |
| **8** | 1, 2, 3, 4, 5, 6, 7, 8, 9, 11, 12, 98, 99 |
| **9** | All |
| **10** | 1, 2, 3, 4, 5, 6, 9, 11, 12, 98, 99 |
| **11** | 1, 2, 3, 4, 5, 6, 7, 8, 12, 98, 99 |
Another relationship present in the schema was introduced by [GMUD Unauthorized Betting Operators | BCB 569](/caf-api/connect/available-resources/joint-resolution-6/changelog.md#2026-12-01---rs6-gmud-unauthorized-betting-operators--bcb-569), limiting the available values of `registro.atividade_relacionada` when `registro.classificacao_irregularidade` is equal to: 1. The available values are: 4, 5, 6, 7, 8, 9 and 10.
### Document Object
This object represents an identification document; it can be either an individual's or a legal entity's document. This object representation is used by the [Claimer Information Object](#claimer-information-object-informacao_reclamante), [Fraudster Information Object](#fraudster-information-object-informacao_executor), and [Destination Bank Account Object](#destination-bank-account-object-informacoes_bancarias_destino).
| Field | Description | Field Requirement | Data type | Options | Examples |
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | --------- | -------------------------- | ------------- |
| tipo | Indicates if is an individual or a legal entity. | Required | integer | 1 - CPF
2 - CNPJ
| 1 |
| numero | If document type is "1" this attribute must contain the CPF. If it's a legal entity ("2"), it should contain the complete CNPJ. Numeric attribute, without leading zeros. | Required | string | - | "81321273070" |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.caf.io/caf-api/connect/available-resources/joint-resolution-6/suspected-fraud-creation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.