Understanding Scores

Every Trustfull product returns a score and a score_cluster that summarize the risk level of the input being analyzed. This guide explains how scores are calculated, what each cluster means, and how to use them to make decisions.

The Scoring Scale

Trustfull scores range from 0 to 1000:

• 0 represents the highest risk (most likely fraudulent or suspicious)
• 1000 represents the lowest risk (most likely legitimate and trustworthy)

The score is computed by a proprietary scoring engine that evaluates hundreds of signals and applies weighted rules and gates. For details on how the engine works, see Score Normalization.

Score Clusters

While the numeric score provides granularity for automated decision-making, the score_cluster provides a human-readable risk band that simplifies review workflows and reporting.

Note: Score ranges are approximate and may vary slightly depending on the product and model configuration. The cluster assignment is determined by the scoring engine and takes into account normalization and gating logic. Always rely on the score_cluster field for cluster-level decisions rather than applying fixed numeric thresholds.

How Scores Are Built

Each score is the result of a transparent, rule-based evaluation process:

1. Data Collection — Trustfull's fraud agents collect signals from carriers, social networks, messaging apps, OSINT databases, WHOIS records, and other sources.

2. Rule Evaluation — Each signal is evaluated against a set of weighted rules. For example:

   • A disposable phone number triggers a risk rule (high weight)
   • An active WhatsApp profile with a real photo triggers a trust rule (medium weight)
   • A recently ported number triggers a risk rule (low weight)

3. Gates — Gates act as upper bounds, ensuring that critical risk signals cap the score regardless of positive signals. For example, a disposable phone number will never score above a certain threshold, no matter how many trust signals are present.

4. Normalization — After gating, scores are normalized to preserve relative ordering within each cluster. Two users in the same cluster remain distinguishable for prioritization purposes. See Score Normalization for details.

5. Reason Codes — The rules that contributed to the final score are returned as reason codes, making every score fully explainable.

Scores Across Products

Each Trustfull product returns its own score:

When using the Onboarding product, you receive individual scores for each signal (phone, email, IP) as well as cross-signal consistency checks. There is no single "onboarding score" — instead, you get granular visibility into each component, which gives you flexibility in how you combine them for your decisioning logic.

Using Scores in Your Workflow

Automated Decisioning

For fully automated flows, use score clusters to drive accept/review/reject decisions:

These are general guidelines. The right thresholds for your business depend on your risk appetite, user base, and regulatory requirements. We recommend starting with the table above and adjusting based on your observed fraud and false-positive rates.

Manual Review Prioritization

Within the review cluster, use the numeric score to prioritize which cases analysts should look at first. A score of 410 represents higher risk than a score of 580, even though both are in the same cluster. This is possible thanks to score normalization, which preserves internal ordering.

Combining Multiple Scores

When using the Onboarding product, you receive scores for phone, email, and IP separately. Common strategies include:

• Minimum score: Use the lowest individual score as the overall risk indicator. This is the most conservative approach.
• Weighted average: Apply business-specific weights to each score (e.g. phone: 40%, email: 35%, IP: 25%).
• Worst cluster: Trigger review if any individual cluster is low or very_low, regardless of other scores.
• Reason code analysis: Instead of relying on scores alone, check for specific high-weight reason codes that are critical for your use case.

Reason Codes: The "Why" Behind the Score

Every score comes with reason codes that explain which rules contributed to it. Reason codes are the most powerful tool for building custom decisioning logic.

• Risk signals (prefix R) indicate red flags — e.g. RP001 (Phone Disposable), RE005 (Email Invalid)
• Trust signals (prefix T) indicate positive indicators — e.g. TP004 (Phone Regular Velocity), TE005 (Email With Web Reviews)
• Each reason code has a weight (1 = low, 2 = medium, 3 = high) indicating its severity or importance

For example, a phone number with score 350 and cluster low might include these reason codes:

Conversely, a phone number with score 850 and cluster very_high might include:

For the complete list, see Reason Codes.

What's Next

• Your First API Call — Get started with a working API request
• Integration Guide — End-to-end integration walkthrough
• Score Normalization — Deep dive into how normalization preserves intra-cluster ordering
• Reason Codes — Full catalogue of all risk and trust signals