What this endpoint does

Retrieves detailed fraud intelligence for multiple compromised bank check alerts in a single request (up to 250 alert IDs). These alerts are generated when images of compromised bank checks are discovered on dark web channels such as Telegram. Use the Playbook Alerts: Search endpoint with category fraud_compromised_checks to find alert IDs first. The optional panels parameter lets you request only specific data sections ("status", "summary", or "log") to reduce response size. For retrieving a single alert's details, use the Playbook Alerts: Bank Checks Detail endpoint instead.

Response data

Each alert in the response contains panel-organized data: panel_status provides alert metadata (status, priority, assignee, timestamps, and available remediation actions like flagging as stolen or stopping payment); panel_evidence_summary contains the extracted check details including check amount, check number, routing number, bank name, payer and payee identities with addresses, the dark web source and actor information, collection and posting dates, and assessments indicating whether this is a first appearance or was previously seen; and panel_log_v2 tracks the alert's change history including status changes, assignments, and analyst notes.