SAFPS Fraud Screening

Overview

The South African Fraud Prevention Service (SAFPS) is a shared database used by financial institutions and businesses to flag and look up fraud incidents. didx:verify returns any SAFPS listings found against a South African ID number, contact number, email address, or bank account. Two endpoints are available. Both take the same request and return the same response:

Detailed Object Search (/Citizen/SAFPSDetailedObjectSearch): use this endpoint.
Detailed Search (/Citizen/SAFPSDetailedSearch): deprecated and due to be removed.

Listing Types

Identifier Format	Type	Description
`PR00000000`	Protective Registration	The individual has voluntarily registered with SAFPS for protection. Requires their PR number to proceed with onboarding.
`VICTIM00000000`	Victim	The individual has been a victim of fraud (e.g. impersonation)
`SH00000000`	SAFPS Hit	The individual has been flagged for conducting fraudulent activity

SAFPS Detailed Object Search

POST /Citizen/SAFPSDetailedObjectSearch

curl -X POST "https://citizen.uat.securecitizen.cloud/Citizen/SAFPSDetailedObjectSearch" \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "ConsentReceived": true,
    "idNumber": "8001014800080",
    "contactNumber": "27821234567",
    "emailAddress": "john.doe@example.com",
    "bankAccountNumber": "045687123",
    "requestedBy": "Example Bank",
    "CRef": "REF00001"
  }'

Request Fields

Field	Type	Required	Description
`ConsentReceived`	boolean	Yes	Must be `true`
`idNumber`	string	Yes	Subject’s 13-digit South African ID number
`contactNumber`	string	No	Subject’s contact number in international format (`27xxxxxxxxx`)
`emailAddress`	string	No	Subject’s email address
`bankAccountNumber`	string	No	Subject’s bank account number
`requestedBy`	string	No	Name of the company calling the API
`CRef`	string	No	Your transaction reference

SAFPS cross-references listings. Lookups by contact number, email address, or bank account can return listings that are unrelated to your subject. Check each result against your subject before you act on it.

Response

{
  "results": [
    {
      "subjectName": "John",
      "subjectSurname": "Doe",
      "subjectDateOfBirth": "1980-01-01",
      "subjectGender": "M",
      "subjectTitle": "Mr",
      "incidents": [
        {
          "incidentReference": "SH00000001",
          "incidentCategory": {
            "categoryNumber": "string",
            "categoryName": "Impersonation",
            "subCategoryNumber": "string",
            "subCategoryName": "string",
            "additionalDetails": null
          },
          "incidentDate": "2024-01-01",
          "incidentLogDate": "2024-01-02",
          "member": "string",
          "memberReference": "string",
          "reportedBy": "string",
          "details": "string",
          "idDocuments": [],
          "contactNumbers": [],
          "addresses": [],
          "emailAddresses": [],
          "bankAccounts": [],
          "employers": [],
          "policeCases": [],
          "devices": [],
          "onlineDetails": [],
          "cryptoDetails": []
        }
      ]
    }
  ],
  "trackingNumber": "00000000-0000-0000-0000-000000000000",
  "CRef": "REF00001",
  "Status": "Success",
  "Message": "string"
}

Response Fields

Field	Description
`results`	SAFPS results. Can contain several unrelated entries because of cross-referencing
`results[].subjectName` / `subjectSurname`	Name and surname of the listed subject
`results[].subjectDateOfBirth`	Date of birth of the listed subject
`results[].incidents`	Incidents recorded against the subject
`incidents[].incidentReference`	Reference of the incident
`incidents[].incidentCategory`	Category and subcategory of the incident, with numbers and names
`incidents[].incidentDate`	Date the incident happened
`incidents[].incidentLogDate`	Date the incident was logged
`trackingNumber`	Unique tracking number (GUID) for the transaction, used for audit, billing, and support

Each incident can also carry idDocuments, contactNumbers, addresses, emailAddresses, bankAccounts, employers, policeCases, devices, onlineDetails, and cryptoDetails. See the API reference for the fields in each list.

SAFPS Detailed Search (deprecated)

POST /Citizen/SAFPSDetailedSearch

This endpoint is deprecated and will be removed. Use SAFPS Detailed Object Search instead.

The request and response are the same as for SAFPS Detailed Object Search.

Handling Protective Registrations

When a PR (Protective Registration) listing is returned, the individual has proactively registered with SAFPS to protect their identity. You must request their PR reference number and validate it before proceeding with their application.

{
  "incidents": [
    {
      "incidentReference": "PR00088118",
      "incidentCategory": {
        "categoryName": ""
      }
    }
  ]
}

Ask the customer to provide their PR number and verify it matches PR00088118 before continuing. TBC: engineering confirming that incidentReference carries the listing identifier.

Identity Verification

Biometrics

Compliance & Screening

Financial Verification

Enterprise

Overview

Listing Types

SAFPS Detailed Object Search

Request Fields

Response

Response Fields

SAFPS Detailed Search (deprecated)

Handling Protective Registrations

​Overview

​Listing Types

​SAFPS Detailed Object Search

​Request Fields

​Response

​Response Fields

​SAFPS Detailed Search (deprecated)

​Handling Protective Registrations

Overview

Listing Types

SAFPS Detailed Object Search

Request Fields

Response

Response Fields

SAFPS Detailed Search (deprecated)

Handling Protective Registrations