Your WhatsApp Risk Score, Explained — What Actually Triggers a Suspension

Most "why was my account suspended" support tickets share the same root cause: the sender never saw it coming. The risk score that triggered the suspension had been climbing for days, quietly, in a dashboard nobody checked. This article walks through exactly how that score works on TextMeFlow, so you can read the warning signs before they become a suspension email.

What the risk score actually is

Every TextMeFlow account carries a risk score, stored with a rolling 30-day window. It starts at zero and only moves when your sending pattern trips one of a fixed set of triggers — it's not a black-box machine-learning guess, it's a deterministic point system:

Cross ANTI_SPAM_RISK_THRESHOLD (100 by default) and the account is automatically suspended, with an email to the account holder. That's roughly two forced quiet-hour sends plus one identical-broadcast flag plus one opt-out violation — it adds up faster than people expect.

You can pull your current score any time with a simple call:

curl -H "Authorization: Bearer $TOKEN" \
  https://api.textmeflow.eu/v1/accounts/me

The response includes a risk_score field. If you're building a dashboard on top of the API, poll this daily and alert internally at, say, 50 — long before it becomes a problem.

The trigger that surprises people most: opted-out sends

At +50 per hit, sending to a recipient who already replied STOP is by far the single most expensive mistake on the list. It's also the easiest to make if you're syncing contact lists from a CRM that doesn't know about the opt-out yet. TextMeFlow rejects those sends with recipient_opted_out and fires an opt_out webhook the moment someone unsubscribes — wire that webhook into your CRM so the suppression list updates automatically instead of relying on a nightly batch job.

The one that isn't about your account at all

Mass new-recipient burst is scored per number, not per account. WhatsApp restricts individual numbers, so an account with three paired devices can have one throttled while the account-wide totals still look calm. TextMeFlow compares each number against its own recent history — a holiday rental doing 40 check-ins a day is normal, a number that did 2 yesterday and 40 today isn't. This trigger only warns and logs; it never blocks a send outright, because a busy Saturday shouldn't mean a guest misses their door code.

The metric that warns you before the score does

The risk score tells you what already went wrong. The confirmed-delivery ratio in the portal tells you something is about to go wrong. WhatsApp sometimes squeezes a number's reach before any error becomes visible — the API still reports "sent," but fewer of those sends actually arrive. Watch that ratio per number, not just account-wide; a single throttled number can hide inside an otherwise healthy average.

What to actually do with this

1. Poll risk_score and alert before 100, not at 100.
2. Wire the opt_out webhook straight into your suppression list — don't rely on manual syncs.
3. Personalize bulk sends (name, order number, room number) to dodge the identical-broadcast trigger entirely.
4. Check the per-number delivery ratio weekly, especially on multi-device accounts.

The full trigger list, quiet-hours logic, and rate limits per plan are documented in detail in the anti-spam policy. If you want the broader seven-rule checklist for staying off Meta's radar in the first place, see how to prevent a WhatsApp number ban.

Try TextMeFlow free — the risk-score pipeline runs on every plan, including the free one: 50 messages a month, no time limit.