| [ Web Proxy ] |
| Viewing: https://docs.stripe.com/radar/transaction-risk-prevention | [Back] [Original] |
While Stripe Radar offers a greater ability to monitor your payments and protect your business from disputes, youre ultimately responsible for payments you choose to accept, including those that are later disputed or found to be fraudulent.
Stripe Radar includes adaptive AI models that use a risk score to evaluate the risk level for each payment in real time. The model uses hundreds of risk factors about each payment and data across our network of businesses to predict whether a payment is likely to be fraudulent. It learns from new customer purchase patterns and transaction features, and incorporates feedback from you whenever payments are marked as fraudulent.
Risk settings and the risk controls for fraudulent disputes and early fraud warnings dont use these AI models. They use more specialized models that can balance the tradeoffs between authorization and fraud.
When a business using Stripe sees a card, a SEPA Direct Debit account, or an ACH account, Stripe has likely processed payments for that payment method in the past:
Radar evaluates risk and runs rules for three Stripe API objects: Charges, PaymentIntents and SetupIntents. Stripe designed the Radar rules to take four actions:
The following table illustrates which rules Radar runs for each type of API object:
| Transaction type | Request 3DS | Allow and Block | Review |
|---|---|---|---|
| Charge | |||
| PaymentIntent | |||
| SetupIntent |
If you use card payments, you can enable Radar for SetupIntents in your Radar settings.
This information also applies to payments created using Stripe Checkout and Stripe Billing. To provide a seamless flow for your subscription customers, the Radar fraud models only score the initial payment of a recurring Stripe Billing subscription, but evaluate rules for all payments.
When available, each payment also includes a risk score that ranges from 099 to indicate the risk level on a more granular level. By default, a score of 65 or above indicates elevated risk, while a score of 75 or above indicates high risk.
The Stripe AI models evaluate the likelihood that a payment is fraudulent, and provides an assessment of one of the following values:
Each payment includes information on the outcome of our risk evaluation.
The risk insights section on the payment page provides more details about why we assigned a payment a particular risk level and score.
If a financial institution (such as a card issuer or bank) declines a payment, Stripe also includes any information we receive from them as part of the outcome. You can see the outcome for each payment in the Dashboard, or through the API in the Outcome attribute of the Charge object.
Stripe reports payments as high risk when we believe theyre likely to be fraudulent. Payments of this risk level are blocked by default.
On the Charge object of a high risk payment, the risk_level is set to highest.
... "outcome": { "network_status": "not_sent_to_network", "reason": "highest_risk_level", "risk_level": "highest", "risk_score": 92, // Provided only with certain Radar plans "seller_message": "Stripe blocked this charge as too risky.", "type": "blocked" } ...
If Stripe Radar blocks a payment that you know is legitimate, you can remove the block by viewing the payment in the Dashboard and clicking Add to allow list. Adding a payment to the allow list doesnt retry the payment, but it does prevent Stripe Radar from blocking future payment attempts with that payment method or email address.
If you dont see Add to allow list, you can contact us to add this feature to your Radar account.
Elevated risk payments have an increased chance of being fraudulent. Stripe Radar allows payments of this risk level by default. If your plan supports this feature, you can evaluate elevated risk payments in your review queue.
On the Charge object of an elevated risk payment, the risk_level is set to elevated.
... "outcome": { "network_status": "approved_by_network", "reason": "elevated_risk_level", "risk_level": "elevated", "risk_score": 68, // Provided only with Stripe Radar for Fraud Teams "seller_message": "Stripe evaluated this charge as having elevated risk, and placed it in your manual review queue.", "type": "manual_review" } ...
Payments with a normal risk evaluation have fewer characteristics that indicate fraud than payments with elevated or high risk levels. However, we recommend that you continue to be vigilant when fulfilling these orders. Payments that have normal risk can still turn out to be fraudulent, and there are other possible types of fraud that can occur later in the order process.
On the Charge object of a successful payment with normal risk, the risk_level is set to normal.
... "outcome": { "network_status": "approved_by_network", "reason": null, "seller_message": "The charge was authorized.", "risk_level": "normal", "risk_score": 23, // Provided only with Stripe Radar for Fraud Teams "type": "authorized" } ...
Radar assesses the risk level for card, ACH, and SEPA Direct Debit payments, and sets the risk level to not_assessed for:
On the Charge object of an unevaluated payment, the risk_level is set to not_assessed.
... "outcome": { "network_status": "approved_by_network", "reason": "not_assessed_risk_level", "risk_level": "not_assessed", "seller_message": "Your business has opted out of Radar fraud risk assessments.", "type": "authorized" } ...
In unusual cases, an error might cause risk evaluation to fail. If this happens, Stripe reports the payment as having unknown risk.
On the Charge object of an unknown risk payment, the risk_level is set to unknown.
... "outcome": { "network_status": "approved_by_network", "reason": "unknown_risk_level", "risk_level": "unknown", "seller_message": "Something went wrong while evaluating this payment. Our engineers have been notified and we'll look into this as soon as possible.", "type": "authorized" } ...
You can search for payments with a specific risk level using the risk_level search term and the desired risk level. For example, a search for risk_level:highest returns a list of all payments with a high risk level. A search for risk_level:elevated returns a list of all payments with an elevated risk level.
While we use information across our network to evaluate a payment, you might have additional information about a payment as a result of a customer interaction. Our AI models respond to feedback you share with us, and you can help improve our fraud detection algorithms and the accuracy of our risk evaluations by refunding and reporting payments that you believe are fraudulent.
To refund a payment and mark it as fraudulent, do the following:
You can also indicate that a payment is fraudulent when you create a refund using the API by providing fraudulent as the value for reason. This adds the email address and card fingerprint associated with the payment to the default email address and card fingerprint block lists.
# Don't put any keys in code. See https://docs.stripe.com/keys-best-practices. # Find your keys at https://dashboard.stripe.com/apikeys. client = Stripe::StripeClient.new('sk_test_wU7nrJCZspk1NPDxiQgAF05q') # If you haven't refunded the charge, you can do so and let Stripe # know it was fraudulent in one step. client.v1.refunds.create({ charge: '{{CHARGE_ID}}', reason: 'fraudulent', }) # If you already refunded the charge (without specifying the # 'fraudulent' reason), you can still let us know it was fraudulent. client.v1.charges.update( '{{CHARGE_ID}}', { fraud_details: { user_report: 'fraudulent', }, } )
For a small subset of payments, Stripe modifies the reported risk score so we can measure the performance of our models and obtain data for subsequent model development. This allows us to make sure key metrics, such as false positive rate and recall, remain within desirable ranges, and that model performance continues to improve.
You can opt out of integrating Radar with the API by contacting support.
| Web Proxy Viewer | New URL | Original Page |