--- title: "Bulk Compromised Bank Checks alert lookup" method: POST path: "/compromised_bank_checks" tags: ["Payment Card Fraud"] --- # Bulk Compromised Bank Checks alert lookup `POST /compromised_bank_checks` Retrieve detailed information about multiple compromised bank check notifications with data grouped into UI-ready panels. ## Request body - object - `playbook_alert_ids` string[], required — The unique ids of the triggered Playbook Alerts. Maximum number of ids in a single request is 250. - `panels` string[] — Request inclusion of detailed Case data, grouped into a set of panels. If left unset, all panels will be returned. ## Response `200` Data for the requested panels. - object - `status` PlaybookAlertStatusResponse - `status_code` 'Ok' | 'Error' — Status describing the result of the request. - `status_message` string — Text describing the status, suitable for displaying an error. - `data` CompromisedBankChecksResponse[] - `playbook_alert_id` string, required - `panel_status` CompromisedBankChecksStatusPanel — Data structure containing general information about the alert and it's associated entity. - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required — The status of the Playbook Alert. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `reopen` 'Never' | 'SignificantUpdates' — Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates - `assignee_name` string — Full name of the assignee - `assignee_id` string — ID of the assignee - `created` string, date-time, required — The Creation time of the Playbook Alert - `updated` string, date-time, required — The Update time of the Playbook Alert - `case_rule_id` string, required — The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field) - `case_rule_label` 'Domain Abuse' | 'Malicious Sites' | 'Cyber Vulnerability' | 'Data Leakage on Code Repository' | 'Compromised Bank Check' | 'Geopolitics Facility' | 'Novel Identity Exposure' | 'Third Party Risk' | 'Malware Report' — The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user. (Deprecated, use 'alertRule.label' field) - `alert_rule` PlaybookAlertAlertRule, required - `id` string, required — The Rule ID that created the Playbook Alert (without the 'report:' prefix) - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'Undefined', required — The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing. - `name` string — The Rule name (if defined) that created the Playbook Alert - `creator_name` string — Full name of the Creator of the Playbook Alert - `creator_id` string — Id of the Creator of the Playbook Alert - `owner_id` string — Id of the owner - `owner_name` string — Name of the owner - `organisation_id` string — Id of the Organisation - `organisation_name` string — Name of the Organisation - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails - `organisations` PlaybookAlertOrganisation[] - `organisation_id` string — Id of the Organisation - `organisation_name` string — Name of the Organisation - `enterprise_id` string — Id of the Enterprise - `enterprise_name` string — Name of the Enterprise - `actions_taken` OnwardActionId[], required - `panel_evidence_summary` CompromisedBankChecksSummaryPanel - `assessments` object[], required — A list of assessments. - `name` 'FIRST APPEARANCE' | 'UNDETERMINED UNIQUENESS' | 'SEEN BEFORE', required - `criticality` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `check_id` string, required — A unique identifier that is generated for each check record. - `collected_date` string — Datetime when the bank check image was collected, parsed, and added to Bank Check Data. - `posted_date` string — Datetime when the check image was posted on the source. - `last_seen_date` string — Datetime when the check image was last seen on a web. - `multiple_checks` boolean — A boolean value that indicates whether the source image contained multiple checks. - `previously_seen` boolean — A boolean field that indicates whether the check was already posted and collected from another source or if the check is completely novel. A check's uniqueness is based on the fields `bank`, `check_date`, and `amount` values. - `seen_ids` string[] — An array containing the Check ID value(s) of previously posted Bank Check Data records with the same data elements. - `seen_source_ids` string[] — An array containing the `source_id` values that previously posted a record with the same data elements. - `seen_dates` string[] — An array containing the date(s) in which a record with the same data elements was previously collected and ingested into Bank Check Data. - `source_id` string — The ID of the channel or group of the source in which an admin or user posted the message containing the check image. - `source_type` 'TELEGRAM' — The type of source that posted the check image. Currently, the only `source_type` value is `TELEGRAM`. Refer to `source_id` for the name of the specific source. - `post_url` string — The URL of the post in the source containing the check image. - `actor` string — The source handle of the threat actor who posted the check image. - `actor_id` string — An ID of the threat actor who posted the check image. - `actor_url` string — The URL of account of the threat actor who posted the check image. - `check_date` string — The date written on the date line of the check, as displayed in the check image. - `expired` boolean — A boolean value that indicates whether the check has already expired. This value is only present when the check specifies when it will expire (e.g., text stating “Void 90 days after issue”). If the check does not specify when it will expire, then the `expired` value is not present. - `expired_at` string — Expiration time of a check, if present on the check image. - `amount` number — The sum of money to be paid to the payee, as displayed in the check image. - `check_number` string — The check number, as displayed in the check image. - `fraction_number` string — The fractional routing number displayed in the check image. Fractional routing numbers are primarily used in the United States and indicate the financial institution responsible for the check's payment. - `bank` string — The bank or other financial institution that issued the check and responsible for disbursing the check's payment. The Bank value is derived from the fractional number, logos, and text displayed in the check image. As fractional numbers and logos have greater fidelity than text, we weigh the fractional numbers and logos more highly than text snippets. - `bank_routing_number` string — The routing number displayed in the check image. Routing numbers are numeric addresses that facilitate payment between financial institutions. - `identity1` string — The payer (individual or entity who will make the payment), as displayed in the check image. Typically, the payer is preprinted on the check and reflects the check signatory. Compare to `identity2`, which is the payee. Due to inconsistencies in the formatting of checks, `identity1` may infrequently represent the payee. - `address1` string — The physical address associated with `identity1`, as displayed in the check image. - `city1` string — The city associated with `identity1`, as displayed in the check image. - `state1` string — The state associated with `identity1`, as displayed in the check image. - `zip1` string — The postal code associated with `identity1`, as displayed in the check image. - `identity2` string — The payee (individual or entity who will receive the payment), as displayed in the check image. Compare to `identity1`, which is the payer. Due to inconsistencies in the formatting of checks, `identity2` may infrequently represent the payer. - `address2` string — The physical address associated with `identity2`, as displayed in the check image. - `city2` string — The city associated with `identity2`, as displayed in the check image. - `state2` string — The state associated with `identity2`, as displayed in the check image. - `zip2` string — The postal code associated with `identity2`, as displayed in the check image. - `info` string — Additional text/information that was present on the bank check image. - `panel_log` object[] — Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. This version is deprecated and will be removed completely in future updates. - `id` string - `actor_name` string — Full name of the author - `actor_id` string — Id of the author - `created` string, date-time - `modified` string, date-time - `action_priority` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert. - `message` string — Log message - `changes` PlaybookAlertLogPanelChanges - `assignee_change` AssigneeChange - `old` string - `new` string - `type` 'assignee_change', required - `status_change` StatusChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `priority_change` PriorityChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - `reopen_strategy_change` ReopenStrategyChange — This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - `title_change` TitleChange — This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - `entities_change` EntitiesChange - `removed` string[] - `added` string[] - `type` 'entities_change', required - `related_entities_change` RelatedEntitiesChange - `removed` string[] - `added` string[] - `type` 'related_entities_change', required - `description_change` DescriptionChange — This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - `external_id_change` ExternalIdChange — Record of an external ID change on a case. - `type` 'external_id_change' - `old` string - `new` string - `actions_change` ActionChange — This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - `assessment_ids_change` AssessmentIdsChange — This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - `context` union - DomainAbuseChangeContext - `type` 'domain_abuse', required - `changes` union[], required - union - … - VulnerabilityChangeContext - `type` 'cyber_vulnerability', required - `changes` union[], required - union - … - CodeRepoLeakageChangeContext - `type` 'code_repo_leakage', required - `changes` union[], required - union - … - ThirdPartyRiskChangeContext - `type` 'third_party_risk', required - `changes` union[], required - union - … - FacilityRiskChangeContext - `type` 'geopolitics_facility', required - `changes` union[], required - union - … - `panel_log_v2` object[] — Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. - `id` string, required - `author_id` string — Id of the author - `author_name` string — Full name of the author - `created` string, date-time, required - `changes` union[], required - union - AssigneeChangeV2 — This change applies to any alert type. - `old` Assignee - … - `new` Assignee - … - `type` 'assignee_change', required - CustomStatusChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `actions_taken` OnwardActionId[], required - PriorityChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - ReopenStrategyChange — This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - TitleChange — This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - EntitiesChangeV2 — This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'entities_change', required - RelatedEntitiesChangeV2 — This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'related_entities_change', required - DescriptionChange — This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - ExternalIdChange — Record of an external ID change on a case. - `type` 'external_id_change' - `old` string - `new` string - CommentChange — This change applies to any alert type. - `comment` string, required - `type` 'comment_change', required - ActionChange — This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - AssessmentIdsChange — This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - CustomOnwardActionsRemovedChange — This change applies to any alert type. - `removed_actions_taken` OnwardActionId[] - `type` 'onward_actions_removed_change' - CustomOnwardActionsAddedChange — This change applies to any alert type. - `added_actions_taken` OnwardActionId[] - `type` 'onward_actions_added_change' - DomainAbuseDnsChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` DnsRecordV2[], required - … - `added` DnsRecordV2[], required - … - `type` 'dns_change', required - DomainAbuseWhoisChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `old_record` WhoisRecordV2 - … - `new_record` WhoisRecordV2 - … - `removed_contacts` WhoisContactRecordV2[], required - … - `added_contacts` WhoisContactRecordV2[], required - … - `type` 'whois_change', required - DomainAbuseLogotypeChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'logotype_in_screenshot_change', required - DomainAbuseMaliciousDnsChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_dns_change', required - DomainAbuseReregistrationChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'reregistration_change', required - DomainAbuseMaliciousUrlChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousUrlRecord[], required - … - `added` MaliciousUrlRecord[], required - … - `type` 'malicious_url_change', required - DomainAbuseScreenshotMentionsChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `added` object[], required - … - `type` 'screenshot_mentions_change', required - DomainAbusePhishingMaliciousBehaviorChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `added` DomainAbusePhishingMaliciousBehaviorThreats, required - … - `removed` DomainAbusePhishingMaliciousBehaviorThreats - … - `type` 'phishing_malicious_behavior_change', required - DomainAbuseAttackerAddedChange — This change only applies to Domain Abuse alerts. - `attacker` string, required - `cause` 'manual' | 'typosquat' | 'similar_domains' — Domain Abuse attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `type` 'attacker_added_change', required - MaliciousSitesAttackerAddedChange — Attacker added change for Malicious Sites alerts. - `attacker` string, required — The attacker domain identity. - `cause` 'manual' | 'typosquat' | 'similar_domains' | 'logotype' | 'logotype_high_interest' | 'phishing_verdict' | 'screenshot_mention' | 'screenshot_custom_keyword' | 'login_form' | 'suggested_takedown' — Malicious Sites attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `logotypes` MaliciousSitesLogotype[] - … - `type` 'malicious_sites_attacker_added_change', required - MaliciousSitesDnsChange — DNS change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousSitesDnsChangeRecord[], required - … - `added` MaliciousSitesDnsChangeRecord[], required - … - `type` 'malicious_sites_dns_change', required - MaliciousSitesWhoisChange — Whois change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `old_record` MaliciousSitesWhoisRecord - … - `new_record` MaliciousSitesWhoisRecord - … - `removed_contacts` MaliciousSitesWhoisContactRecord[], required - … - `added_contacts` MaliciousSitesWhoisContactRecord[], required - … - `type` 'malicious_sites_whois_change', required - MaliciousSitesMaliciousDnsChange — Malicious DNS change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_sites_malicious_dns_change', required - MaliciousSitesReregistrationChange — Reregistration change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'malicious_sites_reregistration_change', required - MaliciousSitesMaliciousUrlChange — Malicious URL change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousSitesMaliciousUrlRecord[], required - … - `added` MaliciousSitesMaliciousUrlRecord[], required - … - `type` 'malicious_sites_malicious_url_change', required - MaliciousSitesForSaleChange — Indicates the domain is for sale. - `url` string, required - `image` string, required - `type` 'for_sale_change', required - MaliciousSitesParkedChange — Indicates the domain is parked. - `url` string, required - `image` string, required - `type` 'parked_change', required - MaliciousSitesLogoHashChange — Indicates logo(s) were detected on a URL via hash matching. - `url` string, required - `scan` string - `hashes` string[], required - `brands` string[] - `type` 'logo_hash_change', required - MaliciousSitesScreenshotMentionChange — Indicates mentions found in a screenshot. - `url` string, required - `scan` string, required - `screenshot` string, required - `mentions` string[], required - `texts` string[], required - `type` 'malicious_sites_screenshot_mention_change', required - MaliciousSitesPhishingVerdictChange — Indicates a phishing verdict was detected. - `domain` string - `url` string - `risk_rule` string, required - `ttps` string[], required - `brands` string[], required - `type` 'phishing_verdict_change', required - MaliciousSitesSuggestedTakedownChange — Indicates a takedown is suggested. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string - `type` 'suggested_takedown_change', required - MaliciousSitesLogoChange — This change only applies to Malicious Sites alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'malicious_sites_logo_change', required - VulnerabilityLifecycleChangeV2 — This change only applies to Vulnerability alerts. - `added` VulnerabilityAssessment - … - `removed` VulnerabilityAssessment - … - `triggered_by_risk_rule` object - … - `type` 'lifecycle_in_cve_change', required - CodeRepoLeakageEvidenceChangeV2 — This change only applies to Data Leakage on Code Repository alerts. - `added` CodeRepoLeakageEvidenceV2[], required - … - `type` 'evidence_change', required - ThirdPartyAssessmentChangeV2 — This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'tpr_assessment_change', required - ThirdPartyAssessmentChangeV3 — This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `assessment_name` string - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'assessment_change', required - FacilityEvidenceChange - `added` FacilityEvidence[], required - … - `type` 'evidence_changes', required - ClusterChangeAdded — Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert. - `cluster_id` string - `main_event` object - … - `other_event_ids` string[] - `type` 'cluster_change_added', required --- [API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)