A fintech product is, mechanically, a machine for sending people links — push notifications, transactional SMS, receipt emails, magic links, statement alerts. That habit is what makes the brand worth imitating, and it is why link screening in a fintech belongs in two places most teams never instrument: everything you send, and everything your users paste into support.
Every product decision that made onboarding fast also made impersonation easy. That is not a criticism — it is the design constraint.
Consider what a well-run neobank asks of a customer in an ordinary month.
Each of those is a small, legitimate message asking the user to tap something and, quite often, to authenticate on the other side. Over a year the user is trained — deliberately, correctly, by you — to treat an unexpected message from your brand as normal and to act on it quickly.
The property an attacker gets for nothing. They do not need to break anything to exploit the habit you built — they need to send one more message of the same shape. The economics are trivially in their favour: your onboarding funnel spent real money teaching a person to recognise your tone of voice and act on it, and the phishing message inherits that training for free.
This is why fintech impersonation converts at rates that surprise teams coming from other industries, and why the usual advice — "tell users we will never ask for X" — degrades so fast. You will ask for something that looks like X, because your product genuinely needs to.
There is a second structural feature that makes this worse for a fintech than for an incumbent bank: the app is the entire relationship, and your users have nothing offline to compare against. When something feels wrong, the verification channel available to them is in-app support, a public community forum, a subreddit, a Discord, or a search engine — and every one of those is a channel an attacker can also post in. A worried user searching for "how do I contact [your brand] support" is one of the most reliably monetisable moments in consumer fraud, and it happens outside your product entirely.
What follows is not a threat briefing. It is a description of the two screening surfaces a fintech engineering team can actually own, plus the arithmetic for what they cost at scale.
The first surface is outbound: every link your own systems emit, checked before dispatch, so your channel is never the delivery mechanism. The second is inbound: every URL a user or an agent pastes into a support conversation, a community post or a dispute form, checked at the moment it appears. Neither requires changing your product's design. Both produce a dated record you can show a partner bank, a payment scheme or a regulator.
If your product sits closer to a licensed institution or a card programme, the framing on our banking and finance page and the sector overview on banking and financial services will be closer to the conversations you are having. This page assumes a product team, a growth team and an engineer who can add a call to a send pipeline this sprint.
This is the placement that surprises people, because the instinct is that your own links are obviously fine. Mostly they are. The failure cases are specific, and each one has bitten a real product.
The gate itself is small. Before a campaign or a transactional template goes out, collect the distinct destination hostnames, submit them to the batch endpoint, and refuse to dispatch if anything comes back flagged. Do it in the send pipeline rather than in the authoring tool, because the authoring tool is not where the last-minute change happens. Do it again on a schedule for long-lived templates — a password-reset email may have shipped its current link two years ago and nobody has looked at it since.
You are checking distinct domains, not messages. A campaign to four million users with three distinct destination domains costs three credits. A month of transactional templates across every channel might be a few hundred distinct hostnames in total. The cost of screening your entire outbound estate is a rounding error next to a single hour of incident response, and it converts an assumption into a dated, per-campaign log line.
The same three lines of code protect a two-message internal test and a four-million-recipient campaign, because the unit of work is the hostname rather than the send.
The support conversation is where fintech fraud is discovered and where it is frequently completed. A user writes in because a payment failed, and somewhere in that thread a URL appears. It arrives in one of three ways.
Screening at that moment is the highest-value inbound placement you have, because unlike outbound it also produces intelligence. Every URL a user submits is a report from the field about a campaign currently targeting your customers. Attach a verdict at ingest, and a support queue becomes a live impersonation sensor: cluster the flagged hostnames by day and you can see a campaign starting hours before the complaint volume makes it obvious.
Instrument the same call in each of them: the in-app support composer, the email support intake, the dispute and chargeback form, the community or forum post editor, and the agent console — so a responder never pastes a link that would fail your own check.
For community platforms, screening at post time rather than on report is what stops the link being live for the three hours before a moderator sees it. The mechanics for that pattern are covered further on our messaging apps and URL shorteners pages.
A flagged host is also a containment trigger: check whether the reporting account authenticated from an unusual session in the preceding hours, and treat it as an attempted takeover until shown otherwise.
Attackers do not clone your product. They clone the four screens where a user hands something over.
A cloned or near-identical listing, a landing page that mirrors your marketing site, and paid placement against your brand name in search means the user never types a URL at all — they arrive through an advert or a listing and the fake sign-in screen is the first thing they see. The domain behind that landing page is an ordinary registered domain and is exactly the kind of thing a known-bad list enumerates once it has been reported and verified as live.
The prize here is not a password. A page that mimics your KYC or re-verification step collects a passport scan, a selfie, a proof of address and a bank statement in a single submission — a complete identity package, worth far more resold than a single account balance, and one the victim cannot revoke by changing a password. Lending and BNPL products are hit hardest, because their genuine application flow legitimately asks for exactly that bundle, so the fake one raises no suspicion at all.
The genuine open-banking flow already involves being redirected away from one brand's app to another brand's authorisation screen and approving broad access. A fake intermediary that sits in that redirect chain inherits all of the user's expectation that being bounced between domains is normal. Screening the destination host at the point the redirect is generated — and refusing to hand off to a host that is flagged — is the only control on this page that operates inside the flow rather than around it.
If your product is distributed through partners — a BNPL option inside a retailer's checkout, a card issued under a marketplace's brand, a lending product embedded in an accounting tool — the user's mental model of "who is asking me for this" gets blurry in a way that helps attackers enormously. They are used to seeing a payment step branded by a company that is not their bank, hosted on a domain that is not either brand's main site. That is the normal experience, so a fraudulent version of it is not obviously abnormal.
The practical response is to make the domain inventory explicit and then screen against it. Enumerate every hostname that legitimately appears in a user-facing flow across every partner integration: checkout subdomains, hosted payment pages, redirect intermediaries, partner support portals. That list is usually shorter than teams expect, and almost nobody maintains it. Once it exists, two things become possible.
The same discipline applies in reverse to anything a partner sends on your behalf. A retailer emailing customers about a BNPL instalment is sending a message that carries your risk with their infrastructure. Make screening a contractual line item rather than a hope, and ask for the log. Our payment processors page covers the equivalent obligation from the acquirer's side.
Screen the whole inventory on a weekly job. It is a handful of credits, and it is the cheapest way to find out that something you own has quietly become something you do not.
They are not alternatives so much as layers with different costs. It helps to be honest about which does what.
| Decision factor | Hand-maintained denylist | Heuristic lookalike scoring | DNS-verified known-bad list |
|---|---|---|---|
| Catches a domain nobody has reported yet | No — only what your team saw | Sometimes, on name similarity | No — it is a known-bad list |
| Catches a campaign already running against your users | After someone adds it by hand | Only if the name resembles yours | Yes, once observed and verified live |
| False positives on legitimate partner domains | Rare, you control every entry | Common — similarity is not intent | Rare, entries are verified before publication |
| Ongoing engineering cost | Permanent manual upkeep | Tuning thresholds forever | One integration, then a cron entry |
| Latency inside a send or support path | In-memory, negligible | Depends on the scoring model | Typically under 50 ms per lookup |
| Produces an auditable record | Only if you build one | A score is hard to explain later | Domain, verdict, timestamp, list version |
| Cost at millions of notifications | No licence cost, minus the salary maintaining it | Compute scales with volume | Priced per distinct domain, not per message |
It is the layer with the best ratio of coverage to effort: one integration, no thresholds to tune, no ongoing curation, and a verdict you can explain to a partner bank in one sentence. It removes the traffic that is already known hostile, which is the majority, and it does so without ever guessing about a domain it has not seen. See pricing for the credit ladder.
Name-similarity scoring earns its place in a brand-monitoring queue that an analyst reads, where a false positive costs a minute. It is a poor fit for an automatic block inside a payment or support flow, where a false positive costs a customer. Keep the automated gate on verified facts and let the fuzzy signal feed a human.
The most common sizing mistake is budgeting one credit per message. You are buying lookups of distinct domains.
GET /api/v1/check takes one hostname and your key and returns a verdict — this is the call for a support composer, a community post editor or an agent console, anywhere a human is waiting. POST /api/v1/batch takes a JSON body with your key and up to a hundred domains, charging one lookup each — this is the call for send pipelines, weekly inventory sweeps and any bulk pass. The response carries the domain, whether it is phishing, the category, the DNS status, when it was last checked, a confidence value and the current database size, so one handler covers both. Keep the key server-side: a key shipped inside a mobile binary or a web bundle is a credential anyone can extract and spend.
curl "https://phishingdetectionapi.com/api/v1/check?domain=secure-account-verify.example.net&apikey=YOUR_API_KEY"
{
"domain": "secure-account-verify.example.net",
"is_phishing": true,
"category": "phishing",
"dns_status": "resolving",
"last_checked": "2026-07-27T05:12:44Z",
"confidence": 0.98,
"database_size": 390000
}POST https://phishingdetectionapi.com/api/v1/batch
Content-Type: application/json
{
"apikey": "YOUR_API_KEY",
"domains": [
"links.yourbrand.example",
"pay.partner-checkout.example",
"kyc-upload.vendor.example"
]
}Now the arithmetic, worked through for a product at real scale. Suppose you send eight million notifications a month across push, SMS and email. Those messages contain, generously, forty distinct destination hostnames — your deep-link host, your click-tracker, two shorteners, a help-centre domain, a handful of partner checkout hosts and a long tail of campaign microsites.
Screening every template and campaign in that month, with a verdict cache per rebuild cycle, costs roughly forty credits a day if you re-check daily — call it 1,200 credits a month for the entire outbound surface of an eight-million-message product. Inbound is where the volume actually lives, because URLs pasted by users are unbounded and mostly unique. A support operation handling forty thousand contacts a month might see six thousand messages containing a URL, of which perhaps four thousand are distinct hostnames after caching. Add a community platform and it might double.
The honest monthly shape for a mid-size fintech is a few hundred credits of outbound screening and several thousand of inbound, which sits comfortably inside Professional at $249/month for 100,000 lookups ($0.0025 each) for most of a year. A fast-growing product with a large community moves to Business at $499/month for 250,000 lookups or Enterprise at $999/month for 750,000 lookups. Only a product screening genuinely unbounded user-generated content — a marketplace, a social investing feed, a messaging surface — needs Enterprise at $999/month for 750,000 lookups or Enterprise at $999/month for 750,000 lookups (per lookup on the Enterprise plan).
Credits are one per lookup, stay billed monthly and are bought outright by PayPal, so there is no subscription to renegotiate when your volume steps up and no per-seat licence on the API itself. See pricing for the full ladder.
Three implementation details keep that arithmetic true, and all three are cheaper to build in on day one than to retrofit once the bill looks wrong.
Key the cache on the hostname and hold it for the current rebuild cycle. The list changes daily, so re-asking inside the same cycle buys you nothing and spends a credit each time.
Strip the scheme, path, query and port and lowercase the host before the lookup, or you will spend credits distinguishing between the same domain written six different ways.
Follow redirects server-side before checking, because the shortened link a user pastes is rarely the destination that matters — and check the intermediate hops as well as the endpoint.
If you would rather enforce in bulk than call per lookup, the CSV feed on the daily feed page gives you the whole list to load into a resolver, a gateway or your own service, with a per-cycle changelog of what was added and removed.
The failure modes are specific, and a product team should design around them rather than discover them.
It is a known-bad list. A domain registered this morning, used in a two-hour SMS burst and abandoned before lunch may never be observed by anyone. What the list reliably removes is the large majority of traffic that reuses infrastructure — and reuse dominates, because fresh domains cost the attacker money, effort and warm-up time. Design your response on that basis: the list is the floor that clears the bulk, and your rate limiting, device signals and step-up authentication handle what gets through.
A great deal of fintech fraud has no bad domain in it at all, and any product plan that treats link screening as fraud prevention will have a gap exactly where the losses are.
The list answers "is this hostname known-bad", not "is this hostname legitimate", so a clean verdict is the absence of a known problem rather than a positive endorsement. That distinction matters most in the consent and redirect flows described earlier: screening the handoff destination is worth doing, but the stronger control is an allow list of the hosts you have deliberately integrated with, screened on a schedule, with the known-bad check as a second layer underneath.
A flagged, dated observation is the evidence a registrar or hosting abuse desk wants, and it is what turns a report from an assertion into a filing — but the takedown itself is a process with its own timelines that you or a specialist provider still have to run. Treat the detection and the response as separate projects; our brand protection page describes where the boundary between them sits.
Practical answers for the engineer who has to ship this alongside everything else in the sprint.
Server-side, and off the user's critical path wherever you can manage it. Each of the three placements behaves differently.
Never call the API directly from a mobile client or browser. Beyond the key exposure problem, a client-side check is trivially bypassed by the attacker you are worried about, and it puts your credit balance in the hands of whoever decompiles your binary.
Be concrete and unembarrassed. "This link goes to a site that has been reported as impersonating financial services. We have not opened it." is better than a generic security warning, because it tells the user what happened and implicitly teaches them the pattern. Offer a next action — report it, or view your genuine account activity — rather than leaving them at a dead end, and make sure the flow does not require them to leave your app to follow up.
Resist the temptation to let users override the block in a payment or authentication context. In a general browser a click-through makes sense; inside a fintech app the population that overrides a warning is disproportionately the population currently being social-engineered, often with the attacker on the phone telling them to.
Resolve, then check, then check again — three rules cover almost every case.
Be aware that a sophisticated redirect will serve a different destination to your server than to a real user's browser, based on user agent or geography. That is a genuine limitation of any server-side resolution and one reason the check is a layer rather than a guarantee. It still catches the large volume of unsophisticated reuse, which is most of it.
Say precisely what it is and nothing more. It is a technical control that screens hostnames against a third-party list of phishing and malware domains, verified as resolving in DNS and rebuilt every 24 hours, applied at named points in your outbound and inbound flows, producing a per-check record of domain, verdict, timestamp and list version. That description belongs in a control register and can be pointed at in a partner-bank due-diligence questionnaire or a scheme review.
What it is not is a compliance status. It does not satisfy any specific regulation on its own, it is not a certification, and it should never be described as one. The value in a review is that it is a control you can evidence with dated records rather than describe with adjectives — which is a materially better position than most anti-phishing claims a growth-stage fintech can make.
The outbound gate is worth building before launch precisely because it is cheap and because retrofitting a check into a send pipeline that already has six templates and three partner integrations is harder than adding it to one. The credit cost at pre-launch volume is negligible — the Starter package at Growth at $99/month for 25,000 lookups covers a great deal of testing and early traffic, and lookups reset monthly so nothing is wasted while you ramp.
Inbound screening can wait until you have a support queue worth instrumenting. The order that works is outbound gate first, domain inventory sweep second, support intake third, and community post screening when you actually have a community.
It will flag them once they have been observed and verified, which for an actively-running campaign is often quickly, but it is not a discovery tool. The productive pattern is to match your brand strings, common misspellings and product vocabulary against the daily changelog of newly added domains, which gives you a dated observation of a live impersonating host the day it enters the list — enough to file an abuse report and warn users.
For systematic discovery of registrations that have not yet been used in a reported campaign, you want certificate-transparency and newly-registered-domain monitoring, which are entirely different data sources. Treat the changelog match as a cheap, high-signal feed into that programme rather than as the programme itself.
Build the escape hatch before you need it, and give it two properties.
Review the allow list quarterly. These entries accumulate, each was justified at the time, and none of them expire on their own. A partner you stopped working with a year ago should not still be exempt from your checks.
No, and the two do not overlap much. A fraud engine reasons about behaviour: device fingerprints, velocity, unusual counterparties, session anomalies, the shape of a transaction against a user's history. This reasons about one hostname at a time and knows nothing about your users. The interesting integration is feeding one into the other — a flagged URL in a support thread, or a session that resolved a known-bad host shortly before a large outbound transfer, is a strong signal to raise a risk score or trigger step-up authentication.
Think of it as a cheap, high-precision input rather than a decision-maker. It removes a class of traffic entirely and enriches the decisions your fraud engine was already making.
One batch call before dispatch and one lookup at support intake covers both surfaces. Credits are priced per distinct domain, so the cost does not move when your send volume does.
