Fraud Signal in ID verification

Every successful identity verification (BVN, NIN, passport, driver's licence, voter's card) carries a fraud_signals node, in two places: inside data (so it is saved with the verification and shown on its report) and on the first level of the response, next to data and billing_info. It is the same node in both. The webhook sent for the verification carries both too. There is nothing to switch on in the request. An organisation can turn it off for its own responses on the API Status page (see the last bullet).

Sample response

{
  "status": true,
  "response_code": "00",
  "data": {
    "...": "the verification result",
    "fraud_signals": {
      "status": "completed",
      "overall_risk_score": 90.0,
      "risk": "high",
      "signals": [
        { "type": "fraud_lens", "severity": "high",
          "message": "Matches 1 fraud report in Fraud Lens (1 verified)." },
        { "type": "watchlist", "severity": "high",
          "message": "This ID number is on the fraud watchlist." }
      ]
    }
  },
  "fraud_signals": {
    "status": "completed",
    "overall_risk_score": 90.0,
    "risk": "high",
    "signals": [ "... the same list as in data.fraud_signals" ]
  },
  "billing_info": { "...": "..." }
}

• overall_risk_score is 0 to 100 and risk is low (under 30), medium (30 to 74) or high (75 and over). Both already cover every signal that hit. signals lists only the signals that were detected, so a clean identity returns [].
• Signal types here: fraud_lens (the ID number matches fraud reports), watchlist, velocity (the ID was queried by many organisations in a short time).
• status is completed, or error when the check could not be completed. An error never fails the verification.
• It runs only the quick ID-number checks. It is part of the verification price, so there is no extra charge, and it only reads: it creates no fraud reports, alerts or tracking entries.
• The node is not in the response for other kinds of verification, for a verification that did not succeed, or in sandbox.
• On/off per organisation: it is on by default. Owners and admins can turn it off or on from the API Status page in the dashboard (GET/PATCH /api/v1/verification/fraud-signals/settings/, body {"enabled": false}), and the node is then left out of that organisation's responses and webhooks. Prembly staff can also switch it off for an organisation in the admin (fraud_signals_allowed); the organisation then cannot turn it back on.
• VERIFICATION_FRAUD_SIGNALS_ENABLED=False switches it off everywhere.