Email Change Event

The email_change event type is used when a user changes the email address on their account. Attackers who take over an account often change the email first to lock the real owner out and intercept future password resets — this is the single highest-value account-change signal.

Category: Non-monetary Relevant feedback outcomes: success, fail, fraud, rejected

note

Dispute, chargeback, and refund outcomes do not apply to email change events.

Request Example

POST /api/v1/generic/validate HTTP/1.1
Host: api.sa.mubeen.ai
X-API-Key: ***
Content-Type: application/json

{
  "event_type": "email_change",
  "timestamp": "2025-03-15T18:45:00Z",
  "attempt_id": "att_emailchg_5521",
  "external_id": "change_998877",
  "device_id": "fp_acctchg_mno34567",
  "user_id": "usr_890123",
  "user_email": "[email protected]",
  "new_user_email": "[email protected]",
  "full_name": "Layla Mahmoud",
  "phone_number": "+966****2345",
  "ip_address": "178.22.91.55",
  "ip_country": "SA",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0",
  "channel": "web",
  "platform": "web",
  "account_created_at": "2022-08-01T00:00:00Z"
}

Response Example

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234567",
  "decision": "challenge",
  "risk_score": 40,
  "risk_level": "medium"
}

Feedback Examples

Successful Email Change

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234567",
  "outcome": "success",
  "external_id": "change_998877"
}

Fraudulent Email Change (Account Takeover)

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234567",
  "outcome": "fraud",
  "outcome_details": {
    "fraud_type": "account_takeover",
    "detection_method": "user_reported"
  },
  "external_id": "change_998877"
}

Rejected Email Change

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234567",
  "outcome": "rejected",
  "outcome_details": {
    "rejection_reason": "suspicious_device",
    "rule_triggered": "new_device_sensitive_change"
  },
  "external_id": "change_998877"
}

Key Fields for Email Change Events

Field	Importance	Notes
user_id	Required	Identifies the account being modified
new_user_email	Recommended	The email address being switched to
device_id	Recommended	Changes from a new device are higher risk
ip_address	Recommended	Changes from an unusual IP indicate potential compromise