# Fraudulent website signal Evaluate connected account websites for suspicious or misleading content. > #### Availability > > Sandbox testing is available with any Radar plan. To use the API in live mode, you must have Radar Plus or Radar Pro. Live mode is limited to 4,000 requests per month. The fraudulent website signal evaluates whether a connected account’s website is deceptive or violates policy. This includes websites for accounts that don’t exist yet on Stripe. ## Request an evaluation Use the [Account Evaluations API](https://docs.stripe.com/api/v2/signals/account-evaluations.md?api-version=preview) to trigger a fraudulent website evaluation on demand. You can evaluate an existing connected account or provide account data directly. ### Evaluate an existing account You can evaluate a website for an existing account. ```curl curl -X POST https://api.stripe.com/v2/signals/account_evaluations \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-09-30.preview" \ --json '{ "account_details": { "account": "{{CONNECTEDACCOUNT_ID}}" }, "requested_signals": [ "fraudulent_website" ] }' ``` ### Evaluate without an existing account You can evaluate a website before creating a connected account by providing `account_details.data` with the business URL. The `business_url` field is the only required field for an entity-less evaluation. You can provide other fields to improve the accuracy of the assessment. ```curl curl -X POST https://api.stripe.com/v2/signals/account_evaluations \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-09-30.preview" \ --json '{ "account_details": { "data": { "defaults": { "profile": { "business_url": "https://example.com" } } } }, "requested_signals": [ "fraudulent_website" ] }' ``` ## Webhook events The evaluation is asynchronous. Listen for: - `v2.signals.account_signal.fraudulent_website_ready` when you request a fraudulent website evaluation. - `v2.signals.account_evaluation.complete` when you request multiple signals and want one notification after all results are ready. These are thin events: `data` is always `{}`. Use `related_object.id` to fetch the related signal or evaluation. You can retrieve account signals and account evaluations for up to 90 days after creation. ```curl curl https://api.stripe.com/v2/signals/account_signals/acctsig_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-09-30.preview" ``` ```json { "id": "acctsig_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES", "object": "v2.signals.account_signal", "type": "fraudulent_website", "account_details": { "account": "acct_1T42eHAZTJIN1MEb" }, "account_evaluation": "acctevl_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES", "created": "2026-02-26T00:43:28.000Z", "fraudulent_website": { "risk_level": "elevated", "details": "The website contains several indicators of potential fraud: product listings use vague descriptions inconsistent with industry norms, the contact page lacks a verifiable address, and images appear to be stock photos presented as original product photos." } } ``` Alternatively, if you received a `v2.signals.account_evaluation.complete` event, use `related_object.id` to fetch the full evaluation, which includes the signal result in `evaluated_signals`: ```curl curl https://api.stripe.com/v2/signals/account_evaluations/acctevl_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-09-30.preview" ``` ```json { "id": "acctevl_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES", "object": "v2.signals.account_evaluation", "account_details": { "account": "acct_1T42eHAZTJIN1MEb" }, "requested_signals": ["fraudulent_website"], "pending_signals": [], "evaluated_signals": { "fraudulent_website": { "signal": "acctsig_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES", "evaluated_at": "2026-02-26T00:43:28.000Z", "risk_level": "elevated", "details": "The website contains several indicators of potential fraud: product listings use vague descriptions inconsistent with industry norms, the contact page lacks a verifiable address, and images appear to be stock photos presented as original product photos." } } } ``` The signal includes the following information: | Field | Description | | --- | --- | | `risk_level` | The risk level for the website: `low`, `normal`, `elevated`, `highest`, or `unknown`. | | `details` | A plain description of issues found on the website, generated by LLM analysis. If the `risk_level` is `unknown`, the explanation includes why we couldn’t complete the evaluation. | > If the website URL is invalid or unreachable, the evaluation returns a risk level of `unknown` with an explanation of why we couldn’t complete the evaluation. ## Test in a sandbox You can trigger a `fraudulent_website` evaluation in a sandbox and receive a deterministic result without waiting for a real website crawl. Use one of the reserved test URLs as the `business_url` in your evaluation request. | URL | `risk_level` result | | --- | --- | | `https://fraudulent-website.test/low` | `low` | | `https://fraudulent-website.test/normal` | `normal` | | `https://fraudulent-website.test/elevated` | `elevated` | | `https://fraudulent-website.test/highest` | `highest` | | `https://fraudulent-website.test/unknown` | `unknown` | | Any other URL | `normal` (standard mock response) | > Reserved URLs only work in a sandbox. Live mode always performs a real website evaluation. ### Test with an existing account In a sandbox, update your connected account’s business URL to a reserved test URL, then trigger the evaluation. #### Accounts v2 ```curl curl -X POST https://api.stripe.com/v2/core/accounts/{{CONNECTEDACCOUNT_ID}} \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-09-30.preview" \ --json '{ "defaults": { "profile": { "business_url": "https://fraudulent-website.test/elevated" } } }' ``` #### Accounts v1 ```curl curl https://api.stripe.com/v1/accounts/{{CONNECTEDACCOUNT_ID}} \ -u "<>:" \ --data-urlencode "business_profile[url]=https://fraudulent-website.test/elevated" ``` ```curl curl -X POST https://api.stripe.com/v2/signals/account_evaluations \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-09-30.preview" \ --json '{ "account_details": { "account": "{{CONNECTEDACCOUNT_ID}}" }, "requested_signals": [ "fraudulent_website" ] }' ``` ### Test with an entity-less evaluation Pass a reserved test URL as `business_url` in `account_details.data`: ```curl curl -X POST https://api.stripe.com/v2/signals/account_evaluations \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-09-30.preview" \ --json '{ "account_details": { "data": { "defaults": { "profile": { "business_url": "https://fraudulent-website.test/highest" } } } }, "requested_signals": [ "fraudulent_website" ] }' ``` ## Take action on connected accounts You can respond to the fraudulent website signals that you receive for a connected account using the [Radar](https://docs.stripe.com/radar/account-fraud-prevention.md) tools. See the list of [available actions](https://docs.stripe.com/radar/account-fraud-prevention.md#take-action).