Maskbreak vs Sift

Sift pricing: what does Sift cost in 2026?

Sift does not say. sift.com/pricing returned a 404 when we checked on 24 September 2026, and every call to action on the site leads to sales: a demo request, a contact form or “talk to an expert”. The best public evidence is Vendr’s buyer data: across 50 purchases, last updated February 2026, the median Sift contract was $150,000 a year, and deals ranged from $29,600 to $600,000.

Vendr lists six things that move the number, led by API call volume: how many fraud checks you run a month. Then the modules you buy (it lists Payment Protection, Account Defense and Content Integrity, and says bundling often earns a discount). Contract term matters: multi-year deals typically come in 10–20% lower per year. Implementation is often quoted separately, with professional services at $5,000 to $20,000 or more. Premium support typically adds 10–20% to the contract, and annual escalation clauses of 3–7% a year are common. So “five to six figures a year” is a fair summary, and “six figures or nothing” is not.

Two things trip people up when they search for Sift pricing. Figures such as $500 a month turn up on software directories with no source, and a “14-day free trial” belongs to justsift.com, a different company that sells an org-chart tool. Sift itself has no self-serve sign-up or trial. Its developer docs do mention sandbox API keys, but those are for testing an integration inside a customer account, not a free tier. Maskbreak publishes its prices: sign up, get a key, and the Free plan covers 10,000 visitor checks a month; paid plans run from €29 to €299 a month, and Enterprise starts at €990. Approved public-interest organisations can have the cap taken off.

What is Sift?

Sift is a San Francisco fraud prevention company, founded in 2011 as Sift Science and renamed Sift in January 2019. Marc Friend became chief executive in November 2025, succeeding Marc Olesen; co-founder Jason Tan is Founder and Executive Chairman.

It sells three software products and a services team:

• Payment Protection scores transactions, flags card testing and learns from your dispute and chargeback history.
• Account Defense covers logins and account takeover, with durable device fingerprinting, monitoring after login and email or SMS step-up.
• The Sift Score API returns what its product page calls “a fraud risk score (0-100)” and the top 20 risk signals behind it, for teams that run their own models or rules engines.
• Expert Services is its fraud-strategy and managed-service team.

Underneath sit a Decisioning Engine, Workflows, the Sift Console and what the site’s navigation calls Network Intelligence (the Payment Protection page still says Global Data Network). By Sift’s own count it has 700+ customers (DoorDash, Yelp and Poshmark among them) and sees over a trillion events a year from 34K+ sites and apps, and its Score API page says 16,000+ fraud signals feed the score.

The line-up is narrower than it was. Sift bought the dispute company Chargeback in 2021, and Dispute Management, Content Integrity and Identity Trust used to have product pages of their own; all three now redirect to its platform overview. Content abuse is still one of the five abuse types its API scores. It also bought Keyless, a passwordless-login company, in 2021, but Keyless was spun back out in 2023, so Sift does not sell that biometric login today. Its release page shows recent work on stronger bot-attack detection and more persistent iOS device IDs.

Not the same Sift: Community Sift is Microsoft’s content-moderation product, which arrived with its 2021 purchase of Two Hat. justsift.com is a people-directory tool and the SIFT Workstation is a SANS forensics kit. None of them is the fraud company.

A score about a user, or a verdict about a visit

The two products ask different questions. Sift asks whether this user and this event look like fraud, given your history and everything else it has seen. Maskbreak asks what the visit is: which network it came through, and whether an ordinary, unmodified browser sent it.

Take a credential-stuffing run against a login form. A script replays leaked email and password pairs, and each attempt leaves through a different home broadband address from a rotating residential proxy pool, so per-IP rate limits never trip. Maskbreak’s browser snippet collects two tokens as the form is submitted; your server sends them to POST /v1/evaluate and gets this back. Example response, selected fields:

{
  "decision": "block",
  "risk_score": 91,
  "reasons": ["proxy_detected", "automation_detected"],
  "network": {
    "vpn": false,
    "proxy": true,
    "datacenter": false,
    "tor": false,
    "service": "<proxy service, when known>"
  },
  "device": {
    "automation": true,
    "antidetect": false,
    "emulator": false,
    "tampering_score": 0.1
  }
}

Proxy and automation are both hard signals, so the default policy blocks. A caveat on the proxy half: proxy: true appears when the exit is already tied to a known proxy pool. A pool rotates addresses faster than classification catches up, so a fresh exit can show residential: true instead; the automation signal alone still blocks, and the browser’s time zone and the device carry the rest. Change the evidence and the answer changes with it. The same login through a VPN alone would be flagged for review, with the VPN service named when known. A login from a cloud server with nothing else wrong stays allow, with datacenter_asn still listed. A script that skips the browser never produces the tokens at all, and in enforce mode the integration guide holds missing evidence instead of treating it as clean. The action for each signal can be changed on the console’s Rules tab, and the account takeover playbook walks the login case end to end.

Sift sees the same login from the account’s side. Its account-takeover guide lists the signals behind Account Defense: device fingerprinting, behavioural biometrics, IP and proxy intelligence, velocity patterns and cross-network data, with headless browsers and emulators named as device tells. It keeps watching after login and can step up with an email or SMS code. The output is a score per abuse type with reason codes attached (the API overview shows one called UsersPerDevice), and your rules or Sift’s workflows act on it. Sift markets “Clearbox” visibility into the signals behind each decision, so the score arrives explained, not bare. One detail to confirm during an evaluation: the docs describe the score as 0 to 100, while the raw JSON example shows a decimal between 0 and 1.

Setup differs as much as output. With Sift you send events from your backend as users sign up, log in and pay (server libraries exist for Python, Ruby, PHP, Java and .NET), add its JavaScript, iOS or Android SDK, and backfill a few months of history if you can. Sift offers pre-built workflow templates that it says need no engineering support, and a Historical Chargeback Import so past losses reach the model. Maskbreak does not need your history to start, because it judges the visit rather than the user. It is one snippet and one server call, and the quickstart begins in watch mode: log every decision, let everyone through, and turn on enforcement once the Events log looks right.

Maskbreak vs Sift, feature by feature

Sift or Maskbreak: which fits your team?

Choose Sift for a fraud model and the tooling of a fraud team. Choose Maskbreak for evidence about the visit, returned to code you already run.

You can also run both. Maskbreak at the form says what the visit is; Sift, or any platform, scores the user and the payment. Your code decides how the answers combine, for example stepping up a login only when Sift’s score is high and Maskbreak also sees a proxy. Maskbreak does not replace MFA, payment-risk scoring, KYC or a chargeback guarantee.

Sift competitors, and who carries the chargeback

Sift’s own round-up of fraud prevention software (October 2025, updated February 2026) names Forter, Kount, SEON, Signifyd, Accertify, Riskified and Ravelin. For online stores the list splits on a question that matters more than any feature table: when a fraudulent order gets through, whose loss is it? The details below were checked in September 2026.

SEON and Kount have their own pages: Maskbreak vs SEON and Maskbreak vs Kount. Maskbreak sits in neither column. It makes no order decision and carries no liability; it tells you what the visit is, and it can sit in front of any tool above. The Sift alternatives guide compares the options by the job you need done.