How scoring works - FIL Scoring API

The score is a ranking

score is a percentile against the scored population of numbering ranges. 78 means riskier than 78% of scored ranges. It is not a probability that this call is fraud, and the non-suppressible disclosure field says so in every response.

Bands and actions

Band	Recommended action	What it takes
critical	`block`	A confirmed consortium report — this exact number or its reported range. Nothing else can produce `block`.
critical	`challenge`	An impossible caller-ID plus independent corroboration.
high	`step_up_auth`	One hard signal alone (impossible caller-ID, close proximity to reported numbers).
medium	`investigate`	Two independent circumstantial signals.
low	`watch`	One circumstantial signal.
minimal	`allow`	Nothing adverse found.

Two rules are fixed outside the scoring model and cannot be overridden by any configuration: only confirmed consortium reports reach block, and proximity to reported numbers is capped — it never blocks and never counts as corroboration.

The evidence

Each response lists its evidence as components, each with a verdict (clean, neutral, no_match, elevated, adverse, unavailable) and its contribution to the ranking. Which components are evaluated depends on your tier — lower tiers don’t hide results, the component is never computed at all.

Component	Question it answers
`reputation_ledger`	Has the consortium reported this number, its range, or a nearby block?
`ndc_range_risk`	How much fraud has accumulated against this numbering range?
`caller_id_integrity`	Can this caller-ID even exist — is the range allocated?
`premium_tariff`	Is this a premium-rate range?
`ip_reputation`	Has the consortium reported this exact IP?
`corroboration`	Do independent signals agree? (Derived; correlated signals count once.)

Identity resolution (validity, operator, line type) appears as the subject block rather than a component row. The same names appear in /v1/health — if a capability is degraded, responses that relied on it say so in degraded_sources, and scoring continues on the remaining evidence. HTTP 200, never an outage.

Coverage

coverage (strong / partial / thin) reports how much consortium reporting stands behind the destination country. It contextualises the score and never modifies it. The rule worth wiring into your workflow: a low score with thin coverage means unwatched, not clean.