Fraud lookup desk for any email, phone, IP address or link

Build me a lookup desk that my support and trust team keeps open all day. It is not a queue and it is not a ticket board. Nobody is handed a worklist. Someone is on a chat or an email, they have an identifier in front of them, they paste it in, and they get one clean risk profile back instead of everyone poking at the IPQualityScore dashboard separately.

The home screen is a single search box that accepts any of four things: an email address, a phone number, an IP address, or a link. Work out which type was pasted and run only the IPQualityScore checks that fit it. For an email, run Email Validation and Dark Web Leak Lookup. For a phone number, run Phone Number Validation. For an IP address, run IP Reputation & Proxy/VPN Detection. For a link, run Malicious URL Scanner. Never run a check that does not apply to what was pasted, because every check costs credits. If the input is ambiguous, ask the user to confirm the type before spending anything.

The result page is one risk profile, not a dump of raw API responses. Show a single headline risk band using three levels off the IPQualityScore fraud and risk scores: below 75 is clear, 75 to 89 is suspicious, and 90 and above is high risk. Under the headline, spell out the specific reasons in plain language, one section per check that ran: this is a disposable or throwaway email domain, this address appeared in a known breach dump, this is a VOIP or prepaid line rather than a real mobile, this IP is a VPN or Tor exit node with recent abuse against it, this link is flagged for phishing or malware. A support agent should be able to read the page out loud to a colleague without translating anything.

Alongside the risk profile, answer the question support always asks first: is this an existing customer or a stranger? Take the pasted email or phone number and look it up with the Shopify Search Customers operation, and if there is a match, pull that customer's history with Get Customer Orders. Show whether they are a real customer, how many orders they have placed, what those orders were worth, and whether any were cancelled or refunded. If there is no match, say so plainly rather than leaving the section empty. Shopify is read only throughout this app: the desk never creates, edits or cancels anything in the store.

Before running anything, check whether we have seen this identifier before. If there is a saved case, show a banner at the top of the result page saying so, with how many times it has come up, the verdict we reached last time, who reached it, when, and the notes they left. This is the whole reason the desk exists. The vendor dashboard cannot tell us that the same email was looked at three weeks ago and marked block, and that is exactly what the team needs to know.

Every lookup becomes a saved case in the General Input Database. Store the identifier, its type, the scores and individual signals at the time of the lookup, the verdict, the free text notes, the person who saved it, and the timestamp. The verdict is one of three values that the user picks: clean, watch or block. Notes are free text and always optional, so nobody is blocked from recording a decision because they did not have time to write a paragraph. Keep the scores as they were at the time rather than overwriting them, so the history shows what we knew when we made the call.

Because every check consumes account credits, tracked per product, two things need to be true. First, show the remaining balance on the page using the Credit Usage (Account) operation, so the team can see what they are spending. Second, when someone looks up an identifier that already has a recent saved result, reuse the saved scores instead of paying for the same lookup twice, and label the result clearly as reused along with when it was originally run. Give the user an explicit control to run the checks fresh when they actually want new data, for example when the saved result is weeks old or the situation has changed.

Add a Full investigation button on the result page that kicks off a background agent. The agent fans out across every IPQualityScore check that is relevant to that identifier rather than the minimum set, pulls any matching Shopify customer and their orders, weighs the risk signals against that order history, and writes a plain English verdict of a few sentences plus a recommendation of clean, watch or block. Write the verdict, the recommendation and the run status back into the case record in the General Input Database so the app can display it. Show the run as in progress while it works and render the verdict when it lands. The agent only writes its opinion into the case: a human still picks the verdict that gets saved, and the agent never changes anything in Shopify.

Add a case history view that searches the whole archive by identifier or by verdict, so I can pull up every identifier we ever marked block, or type in a specific email and see its full timeline. Show the identifier, type, latest verdict, who set it, when, and the note. Partial matching on the identifier is fine and useful, since people often remember part of an address.

Two technical details to respect. The Malicious URL Scanner requires the target URL to be URL encoded before it is placed in the path segment, so encode it properly rather than passing the raw link. And the Dark Web Leak Lookup accepts an email or a username: this app must only ever look up emails and usernames, and must never ask anyone to paste a password or offer a password field anywhere in the interface.