# Fraudulent website signal

Evaluate a connected account's website for deception or policy violations.

The fraudulent website signal evaluates whether a connected account’s website is deceptive or violates policy. This includes websites for accounts that don’t exist yet on Stripe.

## Request an evaluation

Use the [Account Evaluations API](https://docs.stripe.com/api/v2/core/account-evaluations.md) to trigger a fraudulent website evaluation on demand. You can evaluate an existing connected account or provide account data directly.

### Evaluate an existing account

You can evaluate a website for an existing account.

```curl
curl -X POST https://api.stripe.com/v2/core/account_evaluations \
  -H "Authorization: Bearer <<YOUR_SECRET_KEY>>" \
  -H "Stripe-Version: 2026-03-25.preview" \
  --json '{
    "account": "acct_123",
    "signals": [
        "fraudulent_website"
    ]
  }'
```

### Evaluate without an existing account

You can evaluate a website before creating a connected account by providing `account_data` with the business URL.

```curl
curl -X POST https://api.stripe.com/v2/core/account_evaluations \
  -H "Authorization: Bearer <<YOUR_SECRET_KEY>>" \
  -H "Stripe-Version: 2026-03-25.preview" \
  --json '{
    "account_data": {
        "defaults": {
            "profile": {
                "business_url": "https://example.com"
            }
        }
    },
    "signals": [
        "fraudulent_website"
    ]
  }'
```

## Webhook event 

The evaluation is asynchronous. Listen for `v2.core.account_signals.fraudulent_website_ready` event notifications when a website is evaluated. The event payload includes the following information:

| Field           | Description                                                                                                                                                                         |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `risk_level`    | The risk level for the website: `low`, `normal`, `elevated`, `highest`, or `unknown`.                                                                                               |
| `details`       | A plain description of issues found on the website, generated by LLM analysis. If the `risk_level` is `unknown`, the explanation includes why the evaluation couldn’t be completed. |
| `evaluation_id` | A unique identifier for the evaluation request.                                                                                                                                     |
| `signal_id`     | A unique identifier for the signal.                                                                                                                                                 |
| `evaluated_at`  | The timestamp of when the signal was evaluated.                                                                                                                                     |

> If the website URL is invalid or unreachable, the evaluation returns a risk level of `unknown` with an explanation of why the evaluation couldn’t be completed.

## Take action on connected accounts

You can respond to the fraudulent website signals that you receive for a connected account using the [Radar for Platforms](https://docs.stripe.com/radar/radar-for-platforms.md) tools. See the list of [available actions](https://docs.stripe.com/radar/account-risk-signals.md).