Risk Events

The following are events triggered by real-time fraud detection and risk-mitigation activities within the PRP. These are sent to you via the Authorization Events Webhook which is part of the Events API.

Event wrapper

Each event is enclosed in this wrapper:

{
 "detail": {
  "data": {
   "<event_name>": {<event_body>}
   }
  },
  "metadata": {
   "detail_id": "<UUID>",
   "detail_timestamp": "<YYYY-MM-DDThh:mm:ss.ssssss>",
  }
 }
}

Where:

<event_name> — Name of the event, including version number at the end.
<event_body> — Fields in the event, as documented in the tables below.
<UUID> — Unique identifier for the detail contents, meaning the unique ID for the event message.
<YYYY-MM-DDThh:mm:ss.ssssss> — Timestamp for when the event was generated and sent.

👍
Event name change
The name of the prp_sms_suspicious_txn_alert.v1 event is now an FQN, as shown below. The payload of the event has not changed. All clients who are currently receiving the event as prp_sms_suspicious_txn_alert.v1 will continue to receive the event under that name. Newly onboarded clients will get the event with the FQN.

payment-risk-platform-1.0@SmsSuspiciousTxnAlert

A cardholder responded to an SMS fraud alert triggered by the PRP. This event delivers the direct feedback from the cardholder, which you can use to disposition a risky transaction. You must be subscribed to PRP to receive this event. There is currently one supported version for this event.

This event is triggered any time SoFi Tech Solutions receives a valid SMS response from a cardholder regarding a suspicious transaction. Based on the response in the msg_body field, you can call the Program API to take action, such as freezing or unfreezing a card.

Code — n/a
Event trigger — SoFi Tech Solutions receives a valid SMS response from a cardholder regarding a suspicious transaction.
Processes — These processes contain the event trigger:
- Two-Way Messaging Service for PRP

Event body

Field	Type	Description
`prn`	string	SoFi Tech Solutions 12-digit PRN for the account. Example: `"999101003022"`
`cad`	string	System-generated ID for the card. If you are not PCI compliant, you can use the CAD instead of the PAN in many contexts. Example: `"72450868"`
`mobile_phone`	string	The phone number of the cardholder who received the SMS alert. Example: `"1256127234"`
`risk_event_type`	string	The name of this event: `prp_sms_suspicious_txn_alert`
`auth_uid`	string	Unique internal identifier for the original authorization. Use this ID to map the cardholder's SMS response directly to the specific fraud alert that was sent. This value is not the same as the `auth_id`. Example: `"DHWJtI8zRjuDcgF8hru3oQ"`
`auth_ts`	string	Timestamp of when the original authorization was created, in our system time. Format: `YYYYMMDD:hhmmssMST`
`auth_id`	number	System-generated ID for the authorization. Use this ID plus a secondary value to track the transaction throughout the system. See Authorization identifiers in the Transaction IDs guide for more information. Example: `141234123`
`merchant_description`	string	The description of the merchant where the suspicious transaction occurred. Derived from DE043. Example: `"123 WIDGETS MERCHANT BEVERLY HILLS CA"`
`merchant_city`	string	City where the merchant is located. Example: `"Salt Lake City"`
`merchant_state`	string	Two-letter state or provincial designator for the merchant's location. Example: `"UT"`
`merchant_country`	string	ISO 3166-1 country code for the country where the merchant is located. 3 digits. Example: `"840"`
`merchant_postal_code`	string	The postal code of the merchant's location, such as a U.S. ZIP code or a Canadian postal code. The format of this field varies by card network and merchant country. For example, values can be 5-digit (91356), 9-digit (118031598), or alphanumeric (M5T 2S8). A value of all zeros may indicate that no postal code was provided in the authorization request. Example: `"91356"`
`amount`	number	The amount of the suspicious transaction. Example: `75.00`
`sender_phone`	string	The SMS 10-digit long code (10 DLC) that sent the SMS alert. Example: `"(512) 555-0123"`
`msg_body`	string	The cardholder response to the SMS message in raw text. Max: 160 characters. Example: `"Yes"`
`customer_opt_out`	boolean	Indicates whether the cardholder opted out of future SMS alerts by responding with `STOP`. Default: `false`

Example payload

{
  "detail": {
    "data": {
      "payment-risk-platform-1.0@SmsSuspiciousTxnAlert": {
        "prn": "999101003022",
        "cad": "72450868",
        "mobile_phone": "1256127234",
        "risk_event_type": "prp_sms_suspicious_txn_alert",
        "auth_uid": "DHWJtI8zRjuDcgF8hru3oQ",
        "auth_ts": "20250315:121504MST",
        "auth_id": 141234123,
        "merchant_description": "123 WIDGETS MERCHANT BEVERLY HILLS CA",
        "merchant_city": "Salt Lake City",
        "merchant_state": "UT",
        "merchant_country": "840",
        "merchant_postal_code": "91356",
        "amount": 75.00,
        "sender_phone": "(512) 555-0123",
        "msg_body": "Yes",
        "customer_opt_out": false
      }
    },
    "metadata": {
      "detail_id": "550e8400-e29b-41d4-a716-446655440000",
      "detail_timestamp": "2026-11-05T14:30:00.324444"
    }
  }
}