Fraud teams use it at signup to decide whether to approve, step up verification, or review, rather than to decline outright.
Every digital lender, BNPL app, and marketplace asks for an email address at signup. Most treat it as a contact field. Fraud teams increasingly treat it as evidence, and an email risk score turns that evidence into a decision: an address created ten minutes ago on a throwaway domain says something different from a five-year-old mailbox on a company domain.
This guide explains what goes into an email risk score, how each signal works technically, which ones are reliable, and how to turn them into proportionate decisions that block abuse without turning away genuine customers.
Why Email Is a Useful First Signal
Fraud in Indian lending is concentrated where money leaves the institution. RBI’s Annual Report for 2025-26 recorded 10,114 fraud cases involving Rs 48,021 crore, with advances-related frauds accounting for 8,640 cases and Rs 40,774 crore. Many lending frauds begin at onboarding, with identities that look complete on paper.
Email is one of the cheapest identity attributes to fabricate. A fraudster can create hundreds of addresses in an afternoon. That is precisely why it is informative: genuine customers rarely use throwaway addresses for a loan application, while organised abuse often does.
It is also the first data point captured, often before PAN, Aadhaar or bank details. A signal available at the first screen lets teams adjust friction before any expensive check runs. Email signals work best alongside device data, because each is easy to fake alone and harder to fake consistently together.
The Signals Behind an Email Risk Score
An email risk score is only as good as its inputs. The signals fall into three groups: deliverability, domain characteristics, and behaviour.
Deliverability signals
Syntax. The address must conform to the format rules in RFC 5322. Invalid syntax usually indicates a typo, but repeated malformed submissions from one device suggest scripted testing.
Domain and MX records. A valid domain needs DNS records showing where its mail goes. A missing MX record, or a “null MX” as defined in RFC 7505, means the domain does not accept mail at all.
Mailbox existence. A verifier can open an SMTP conversation, defined in RFC 5321, with the receiving server and ask whether a mailbox would accept mail, without sending a message. Many large providers deliberately give ambiguous answers, so this check returns “unknown” more often than teams expect.
Catch-all domains. Some domains accept mail for any address. The mailbox check then cannot distinguish a real user from an invented one, so catch-all status lowers confidence rather than proving fraud.
Domain characteristics
Disposable and temporary domains. Services that issue short-lived inboxes are the strongest single signal of low-commitment signups. Lists of such domains change constantly, so a static blocklist decays quickly and weakens any email risk score built on it.
Role accounts. RFC 2142 standardises role mailboxes such as postmaster and abuse, and businesses add others like info@ or sales@. A role address on a personal loan application is unusual, because no single individual owns it.
Free versus corporate domains. A free webmail address is normal for retail customers. On a B2B form or a business loan application, a free domain where a company domain is expected merits a closer look.
Domain age. A domain registered days before the application, especially one that resembles a known brand, is a classic sign of impersonation or bulk account creation.
Behavioural signals
Name-email consistency. “priya.menon84@” on an application from Priya Menon is coherent. A random string, or a name belonging to someone else, is not proof of fraud, but it adds weight to other signals.
Velocity and reuse. The same address, or near-identical variants such as added dots or plus-tags, appearing across many applications, devices, or PANs is a strong indicator of fraud or promo abuse.
Breach exposure. Some providers note whether an address appears in known data breach compilations. Interpret this carefully: exposure is common among genuine, long-standing users and can indicate an established address. It is more useful as a flag for account takeover risk than as a signup decline reason.
How Fraud Teams Use an Email Risk Score
The most common mistake is wiring an email risk score directly to auto-decline. Signals are probabilistic, and many genuine customers have unusual emails. A tiered response works better.
| Signal | Risk indicated | Suggested action |
|---|---|---|
| Invalid syntax or no MX | Typo or fabricated address | Prompt correction inline |
| Disposable domain | Low-commitment or abusive signup | Ask for a permanent address; block for credit products |
| Mailbox does not exist | Fabricated address | Request a different email before proceeding |
| Catch-all or unknown | Unverifiable mailbox | Send an OTP or verification link |
| Role account on retail product | No individual owner | Ask for a personal address |
| Very new domain | Possible impersonation or bulk creation | Step up to stronger identity checks |
| Reuse across many applications | Synthetic identity or promo abuse | Route to manual review; link related accounts |
A practical decision flow looks like this:
- Validate syntax and domain at the input field, so honest typos are fixed before submission.
- Check mailbox, disposable, and catch-all status in the background as the user continues.
- Combine the email result with phone, device, and identity signals into a single risk tier.
- Apply friction by tier: approve, send an email OTP, require additional verification, or review.
- Feed confirmed fraud outcomes back to tune thresholds every month.
Where BeFiSc fits: BounceProof validates syntax and domains, checks SMTP and MX records, flags disposable inboxes and catch-all domains, and categorises each address as Safe, Risky, Reject, or Unknown. Those categories drop directly into the tiered flow above. Start with 100 free email checks on your own signup data.
What can an email risk score not do?
It cannot confirm identity. A clean, long-standing Gmail address can belong to a fraudster using a stolen identity. An email risk score screens out cheap abuse and prioritises reviews; identity verification still does the heavy lifting.
Use Cases by Business Type
Digital lending signup. A personal loan app sees a burst of applications using addresses from rotating disposable domains, all from a handful of devices. Blocking disposable domains for credit products and routing reused addresses to review removes much of the noise before bureau pulls are paid for. See our overview for related patterns.
BNPL checkout. Merchants want minimal friction. Here, invalid and disposable addresses trigger an OTP rather than a decline, keeping conversion high for genuine buyers.
B2B lead forms. A free domain on a “work email” field, or a role address, lowers lead quality scores. Sales teams spend time on real prospects, and marketing lists stay deliverable.
Promo and referral abuse. Cashback and referral programmes attract users creating many accounts. Reuse detection, including dot and plus-tag variants, links them back to one person.
Email Signals and the DPDP Framework
An email address is personal data under the Digital Personal Data Protection Act, 2023. The DPDP Rules, 2025, notified on 14 November 2025 with an 18-month phased compliance timeline, emphasise purpose limitation, data minimisation and clear, standalone consent notices.
For email risk scoring, that translates into four practices:
- State fraud prevention as a purpose in your notice when you collect the email.
- Send only the email address to a verification provider, not the full application.
- Retain the risk result, not the raw provider response, for as long as your fraud and audit purposes require.
- Contract with providers as data processors, with clear limits on reuse of your data.
Our guide covers notice design and processor contracts in more detail.
Key Takeaways
- An email risk score combines deliverability, domain and behavioural signals into a single view of how trustworthy a signup email is.
- Disposable domains, non-existent mailboxes and heavy reuse across applications are the strongest individual signals.
- Catch-all domains, breach exposure and free webmail are context, not reasons to decline.
- Tiered friction (OTP, step-up, review) outperforms auto-decline for both fraud loss and conversion.
- Email signals screen out cheap abuse; they do not replace identity verification.
- Under the DPDP Rules, 2025, collect for a stated purpose, share the minimum, and limit retention.
Frequently Asked Questions
Is email risk scoring allowed under India’s DPDP Act?
Processing personal data for fraud prevention is possible when it is covered by your notice and consent framework and limited to what is necessary. Confirm the specific legal basis for your use case with counsel.
Why do some email checks return “unknown”?
Many mail servers, especially large providers and catch-all domains, do not confirm whether a specific mailbox exists. In those cases, an OTP or verification link is the most reliable next step.
What is the difference between email validation and an email risk score?
Email validation checks whether an address is real and deliverable. A risk score goes further, weighing domain characteristics and behaviour to estimate fraud likelihood. Validation results are usually the foundation of the score.
Should I block all disposable email addresses?
For credit and other regulated products, blocking or requiring a permanent address is reasonable. For low-risk products such as newsletters, a softer response like a verification link may protect conversion.
What is an email risk score?
It is a rating of how likely an email address is fake, disposable, or associated with abuse. It is built from signals such as syntax, domain validity, mailbox existence, disposable status, and reuse across accounts.
Conclusion
The email field is the first piece of evidence a customer gives you, and it costs almost nothing to examine. Treated as a contact detail, it adds nothing to risk control. Treated as a signal, it filters out the cheapest forms of abuse before expensive checks run.
The value lies in proportion. An email risk score should decide how much friction a user sees, not whether they are a fraudster. Teams that build it into a tiered flow, alongside phone, device, and identity checks, see cleaner funnels and fewer losses.
