Download a fraud report

Generate and download your Payment Fraud Report as a CSV using the Risk Reports API

The Risk Reports API lets you generate and download your Payment Fraud Report data on demand. The report contains fraud-reported card transactions (Visa TC40 and Mastercard SAFE) for a date range you specify, delivered as a CSV file.

For full request and response schemas and code samples, see the Risk Reports API reference in the Airwallex API documentation.

Generate and download a report

Generating a report is asynchronous: you request the report, wait for it to complete, then download the CSV.

Step 1: Generate a report

Call the Generate a risk report API with a date range and report type. The date range filters on the fraud reported date (when the TC40 or SAFE was received), not the original payment date. The maximum interval is 90 days.

Shell

1curl -X POST 'https://api.sandbox.airwallex.com/api/v1/risk/risk_reports/generate' \
2  -H 'Authorization: Bearer {{ACCESS_TOKEN}}' \
3  -H 'Content-Type: application/json' \
4  -d '{
5    "start_date": "2026-04-01",
6    "end_date": "2026-06-30",
7    "type": "PAYMENT_FRAUD_REPORT"
8  }'

The response returns a report id with status PENDING.

Step 2: Wait for the report to complete

Reports generate asynchronously. You have two options to detect completion:

Webhooks (recommended): Subscribe to the risk.risk_reports.completed and risk.risk_reports.failed events to get notified automatically. See Risk report webhook events and Webhooks overview for setup.
Polling: Call the Retrieve a risk report API with your report id until the status changes to COMPLETED or FAILED.

Step 3: Download the CSV

Once the status is COMPLETED, the response includes a file object with a signed download_url and its expires_at timestamp. Download the CSV from that URL. If the link expires, call the Retrieve a risk report API again to get a fresh one.

Shell

1curl -o fraud_report.csv "DOWNLOAD_URL_FROM_RESPONSE"

What's in the report

Each row represents one fraud-reported card transaction. The CSV contains these columns:

Column	Description
`payment_intent_id`	Airwallex payment intent ID
`payment_attempt_id`	Airwallex payment attempt ID
`merchant_account_id`	Your merchant account ID
`payment_created_date`	Date the original payment was created
`payment_amount`	Payment amount in the original currency
`payment_currency`	Currency code (for example, USD, EUR)
`card_brand`	Card network (visa, mastercard, and so on)
`card_bin`	Card BIN (first 6 to 8 digits)
`card_last_four`	Last four digits of the card number
`issuing_country`	Card issuing country (ISO 2-letter code)
`payment_status`	Current payment status (for example, SUCCEEDED)
`fraud_reported`	Always `true` in this report
`fraud_reported_date`	Date the fraud report was received
`fraud_amount_usd`	Fraud amount in USD
`fraud_type_reason`	Human-readable description (for example, "Fraudulent use of account number")
`fraud_type_code`	Scheme fraud type code
`risk_decision`	Airwallex risk decision: ACCEPT, VERIFY, or BLOCK
`three_ds_triggered`	Whether 3D Secure was triggered
`acquirer_reference_number`	ARN for cross-referencing with disputes

Key things to know

Date range filtering. The start_date and end_date parameters filter on the fraud reported date, not the payment creation date. A payment created in March that was fraud-reported in June appears in a June report, not a March report.
Data scoping. Reports only return data for the authenticated merchant. There is no cross-merchant access.
Download link expiry. The signed download URL is temporary. If it expires before you download, call the Retrieve a risk report API again. A new link is generated on each call.
Rate limits. Standard API rate limits apply. For automated workflows, use webhooks rather than aggressive polling.