# Customer risk

Assess and respond to fraud or abuse associated with your customers.

Radar assesses customer risk using signals from the customer’s activity with your business and across the Stripe network. Use the built-in risk control or custom Radar rules to respond to this assessment when the customer makes a payment.

To use customer risk, you must have the Radar Pro plan and [access to the private preview](https://docs.stripe.com/radar/customer-risk.md#request-access).

## How it works 

Radar assigns a fraud and abuse risk level to a Stripe [Customer](https://docs.stripe.com/api/customers.md) object. The assessment considers fraudulent and abusive activity throughout the customer lifecycle, including payments, registrations, refunds, and disputes.

The Stripe network graph links activity associated with the customer and their underlying identity using identifiers such as payment methods, devices, and email addresses. This helps Radar detect recurring fraud and abuse patterns across `Customer` objects and businesses that an individual business might not identify from its own activity.

Radar returns the customer’s risk level without exposing information about other Stripe businesses or their customers. The risk level can change as Stripe receives new information.

> #### Customer object required
> 
> You must identify the customer with a Stripe Customer ID. Radar doesn’t support customer risk assessments without a `Customer` object.

## Interpret customer risk levels 

Radar assigns a customer risk level of `normal`, `elevated`, `highest`, or `unknown`. The `elevated` and `highest` levels indicate increased fraud or abuse risk. An `unknown` level means that Radar couldn’t determine the customer’s risk.

Evaluate the risk level alongside your policies and other information about the customer. Customers might share identifiers or exhibit similar activity for legitimate reasons, and related customers might receive different risk levels.

## Respond to customer risk 

Use the built-in risk control or write custom Radar rules to block or review payments based on customer risk. Both options apply when Radar evaluates a payment. Neither takes action on the customer outside the payment flow.

### Enable the customer risk control 

The customer risk control blocks a payment when Radar assigns the customer a risk level of `highest`. The control is disabled by default.

Before enabling the control, assess its potential effect on your payments:

1. Go to [Risk controls](https://dashboard.stripe.com/settings/radar/risk-controls) in the Dashboard.
2. Select **Customer risk**.
3. Choose a date range to test the control against past payments.
4. Review the projected impact. Compare individual matching payments with your policies and false-positive tolerance.
5. Select **Enable control**.

After enabling the control, use its overview page to monitor blocked payment volume and review affected payments.

### Write custom rules 

Use the `customer_abuse_risk_level` attribute in [custom Radar rules](https://docs.stripe.com/radar/rules.md) to define how Radar responds to each customer risk level. Supported values are `normal`, `elevated`, and `highest`. For example:

- `Block if :customer_abuse_risk_level: = 'highest'`
- `Review if :customer_abuse_risk_level: = 'elevated'`

The `highest` value indicates the greatest assessed customer abuse risk. Block matching payments only if that action aligns with your policies and backtest results. For `elevated`, use manual review or combine the attribute with other risk criteria instead of blocking a payment based only on the customer risk level.

Before enabling your rules, [backtest them](https://docs.stripe.com/radar/testing.md#rules) against historical payments. Evaluate the results based on your policies and false-positive tolerance.

## Analyze customer risk in Sigma 

If you use Stripe Sigma, query the `radar_consumer_abuse_risk_levels` table to investigate customers with an `elevated` or `highest` customer abuse risk level.

Each row identifies the `Customer` object and the assessment time. The table includes the overall `customer_abuse_risk_level` and the following metrics calculated over the previous 90 days:

- Fraudulent dispute and early fraud warning rates
- Fraudulent and non-fraudulent refund rates
- Non-fraudulent dispute rates
- Authorization rates
- Suspected card testing rates
- Unpaid invoice rates

Metrics with the `customer_` prefix describe activity associated with a specific `Customer` object. Metrics with the `entity_` prefix aggregate activity across related `Customer` objects that Stripe associates with the same underlying identity.

Use these metrics alongside your policies and customer context to investigate an increased risk level before changing your controls or rules.

## Receive customer risk updates 

Stripe evaluates customer risk asynchronously. When a customer’s risk level changes, Stripe creates a `customer_risk` [AccountSignal](https://docs.stripe.com/api/v2/signals/account-signals/list.md?api-version=preview) and sends a `v2.signals.account_signal.customer_risk_ready` event notification.

This thin event has an empty `data` property. The `related_object.id` property identifies the `AccountSignal` containing the assessment:

Verify webhook signatures before processing events.

```json
{
  "id": "evt_123",
  "object": "v2.core.event",
  "type": "v2.signals.account_signal.customer_risk_ready",
  "created": "2026-10-08T00:00:10.000Z",
  "related_object": {
    "id": "acctsig_123",
    "type": "v2.signals.account_signal",
    "url": "/v2/signals/account_signals/acctsig_123"
  },
  "data": {}
}
```

### Retrieve the customer risk signal 

Use `related_object.id` from the event notification to retrieve the `AccountSignal`:

```curl
curl https://api.stripe.com/v2/signals/account_signals/acctsig_123 \
  -H "Authorization: Bearer <<YOUR_SECRET_KEY>>" \
  -H "Stripe-Version: 2026-09-30.preview"
```

The response contains the Stripe `Customer` ID and its assessed risk level:

```json
{
  "id": "acctsig_123",
  "object": "v2.signals.account_signal",
  "created": "2026-10-08T00:00:00.000Z",
  "type": "customer_risk",
  "account_details": {
    "customer": "cus_123"
  },
  "customer_risk": {
    "risk_level": "highest"
  }
}
```

The `account_details.customer` property identifies the corresponding `Customer` object. The `customer_risk.risk_level` property contains the assessed risk level.

> #### Asynchronous risk updates
> 
> Customer risk updates are asynchronous. Don’t use the webhook as a synchronous risk evaluation endpoint.

## Request access 

### Request access to the customer risk preview.

Enter your email to request access.

```bash
curl https://docs.stripe.com/preview/register \
  -X POST \
  -H "Content-Type: application/json" \
  -H "Referer: https://docs.stripe.com/radar/customer-risk" \
  -d '{"email": "EMAIL", "preview": "customer_risk_preview"}'
```

## See also 

- [Customer abuse prevention](https://docs.stripe.com/radar/customer-abuse-prevention.md)
- [Manage Radar risk controls](https://docs.stripe.com/radar/risk-settings.md)
- [Custom Radar rules](https://docs.stripe.com/radar/rules.md)
- [Backtest Radar rules](https://docs.stripe.com/radar/testing.md#rules)
- [Stripe Sigma](https://docs.stripe.com/data/sigma.md)