# Fraudulent website signal Evaluate connected account websites for suspicious or misleading content. The fraudulent website signal evaluates whether a connected account’s website is deceptive or violates policy. This includes websites for accounts that don’t exist yet on Stripe. ### Get early access to the fraudulent website signal. Enter your email to request access. ```bash curl https://docs.stripe.com/preview/register \ -X POST \ -H "Content-Type: application/json" \ -H "Referer: https://docs.stripe.com/radar/fraudulent-website" \ -d '{"email": "EMAIL", "preview": "merchant_risk_tooling_beta_preview"}' ``` ## Request an evaluation Use the Account Evaluations API to trigger a fraudulent website evaluation on demand. You can evaluate an existing connected account or provide account data directly. ### Evaluate an existing account You can evaluate a website for an existing account. ```curl curl -X POST https://api.stripe.com/v2/signals/account_evaluations \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-07-29.preview" \ --json '{ "account_details": { "account": "{{CONNECTEDACCOUNT_ID}}" }, "requested_signals": [ "fraudulent_website" ] }' ``` ### Evaluate without an existing account You can evaluate a website before creating a connected account by providing `account_details.data` with the business URL. The `business_url` field is the only required field for an entity-less evaluation. You can provide other fields to improve the accuracy of the assessment. ```curl curl -X POST https://api.stripe.com/v2/signals/account_evaluations \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-07-29.preview" \ --json '{ "account_details": { "data": { "defaults": { "profile": { "business_url": "https://example.com" } } } }, "requested_signals": [ "fraudulent_website" ] }' ``` ## Webhook events The evaluation is asynchronous. Listen for: - `v2.signals.account_signal.fraudulent_website_ready` when you request a fraudulent website evaluation. - `v2.signals.account_evaluation.complete` when you request multiple signals and want one notification after all results are ready. These are thin events: `data` is always `{}`. Use `related_object.id` to fetch the related signal or evaluation. ```curl curl https://api.stripe.com/v2/signals/account_signals/acctsig_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-07-29.preview" ``` ```json { "id": "acctsig_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES", "object": "v2.signals.account_signal", "type": "fraudulent_website", "account_details": { "account": "acct_1T42eHAZTJIN1MEb" }, "account_evaluation": "acctevl_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES", "created": "2026-02-26T00:43:28.000Z", "fraudulent_website": { "risk_level": "elevated", "details": "The website contains several indicators of potential fraud: product listings use vague descriptions inconsistent with industry norms, the contact page lacks a verifiable address, and images appear to be stock photos presented as original product photos." } } ``` Alternatively, if you received a `v2.signals.account_evaluation.complete` event, use `related_object.id` to fetch the full evaluation, which includes the signal result in `evaluated_signals`: ```curl curl https://api.stripe.com/v2/signals/account_evaluations/acctevl_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-07-29.preview" ``` ```json { "id": "acctevl_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES", "object": "v2.signals.account_evaluation", "account_details": { "account": "acct_1T42eHAZTJIN1MEb" }, "requested_signals": ["fraudulent_website"], "pending_signals": [], "evaluated_signals": { "fraudulent_website": { "signal": "acctsig_61UDQe5wRb3w1JgCP16UDQb80xSQmM6vEqeUAlKES", "evaluated_at": "2026-02-26T00:43:28.000Z", "risk_level": "elevated", "details": "The website contains several indicators of potential fraud: product listings use vague descriptions inconsistent with industry norms, the contact page lacks a verifiable address, and images appear to be stock photos presented as original product photos." } } } ``` The signal includes the following information: | Field | Description | | --- | --- | | `risk_level` | The risk level for the website: `low`, `normal`, `elevated`, `highest`, or `unknown`. | | `details` | A plain description of issues found on the website, generated by LLM analysis. If the `risk_level` is `unknown`, the explanation includes why we couldn’t complete the evaluation. | > If the website URL is invalid or unreachable, the evaluation returns a risk level of `unknown` with an explanation of why we couldn’t complete the evaluation. ## Test in a sandbox You can trigger a `fraudulent_website` evaluation in a sandbox and receive a deterministic result without waiting for a real website crawl. Use one of the reserved test URLs as the `business_url` in your evaluation request. | URL | `risk_level` result | | --- | --- | | `https://fraudulent-website.test/low` | `low` | | `https://fraudulent-website.test/normal` | `normal` | | `https://fraudulent-website.test/elevated` | `elevated` | | `https://fraudulent-website.test/highest` | `highest` | | `https://fraudulent-website.test/unknown` | `unknown` | | Any other URL | `normal` (standard mock response) | > Reserved URLs only work in a sandbox. Live mode always performs a real website evaluation. ### Test with an existing account In a sandbox, update your connected account’s business URL to a reserved test URL, then trigger the evaluation. #### Accounts v2 ```curl curl -X POST https://api.stripe.com/v2/core/accounts/{{CONNECTEDACCOUNT_ID}} \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-07-29.preview" \ --json '{ "defaults": { "profile": { "business_url": "https://fraudulent-website.test/elevated" } } }' ``` #### Accounts v1 ```curl curl https://api.stripe.com/v1/accounts/{{CONNECTEDACCOUNT_ID}} \ -u "<>:" \ --data-urlencode "business_profile[url]=https://fraudulent-website.test/elevated" ``` ```curl curl -X POST https://api.stripe.com/v2/signals/account_evaluations \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-07-29.preview" \ --json '{ "account_details": { "account": "{{CONNECTEDACCOUNT_ID}}" }, "requested_signals": [ "fraudulent_website" ] }' ``` ### Test with an entity-less evaluation Pass a reserved test URL as `business_url` in `account_details.data`: ```curl curl -X POST https://api.stripe.com/v2/signals/account_evaluations \ -H "Authorization: Bearer <>" \ -H "Stripe-Version: 2026-07-29.preview" \ --json '{ "account_details": { "data": { "defaults": { "profile": { "business_url": "https://fraudulent-website.test/highest" } } } }, "requested_signals": [ "fraudulent_website" ] }' ``` ## Take action on connected accounts You can respond to the fraudulent website signals that you receive for a connected account using the [Radar](https://docs.stripe.com/radar/account-fraud-prevention.md) tools. See the list of [available actions](https://docs.stripe.com/radar/account-fraud-prevention.md#take-action).