BDF Codes

The Sharing endpoints use standardised EPC / BDF codes for fraud context and qualifications. This page is the lookup table for every code you'll send or receive across Verify, Reporting, the IBAN lists, and Alerts.

Fraud categories

Sent as fraudCategory when creating a report; returned on alerts.

Code	Label	Meaning
`FC_IDTHIE`	ID theft	The fraudster uses a stolen identity to open an account, request a loan, etc.
`FC_IDFALS`	Forged ID	The fraudster uses a false identity (synthetic or falsified) to open an account, request a loan, etc.
`FC_ATO`	Account takeover	The fraudster uses the victim's web-banking credentials to input payment orders, set up a direct debit, or purchase goods/services with their card.
`FC_TECFRD`	Technician fraud	The fraudster poses as a technician to have the victim carry out fraudulent operations or install remote-access software.
`FC_CEOFRD`	CEO fraud	The fraudster impersonates a senior officer of the victim's company and asks, under false pretences, for fraudulent transfers.
`FC_BRAFRD`	Fake bank advisor fraud	The fraudster impersonates the bank adviser or fraud department and asks the victim to make transfers or validate card payments.
`FC_COUFRD`	Fake courier fraud	The fraudster impersonates the bank and tells the victim a courier will collect their compromised card.
`FC_ACCMOD`	Account modification	The fraudster has the victim replace a legitimate creditor account with a fraudulent one.
`FC_ORDFRD`	Fraudulent payment ordered	The fraudster impersonates a customer and has a bank employee replace a creditor account or order a new transfer.
`FC_CUSFRD`	Customer fraud	The fraud is perpetrated by the client themselves (false declaration).
`FC_OTHFRD`	Other fraud	Any other fraud category.

Fraud sources

Optional fraudSource on reports and context updates; returned on alerts.

Code	Label	Meaning
`FS_PHISH`	Phishing	The victim was lured (email/SMS/QR/messaging app) into entering credentials or validation codes on a fraudulent site.
`FS_MALWAR`	Malware	The victim's device was compromised via a malicious attachment or counterfeit software, allowing interception or remote control.
`FS_BNKSPO`	Bank spoofing	The fraudster impersonates the bank using a spoofed phone number, email, or logo.
`FS_OTHSPO`	Other spoofing	The fraudster poses as a technician, operator, relative, etc. to have operations validated.
`FS_CUSSPO`	Client ID spoofing	The fraudster impersonates the customer and asks the bank to carry out fraudulent operations.
`FS_SIMSWA`	SIM swap	The fraudster takes over the victim's phone line to enrol a device and usurp the account.
`FS_CONABU`	Confidence abuse	The victim is deceived into making transfers (fake investment, fake donation, romance scam, etc.).
`FS_DATALK`	Data leak	The fraudster uses information leaked from a merchant, business, or bank.
`FS_STOLEN`	Stolen or lost	The fraudster obtained the victim's assets by theft or recovery from loss.
`FS_EXTOR`	Extortion	The fraudster obtained assets through pressure, blackmail, or violence.
`FS_FORGED`	Forged document	The fraudster provided forged documents to the PSP.
`FS_UNKNWN`	Unknown	Source not identified.

Transaction types

Sent as transactionType when creating a report; returned on alerts.

Code	Label
`TT_SCT`	SEPA credit transfer
`TT_IP`	Instant payment
`TT_INTCT`	International credit transfer
`TT_SDD`	SEPA direct debit
`TT_INTSDD`	International direct debit
`TT_ACCOPN`	Account opening
`TT_PAYADD`	Payee addition

Transaction channels

Optional transactionChannel on reports and context updates; returned on alerts.

Code	Label
`TC_BRANCH`	Branch
`TC_WEBBNK`	Web-banking
`TC_MOBAPP`	Mobile app
`TC_PISP`	Payment initiation service provider
`TC_ATM`	ATM
`TC_WEBEC`	E-commerce
`TC_WALLET`	P2P wallet
`TC_WEROPP`	P2P Wero wallet
`TC_WEROEC`	E-commerce Wero wallet
`TC_BULK`	Remotely transmitted bulk

Account-holder qualifications

Sent on holder-qualification, and used as the auto-applied qualification on the Whitelist and Blacklist. These are the account holder's verdict on the suspicious account.

Code	Label	Meaning	Usable on
`FRAUD`	Fraud	The PSP confirms the account is used for malicious purposes.	Holder qualification, Blacklist
`FRADID`	ID theft	The PSP confirms the account is malicious and was opened using a stolen ID.	Holder qualification, Blacklist
`GENUIN`	Legitimate account	The PSP confirms the account is legitimate.	Holder qualification, Whitelist
`REGUL`	Regularized account	The PSP warned the client and obtained their commitment to comply.	Holder qualification, Whitelist
`MERCHT`	Merchant	The PSP states the customer is a merchant.	Holder qualification, Whitelist
`CLOSED`	Closed account	The PSP confirms the account is closed.	Holder qualification, Whitelist
`MISATT`	Misattributed holder	The PSP is not the account holder.	Holder qualification
`NOTFND`	Not found	The PSP cannot find the account in its books.	Holder qualification
`UNDINV`	Under investigation	The account is under investigation; no decision yet.	Holder qualification
`UNKNWN`	Don't know	The PSP cannot decide based on the information available.	Holder qualification

Participant observations

Sent as type on participant-qualification.

Code	Label	Meaning
`SIGHTING`	Observation	You agree with / confirm the reported fraud (you have also seen this account involved).
`FALSE_POSITIVE`	False positive	You disagree — you do not confirm the reported fraud.

Deletion reasons

Sent as reason when deleting a report.

Code	Label	Meaning
`EVENT_TO_DELETE_1`	Wrongly declared	The report was wrongly declared; the fraud suspicion is not confirmed.
`EVENT_TO_DELETE_2`	Incorrect data	Incorrect and/or missing data on the suspicious account.

Alert qualifications

The aggregate verdict on an alert, computed from all of its reports' holder qualifications. Returned on Verify and Alerts responses; not something you send.

Code	Meaning
`CONFIRMED`	At least one holder qualification confirms fraud (`FRAUD` or `FRADID`).
`REJECTED`	The account holder cleared the account (e.g. `GENUIN`, `MERCHT`, `CLOSED`, `REGUL`, `MISATT`, `NOTFND`).
`PENDING`	Reported, but not yet qualified by the account holder.
`UNDER_INVESTIGATION`	The account holder is investigating.

📘
Source of truth
These codes follow the EPC / BDF fraud-sharing standard. The exact set accepted by each endpoint is enforced in the API reference schema.