> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fraudintelligencelimited.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How scoring works

> What the score is, where the evidence comes from, and what we deliberately don't claim.

## The score is a ranking

`score` is a percentile against the scored population of numbering ranges. 78 means riskier than 78% of scored ranges. It is not a probability that this call is fraud, and the non-suppressible `disclosure` field says so in every response.

## Bands and actions

| Band     | Recommended action | What it takes                                                                                              |
| -------- | ------------------ | ---------------------------------------------------------------------------------------------------------- |
| critical | `block`            | A confirmed consortium report — this exact number or its reported range. Nothing else can produce `block`. |
| critical | `challenge`        | An impossible caller-ID plus independent corroboration.                                                    |
| high     | `step_up_auth`     | One hard signal alone (impossible caller-ID, close proximity to reported numbers).                         |
| medium   | `investigate`      | Two independent circumstantial signals.                                                                    |
| low      | `watch`            | One circumstantial signal.                                                                                 |
| minimal  | `allow`            | Nothing adverse found.                                                                                     |

Two rules are fixed outside the scoring model and cannot be overridden by any configuration: only confirmed consortium reports reach `block`, and proximity to reported numbers is capped — it never blocks and never counts as corroboration.

## The evidence

Each response lists its evidence as `components`, each with a verdict (`clean`, `neutral`, `no_match`, `elevated`, `adverse`, `unavailable`) and its contribution to the ranking. Which components are evaluated depends on your tier — lower tiers don't hide results, the component is never computed at all.

| Component             | Question it answers                                                     |
| --------------------- | ----------------------------------------------------------------------- |
| `reputation_ledger`   | Has the consortium reported this number, its range, or a nearby block?  |
| `ndc_range_risk`      | How much fraud has accumulated against this numbering range?            |
| `caller_id_integrity` | Can this caller-ID even exist — is the range allocated?                 |
| `premium_tariff`      | Is this a premium-rate range?                                           |
| `ip_reputation`       | Has the consortium reported this exact IP?                              |
| `corroboration`       | Do independent signals agree? (Derived; correlated signals count once.) |

Identity resolution (validity, operator, line type) appears as the `subject` block rather than a component row.

The same names appear in `/v1/health` — if a capability is degraded, responses that relied on it say so in `degraded_sources`, and scoring continues on the remaining evidence. HTTP 200, never an outage.

## Coverage

`coverage` (`strong` / `partial` / `thin`) reports how much consortium reporting stands behind the destination country. It contextualises the score and never modifies it. The rule worth wiring into your workflow: **a low score with thin coverage means unwatched, not clean.**