Suspected Fraud Creation

Authentication Requirements:

• Regular endpoints use OAuth2 authentication with base URL: https://api.us.prd.caf.io
• For enhanced security, some endpoints may also support mTLS authentication with base URL: https://mtls.us.prd.caf.io
• For information on implementing mTLS, access Using mTLS

A suspected fraud creation request inserts a suspected fraud into your peer's database and this data becomes available to other peers in the network.

Suspected Fraud Creation

post

https://api.us.prd.caf.io/v1/rs6https://mtls.us.prd.caf.io/v1/rs6https://api.us.stg.caf.io/v1/rs6https://mtls.us.stg.caf.io/v1/rs6

/suspected-fraud

Inserts a suspected fraud into your peer's database and this data become available to other peers in the network.

Permission required: Create RS6

Authorizations

bearerAuth

AuthorizationstringRequired

JWT Authorization header using the Bearer scheme.

Header parameters

AuthorizationstringRequired

Your access token. See more in the 'Authentication' topic of this section.

Example: Bearer YOUR_TOKEN

Body

application/json

Suspected fraud occurence, condenses all relevant information about a suspected fraud.

Responses

200

Suspected fraud creation occurred successfully.

application/json

messagestringRequired

Human readable message informing about the operation.

fraudTokenstring · uuidRequired

Unique identifier of the suspected fraud.

400

Suspected fraud creation failed due to a bad request.

application/json

401

Unauthorized.

application/json

422

Suspected fraud creation failed, but the request was processed by the API, just not by the peer.

application/json

500

Suspected fraud creation failed due to an unexpected error in the API.

application/json

503

Suspected fraud creation failed due to an unexpected error in the Peer.

application/json

post/suspected-fraud

HTTPcURLJavaScriptPython

POST /v1/rs6/suspected-fraud HTTP/1.1
Host: api.us.prd.caf.io
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 1009

{
  "instituicao_responsavel": {
    "cnpj_origem": "text",
    "razao_social_origem": "text"
  },
  "informacoes_bancarias_destino": {
    "codigo_instituicao": 1,
    "ispb": "text",
    "agencia": "text",
    "conta": {
      "numero": "text",
      "tipo": 1,
      "titular": {
        "documento": {
          "tipo": 1,
          "numero": "text"
        },
        "nome_completo_razao_social": "text",
        "nome_fantasia": "text"
      },
      "documento_representante_legal": [
        {
          "tipo": 1,
          "numero": "text"
        }
      ]
    },
    "chave_pix": {
      "tipo": 1,
      "valor": "text"
    },
    "linha_digitavel_boleto": "text"
  },
  "informacao_executor": {
    "nome": "text",
    "razao_social": "text",
    "documento": {
      "tipo": 1,
      "numero": "text"
    },
    "documento_representante_legal": [
      {
        "tipo": 1,
        "numero": "text"
      }
    ]
  },
  "informacao_reclamante": {
    "documento": {
      "tipo": 1,
      "numero": "text"
    },
    "documento_representante_legal": [
      {
        "tipo": 1,
        "numero": "text"
      }
    ]
  },
  "registro": {
    "data_hora": "2026-08-11T05:14:00.703Z",
    "local": "text",
    "canal": 1,
    "atividade_relacionada": 1,
    "classificacao": 1,
    "motivo": "text",
    "valor_transacao": 1,
    "valor_contrato": 1,
    "dispositivo": {
      "identificacao": "text",
      "ip": "0.0.0.0"
    },
    "envolvimento_reclamante": 1,
    "modalidade_fraude": 1
  }
}

{
  "message": "text",
  "requestStatus": {
    "status": "SUCCESS",
    "token": "123e4567-e89b-12d3-a456-426614174000"
  },
  "fraudToken": "123e4567-e89b-12d3-a456-426614174000"
}

Occurrence Data Model

As demonstrated in the example request, a suspected fraud occurrence is composed of the following properties:

• instituicao_responsavel: it is a required field and is represented by responsible institution object schema;
• informacoes_bancarias_destino: it is a conditional field and is represented by destination bank account object schema;
• informacao_executor: it is a conditional** field and is represented by fraudster information object schema;
• informacao_reclamante: it is a conditional** field and is represented by claimer information object schema;
• registro: it is a required field and is represented by occurrence object schema.

** At least one of the objects, informacao_executor or informacao_reclamante, must be present.

Responsible Institution Object: instituicao_responsavel

This object describes the financial institution submitting the occurrence. It's a required object.

Field	Description	Field Requirement	Data type	Options	Examples
cnpj_origem	Financial institution's CNPJ submitting fraud evidence.	Required	string	-	"52337497000131"
razao_social_origem	Registered entity's legal name, the financial institution submitting evidence of fraud.	Required	string	-	"Empresa XYZ Ltda."

Destination Bank Account Object: informacoes_bancarias_destino

This object describes the banking information of the destination account of the occurrence, when applicable. It's a conditional object, if registro.atividade_relacionada is equal to: 4, 5, 6, 7 or 8; the informacoes_bancarias_destino object is required.

Field	Description	Field Requirement	Data type	Options	Examples
agencia	Destination bank branch code. It must consist of the branch prefix and the check digit without a separator/hyphen.	Conditional This field is required when chave_pix.tipo is equal to: 6	string	-	"0123"
codigo_instituicao	Deprecated ISPB of the destination institution.	Conditional This object is required when ispb is not provided	integer	-	00000000
ispb	ISPB of the destination institution.	Conditional This object is required when codigo_instituicao is not provided	string	-	"00A0Z000"
conta	Destination bank account details.	Conditional This object is required when registro.atividade_relacionada is equal to: 4, 5, 6, 7 or 8; Or when chave_pix.tipo is equal to: 6	object	-	-
conta.numero	Destination bank account number. It must consist of the account prefix and the check digit without a separator/hyphen.	Required	string	-	"1234567890"
conta.tipo	Type of destination bank account.	Required	integer	1 - CV Sight deposit account (checking account) 2 - CP Savings deposit account (savings account) 3 - PP Prepaid Payment account	1
conta.titular	Destination account holder details.	Conditional This field is required when registro.atividade_relacionada is equal to: 4, 5, 6, 7 or 8	object	-	-
conta.titular.documento	Destination account holder identification document.	Optional	object	schema	-
conta.titular.nome_completo_razao_social	Destination account holder full name.	Optional	string	-	"Maria Silva"
conta.titular.nome_fantasia	Destination account holder company name, when applicable.	Optional	string	-	"Empresa XYZ"
conta.documento_representante_legal	Identification documents of the account holder legal representatives, when applicable.	Optional	array	schema	-
chave_pix	PIX key of the destination account suspected of fraud.	Conditional This object is required when registro.atividade_relacionada is equal to: 7	object	-	-
chave_pix.tipo	Type of PIX key.	Required	integer	1 - CPF 2 - CNPJ 3 - Phone Number 4 - E-mail 5 - Random 6 - Bank Account	4
chave_pix.valor	Value of PIX Key.	Conditional This field is required when chave_pix.tipo is not equal to: 6	string	-	"[email protected]"
linha_digitavel_boleto	Digitable line of the payment slip linked to suspected destination account fraud.	Conditional This field is required when registro.atividade_relacionada is equal to: 9	string	-	"00190500950448160698093503143373700000001000"

Fraudster Information Object: informacao_executor

This object represents the fraudster information, when available. It's a conditional object, if the informacao_reclamante object was not provided, the informacao_executor object is required.

Field	Description	Field Requirement	Data type	Options	Examples
nome	The Fraudster full name or corporate name.	Required	string	-	"João Silva"
documento	The Fraudster identification document.	Required	object	schema	-
razao_social	Company name, when applicable.	Optional	string	-	"Empresa XYZ Ltda."
documento_representante_legal	Identification documents of the fraudster legal representatives, when applicable.	Optional	array	schema	-

Claimer Information Object: informacao_reclamante

This object represents the claimer information. It's a conditional object, if the informacao_executor object was not provided, the informacao_reclamante object is required.

Field	Description	Field Requirement	Data type	Options	Examples
documento	The Claimer identification document.	Required	object	schema	-
documento_representante_legal	Identification documents of the claimer legal representatives, when applicable.	Optional	array	schema	-

Occurrence Object: registro

This object describes the general data from occurrence. It's a required object.

Field	Description	Field Requirement	Data type	Options	Examples
data_hora	Timestamp in ISO format "YYYY:MM::DDThh:mm:ss.sTZD" denoting the occurrence of the suspected fraud attempt.	Required	string	-	"2024-04-03T12:00:00Z"
atividade_relacionada	Activity related to the occurrence or attempted fraud, as per the list.	Required	integer	1 - Opening a deposit account or payment account 2 - Maintenance of a deposit account or payment account 3 - Contracting a credit operation 4 - Transfers between accounts within the same institution 5 - Electronic Funds Transfer (TED) 6 - Payment transactions using checks 7 - Instant payment transactions (Pix) 8 - Transfers through Credit Document (DOC) 9 - Payment slips 10 - Withdrawals of funds in cash 99 - Others	5
classificacao	Occurrence classification.	Required	integer	1 - Confirmed Fraud 2 - Suspected Fraud	1
envolvimento_reclamante	Indicates whether there was the involvement of the client in the occurrence or attempted fraud. The client's involvement is independent of whether it was by third parties or not.	Required	integer	1 - Yes 2 - No	1
valor_transacao	If the fraud indication is a payment operation, indicate the transaction amount.	Conditional This field is required when registro.atividade_relacionada is equal to: 4, 5, 6, 7, 8, 9 or 10	number	-	1000.00
valor_contrato	If the fraud indication is a credit operation, indicate the contract amount.	Conditional This field is required when registro.atividade_relacionada is equal to: 3	number	-	5000.00
canal	Interaction form or channel used for the execution of the occurrence or attempted fraud.	Optional	integer	1 - Internet 2 - Mobile 3 - Self-service 4 - Partner Network 5 - Social Media 6 - Interbank 7 - Others	3
local	Location where the activity was realized, when applicable.	Optional	string	-	"Agência X"
motivo	Description of the cause or procedure that led to the occurrence or attempted fraud, when applicable.	Conditional This field is required when registro.modalidade_fraude is equal to: 98 or 99	string	-	"Cobrança indevida"
modalidade_fraude	Modality related to the occurrence or attempted fraud, as per the list.	Required This field is required when registro.data_hora is greater than March 10, 2025	integer	1 - Self Fraud 2 - Mule Account 3 - Identity Theft (ITO) 4 - Synthetic Identity 5 - Account Takeover - ATO 6 - Friendly/Family/Second-Party Fraud 7 - Buyer Fraud 8 - Seller Fraud 9 - SIM Swap 10 - Fraud with Altered Payment Slips 11 - Benefits Fraud 12 - Kidnapping or Extortion 98 - Inconclusive 99 - Unlisted Modality	5
dispositivo	Information about the device used.	Optional	object	-	-
dispositivo.identificacao	Identification of the device used in the execution of the occurrence or attempted Fraud.	Optional	string	-	"ID-1234"
dispositivo.ip	Description of information regarding the Internet Protocol (IP) address of the device used in the occurrence or attempted fraud, when applicable.	Optional	string	-	"192.168.0.1"

Relation Fraud Modality <> Related Activity

The registro.modalidade_fraude has a dependent relation with registro.atividade_relacionada. The relationships in the table below are allowed, any relationship outside the table is invalid.

modalidade_fraude	atividade_relacionada
1	All
2	All
3	All
4	All
5	2, 3, 4, 5, 6, 7, 8, 9 or 10
6	All
7	2, 3, 4, 5, 6, 7, 8 or 9
8	2, 3, 4, 5, 6, 7, 8 or 9
9	All
10	9
11	All
12	All
98	All
99	All

Document Object

This object represents an identification document, it can be an individual or a legal entity document. This object representation is used by: Claimer Object, Fraudster Object and Destination Bank Account Object.

Field	Description	Field Requirement	Data type	Options	Examples
tipo	Indicates if is an individual or a legal entity.	Required	integer	1 - CPF 2 - CNPJ	1
numero	If document type is "1" this attribute must contain the CPF. If it's a legal entity ("2"), it should contain the complete CNPJ. Numeric attribute, without leading zeros.	Required	string	-	"81321273070"