Marketplace scam detection

Marketplace scams rarely show up in a single message. A buyer asks a normal question, then asks to move to WhatsApp, then offers to pay by wire "plus shipping", then sends a link to a fake payment page. Keyword filters catch the last step, if that. SigWise scores the user, over everything they have said and done, so the pattern is visible as it forms.

What to send

Send each user's activity as events on an object named after your user ID:

• Messages between buyers and sellers, with the listing in metadata.
• Actions that matter for fraud: sign-up, profile and payout changes, failed logins, listings created, reports by other users.
• Context in metadata: account age, country, price, amount.

POST /v1/objects/user-42/events
{
  "object_type": "user",
  "events": [
    { "type": "event", "name": "account.created", "metadata": { "country": "NG" } },
    { "type": "message", "content": "is this still available? I'm abroad, can I pay by wire and my courier picks up?",
      "metadata": { "listing": "bike-221", "price": 450 } },
    { "type": "message", "content": "I sent $950 by mistake, please refund the difference to my cousin" }
  ]
}

Ingestion returns 202 right away. Events that arrive within a few seconds of each other are analyzed together. See Ingesting events.

The signals

Every account starts with is_scammer. Make its criteria concrete for your marketplace. Describing the evidence steers the analyzer much more than words like "suspicious" do:

PUT /v1/signals/is_scammer
{
  "type": "noul",
  "instructions": "Decide whether this user is trying to defraud other users of the marketplace.",
  "criteria": {
    "true": "asks to pay or talk off-platform, overpays and asks for a refund, sends payment or courier links, pressures for urgency, story does not add up",
    "false": "ordinary questions about the item, price negotiation, arranging pickup on the platform"
  }
}

Add narrower signals when you want to act on them differently:

PUT /v1/signals/scam_type
{
  "type": "choice",
  "instructions": "If this user is running a scam, which kind?",
  "criteria": {
    "none": null,
    "off_platform_payment": "moves payment outside the marketplace",
    "overpayment": "pays too much and asks for the difference back",
    "phishing": "sends links to fake payment or login pages",
    "account_takeover": "behaviour changes abruptly after a login from a new place"
  }
}

See Signals for the three types.

Acting on the answers

• Block a message before it is delivered. Send it with "wait": true and "signals": ["is_scammer"], and hold it if the probability is high. See Direct moderation.
• Review queue. List the riskiest users first: GET /v1/objects?q=is_scammer >= 80&sort=flagged. See Search and conditions.
• Alert your team. A rule posts to Slack when a user crosses the line, once, not on every message:

POST /v1/rules
{
  "name": "likely scammer",
  "when": "is_scammer >= 90",
  "action_type": "slack",
  "action_config": { "webhook_url": "https://hooks.slack.com/services/T000/B000/XXXX" }
}

• Automate. Subscribe a webhook to analysis.completed and freeze payouts or hide listings in your own code.

Cost

Each analysis is billed at its model cost, typically a fraction of a cent. A short marketplace conversation costs about $0.0001. Bursts of messages are folded into one analysis, so you pay per conversation turn, not per event. See Billing and usage.

Next steps

• Quickstart: your first signal, event and answer in five minutes.
• User trust scores: rank users by trustworthiness, not only flag the worst.