Email Deliverability as a Fraud Signal: Catch-All and SMTP Checks
Undeliverable and catch-all email addresses quietly predict fraud and chargebacks. Learn how SMTP verification and catch-all detection strengthen signup risk scoring.
Most teams treat email verification as a deliverability problem, will my message land in the inbox? But deliverability is also a powerful fraud signal. An address that can't actually receive mail, or a domain that accepts mail for every possible local part, tells you something important about the person on the other side of the form.
What deliverability actually checks
Deliverability verification resolves the domain's MX records and, where possible, checks whether the specific mailbox exists via SMTP, without sending an email. The result is a simple but valuable boolean: is this address likely to receive mail or not?
- Deliverable: the mailbox exists and accepts mail. Normal.
- Undeliverable: the mailbox bounces. Often a typo, but also a hallmark of fabricated identities.
- Catch-all: the domain accepts mail for *any* address, so existence can't be confirmed.
Why catch-all domains raise risk
A catch_all domain accepts mail for anything@domain.com, which means a fraudster can invent an unlimited number of valid-looking addresses on a domain they control. Catch-all is common on legitimate custom domains too, so it isn't a block on its own, but combined with a young domain age or missing website, it's a strong contributor to a high risk score.
Turning deliverability into a risk decision
Undeliverable addresses at signup deserve scrutiny: a real customer almost always types an address they can actually receive your confirmation at. Pair email_deliverable: false with domain intelligence and you catch fabricated identities that a format-only regex check would happily wave through.
{
"email_features": {
"email_deliverable": false,
"catch_all": true,
"email_history_count": 0
},
"domain_features": { "domain_risk": "high", "domain_age_days": 12 },
"risk": { "level": "high", "signals": ["email_not_deliverable"] }
}RiskUnified's Email Risk API returns email_deliverable, catch_all, and email_history_count alongside domain reputation, so you can weigh deliverability as one input in a broader identity score rather than a blunt yes/no gate.
Frequently asked questions
Does email verification send an email?
No. SMTP-based verification checks whether a mailbox exists at the mail server level without delivering a message, so the user never receives anything.
Is a catch-all domain always fraudulent?
No. Plenty of legitimate businesses run catch-all domains. It raises risk only in combination with other signals like a very young domain age or missing web presence.
Why use deliverability as a fraud signal?
Real customers give addresses they can actually receive mail at. Undeliverable addresses at signup disproportionately belong to fabricated or careless identities, making deliverability a cheap, high-value input to risk scoring.
Try RiskUnified free
Score email, phone and IP risk from one API. 500 free credits every month, no credit card required.