The Email Risk Score evaluates whether an email address behaves consistently with legitimate ownership and stable usage by analyzing lifecycle, behavioral, and ecosystem signals across the network rather than just verifying existence. Key categories include:

Email Lifecycle: When the email was first seen and how its activity has evolved (new emails may signal synthetic identities; reactivated old ones may be compromised)

Domain Context: How the email compares to others on the same domain, flagging high-risk domains or behavioral outliers

Identity Consistency: Stability of associations with phone numbers and geography, where rotation suggests synthetic or recycled identities

Behavioral Activity: Usage frequency and infrastructure diversity, which can reveal automated or coordinated fraud

Email Structure Signals: Patterns in the address itself (random prefixes, excessive numbers) that suggest programmatic generation

The model is designed to evolve over time as new fraud patterns emerge.