Aturan pencegahan penipuan

Fraud prevention rules allow you to take action whenever a payment matches certain criteria. Stripe Radar provides built-in rules to help detect and protect you against fraud risk on card, ACH, and SEPA Direct Debit payments.

Radar for Fraud Teams and Radar for Platforms let you use the Dashboard to create custom rules based on the business logic specific to your business. For example, you can:

• Meminta 3D Secure (3DS) untuk semua pembayaran yang mendukungnya dan dibuat oleh pelanggan baru
• Mengizinkan semua pembayaran dari alamat IP pusat layanan pelanggan Anda
• Memblokir pembayaran yang dibuat dari suatu lokasi atau dari kartu yang diterbitkan dari luar negara Anda
• Review all payments greater than 1,000 USD that were made with a prepaid card
• Review and automatically pause payouts on accounts that have a high dispute rate (with Radar for Platforms)

Aturan bawaan

The following rules are available by default, unless flagged as custom rules, which are only available if you use Radar for Fraud Teams or Radar for Platforms.

Pemeriksaan risiko AI

All Radar offerings provide a set of default rules based on the judgments of our AI models.

Radar for Platforms has additional account-level AI models that are incorporated through two default rules:

Review if :account_risk_level: = 'highest'

Review if :account_risk_level: = 'elevated'

We calculate account-level risk using KYC information, transactions, geographic signals, and behavior patterns.

Pemeriksaan kartu tradisional

Pembayaran masih dapat berhasil bahkan bila pemeriksaan CVC atau alamat (AVS) gagal karena penerbit mengevaluasi banyak sinyal ketika memutuskan untuk mengotorisasi pembayaran. Penerbit kartu mungkin masih menganggap sah pembayaran yang gagal dalam verifikasi CVC atau kode pos, sehingga menyetujuinya.

Anda dapat mengaktifkan aturan bawaan Radar untuk memblokir pembayaran tertentu yang disetujui oleh penerbit kartu. Bila diaktifkan, aturan ini juga memengaruhi pelampiran kartu ke pelanggan, serta pembuatan pelanggan, jika Anda membuat kartu dan pelanggan bersama-sama.

Aturan bawaan untuk meminta 3D Secure

3D Secure (3DS) prompts customers to complete an additional authentication step before they can complete the purchase flow. If 3DS authenticates a payment, the liability for any fraud-related disputes for that payment typically shifts from the seller to the issuer. This means that in most cases, the seller isn’t responsible for fraud costs on 3DS authenticated payments.

Stripe automatically handles soft decline codes indicating that 3DS is required by issuers. We also trigger 3DS when necessary, adhering to regulations, such as the Strong Customer Authentication (SCA) mandated by the PSD2. Disabling Radar doesn’t prevent 3DS from being triggered in cases where it’s necessary.

Stripe supports three legacy built-in rules to request 3DS when using Radar with Payment Intents or SetupIntents:

Karena 3DS mengharuskan pelanggan Anda untuk melewati lapisan autentikasi tambahan, penggunaan 3DS secara sembarangan dapat menurunkan rasio konversi.

Requesting 3DS doesn’t necessarily mean the issuer actually performs 3DS. Learn more about possible outcomes.

Aturan khusus untuk meminta 3D Secure dan bertindak berdasarkan hasil tertentu

Setelah mencoba autentikasi 3DS, jika Anda memiliki Radar for Fraud Teams atau Radar for Platforms, Anda dapat mengevaluasi hasilnya dalam aturan izinkan, blokir, atau tinjau.

See below for the most important attributes for custom Radar rules.

For custom rules, we recommend keeping Request 3DS and Block rules aligned depending on your risk appetite. However, don’t block payments where 3DS isn’t supported, such as from some wallets.

See below for some examples that show how to achieve this for different use cases.

Minta 3D Secure berdasarkan tingkat risiko Radar

You want to use Radar to request 3DS on all payments, based on the risk level and that are above a certain amount.

In this case, without a block rule, cards or wallets that don’t support 3DS aren’t blocked. 3DS attempts that failed authentication don’t continue to charge authorization.

Selalu wajibkan 3D Secure berdasarkan tingkat risiko Radar

You want to use Radar to request 3DS on all payments, based on an elevated or high risk level and that are above a certain amount. You don’t want to support cards that don’t support 3DS.

Only accept fully 3D Secure authenticated payments if 3D Secure is supported

You rely on Stripe activating 3DS when necessary in cases such as Strong Customer Authentication (SCA), but don’t want to accept edge cases, such as processing errors.

Request 3D Secure based on metadata

You want to use Radar to request 3DS on all payments with a custom metadata attribute.

In this case, without a block rule, we don’t block cards or wallets that don’t support 3DS. 3DS attempts that failed authentication don’t continue to charge authorization.

Always require 3D Secure based on metadata

You want to use Radar to request 3DS on all payments with a custom metadata attribute and block cards that don’t support it.

Minta 3D Secure untuk semua kartu baru dan tinjau apakah 3D Secure tidak didukung

You want to use Radar to request 3DS on all new cards and manually review payments from cards that don’t support 3DS.

In this case, without a block rule, we don’t block cards or wallets that don’t support 3DS. 3DS attempts that failed authentication don’t continue to charge authorization.

Selalu wajibkan 3D Secure untuk sejumlah negara penerbit tertentu

You want to use Radar to request 3DS on all payments from card issuers originating from countries on a custom list and block the cards that don’t support it.

Selalu wajibkan 3D Secure berdasarkan tingkat risiko Radar dan tinjau kasus unik

You want to use Radar to request 3DS on all payments based on the risk level, and block cards that don’t support 3DS, but manually review edge cases.

Create rules

The Stripe default rules can block a substantial number of fraudulent payments. Businesses that need more control over which payments they want to review, allow, or block can write custom rules through Radar for Fraud Teams. Platforms can write custom rules through Radar for Platforms to calibrate payments risk for their platform and connected accounts and apply account-specific rules.

Pertimbangkanlah hal berikut saat mengambil keputusan apakah akan mengaktifkan aturan custom:

• If you see certain features or user behaviors as more risky (for example, using a disposable email).
• If you want to implement rules based on the payment method (for example, automatically blocking SEPA Direct Debit payments that exceed a certain risk score).
• If you want to implement rules based on payment amounts or perceived risk level (for example, automatically review if the payment is over 500 USD, automatically allow if the payment is under 5 USD).
• If your existing disputed and refunded payments share any common patterns (for example, similar amounts, card types, or countries).
• If you have existing rules you want to migrate to Stripe. The Stripe AI model might already cover many of these rules, and you can check how our system performs for your business before customizing it.
• If you want to automatically raise reviews and optionally pause payouts on accounts. This applies to platforms only.

Create effective rules

While rules can help you automate your existing workflows, they can also negatively affect your business if used incorrectly. For example, a rule can automatically allow a large number of elevated or high-risk payments or block a large number of legitimate payments, if it isn’t set up properly.

Remember the following when setting up rules:

• Secara default, aturan berlaku untuk semua metode pembayaran yang didukung Radar kecuali Anda menentukan metode pembayaran tertentu dalam predikat aturan menggunakan atribut payment_method_type.
• Rules only apply to future payments and don’t apply to any that you already processed.
• Aturan Minta 3DS hanya berlaku ketika menggunakan Stripe Checkout, Payment Intents, atau Setup Intents, dan dievaluasi sebelum aturan tinjauan, blokir, atau izinkan.
• Before implementing any block rule to block all payments or pause payouts for accounts that meet its criteria, consider whether you’d rather review the payments or accounts first.
• Implement any allow rules minimally, because they override the Stripe default rules, along with any other custom rules that match the same criteria.
• Anda dapat membuat maksimal 200 aturan transaksi dan 100 aturan akun.

Bangun aturan transaksi

You can add and manage rules from the Radar Rules page in the Dashboard.

To add a transaction rule

1. Klik + Tambahkan aturan.
2. Select the rule type.
3. Di editor aturan, buat aturan menggunakan sintaks {action} if {attribute} {operator} {value} dengan:
   • {action}: is how Radar responds when the rule criteria is met. This value is pre-populated based on the rule type you selected.
   • {attribute}: is the element of the payment to evaluate, such as the amount or card type. Begin typing with : to open a list of valid attributes. You can also evaluate your custom metadata by enclosing it in double colons, for example, ::product_sku::.
   • {operator}: is how to compare the attribute to the value, such as =, >, !=, and so on.
   • {value}: is the value of the attribute to evaluate.
4. Klik Coba aturan.
5. Perbaiki kesalahan validasi yang terdeteksi, jika perlu.
6. On the Review new rule page, review how this rule performs against your recent payments to confirm whether you want to enable it. If the rule might impact payments from more than one payment method, use the filter to view rule performance by payment method (for example, ACH or Cards).
7. Click Add rule to apply this rule to all future transactions.

Gunakan Radar Assistant

The Stripe rule editor has a built-in LLM assistant that constructs a Radar transaction rule from a natural language prompt. Learn more about Stripe AI services.

To use Radar Assistant

1. On the Radar Rules page, click + Add rule.
2. Select the rule type.
3. Di editor aturan, klik Radar Assistant.
4. In the message field, enter your rule request. You might ask to:
   • Tinjau pembayaran dengan negara kartu dan IP yang berbeda.
   • Blokir pembayaran kartu Discover yang lebih dari $1000.
   • Izinkan pembayaran dari alamat email stripe.com.
5. When the Assistant returns its suggestion, you can either enter an additional command to make adjustments to the rule, or you can click Test rule to see how the rule performs against your recent transaction history.
6. When you’re satisfied with the rule, click Add rule to enable it for all future transactions.

Aturan tinjauan

Stripe still processes payments normally when they match a review rule’s criteria. We add these payments to your review queue so your team can review them more closely. Setting up a rule that’s too broad can result in too many payments placed in your review queue, slowing down your customers and burdening your review team.

The Stripe rule testing interface runs a simulation on the last 6 months of charges to determine how many legitimate, fraudulent, and blocked payments would have been affected by the rule, had it been implemented. While testing a rule and examining the last 6 months, make sure that:

• Overall volume of payments is low. Reviewing these payments shouldn’t create a burden for your team.
• Human reviewers add value. A human reviewer can generally identify an elevated or high-risk payment with greater confidence than the automated system.
• The rule results in a mix of successful and refunded or disputed payments. This means that additional inspection on these types of payments can help separate legitimate payments from fraudulent payments.

Berikut adalah contoh cara menyempurnakan aturan tinjauan yang dibuat oleh bisnis yang ingin meninjau kartu kredit prabayar.

Aturan blokir

You can use block rules to block payments that you’re confident are fraudulent, or based on any restrictions your business has in place (such as blocking payments from prepaid cards). If you’re not sure how to apply block rules, we recommend using a review rule to place payments in review. After reviewing these payments for potential false positives, you can confirm whether you want to create a block rule instead.

Aturan blokir hanya berdampak pada pembayaran penipuan dan pembayaran yang berhasil, karena pembayaran yang terblokir tidak terpengaruh. Saat mencoba aturan, pastikan bahwa Anda:

• Menjaga positif palsu serendah-rendahnya. Selama percobaan, Stripe mengidentifikasi jumlah pembayaran yang berhasil dan bersengketa yang akan disaring oleh aturan. Aturan blokir yang baik secara signifikan akan lebih banyak memblokir pembayaran penipuan daripada pembayaran yang sah.
• Minimize unnecessary rules. If your rule appears to perform well but is already covered by an existing rule, your newer rule might not be necessary. Similarly, if the results during testing appear to be mixed, consider setting up a review rule instead so you can gather more information about those types of payments.

The following is an example of how to improve a block rule created by a business that has a high level fraud from payments outside the US.

Aturan izinkan

Aturan izinkan mengesampingkan semua aturan Anda lainnya, jadi gunakanlah secara hati-hati. Banyak bisnis mungkin tidak perlu mengimplementasikan aturan izinkan. Jika Anda memiliki persoalan, yaitu aturan izinkan tidak sedikit pun menjaring pembayaran penipuan, pertimbangkanlah untuk melakukan penyesuaian guna membatasi aturan ini lebih lanjut sebelum mengimplementasikannya.

Aturan izinkan diterapkan pada semua pembayaran yang baru segera setelah aturan itu dibuat. Ini termasuk setiap pembayaran yang serupa dengan pembayaran sebelumnya yang telah diblokir. Saat mencoba aturan, pastikan bahwa Anda:

• Examine the number of previously blocked payments that would have been allowed. Allow rules override all other rules and Stripe’s risk assessment. When testing a new allow rule, all payments shown would have been allowed if this rule were active. This can include payments that had been blocked or disputed, impacting your future dispute rates.
• Continue to block any high-risk payments. Block high-risk payments by adding the following to any allow rule: and :risk_level: != 'highest'
• Evaluasi riwayat transaksi yang sah di bisnis Anda. Anda dapat menganalisis koneksi antarpelanggan Anda sendiri untuk mengizinkan volume transaksi yang lebih tinggi berdasarkan riwayat pembelian yang sah. Hal ini membantu Anda memblokir lebih sedikit pembayaran dari pelanggan dengan riwayat yang telah terbukti di bisnis Anda. Untuk melakukannya, tinjau daftar atribut dan cari atribut yang berisi kata “customer”.

The following is an example of how to improve an allow rule for a business that generally (but not always) sees legitimate payments coming from customers in the UK:

Maintain your rules

As your business continues to grow, make sure your rules continue to reflect the types of customers that you want to do business with. The following are some best practices to keep rules current for the state of your business.

Regularly monitor rules to make sure they’re still effective

Metrik aturan

Pola penipuan terus berubah, jadi kami menyediakan metrik untuk menunjukkan cara kerja aturan ini. Metrik ini bervariasi menurut tipe aturan, karena tipe aturan melakukan tindakan yang berbeda.

Use the rule performance chart to understand the behavior of your Radar rules. Look for unexpected spikes or declines in the number of payments matching your rules, such as allow rules letting through too many payments or block rules blocking too many. These spikes might indicate a change in the types of payments your business receives or that might necessitate updates to the rules.

Color-coded lines track the number of payments that match 3DS rules, allow rules, block rules, and review rules. Updated rules are displayed as triangular symbols on the graph lines, and can help you compare the impact of a change before and after you make it.

Click the overflow menu () to view additional commands for any rule, including Disable, Enable, Edit or Delete.

You can also use our reporting products, Sigma and Data Pipelines, to query disputes and fraud data, including rule decisions and attributes for each individual payment.

Lakukan evaluasi keefektifan aturan

You can find information about the effectiveness of your rules and see how many payments each rule has affected. You can also view and download a filtered list of every payment that a rule has been applied to.

Review the sample questions in the following table to help you decide if you need to make changes to any rules or remove them entirely.

Request 3DS rules

For request 3DS rules, we display 3DS Requested, which is the number of times a rule triggered a 3DS request. You can click a 3DS rule to see the following metrics.

Aturan izinkan

If you use Radar for Fraud Teams, you can view the following allow rules:

• Allowed payments: The total number of payments allowed by your rules.
• Volume, allowed payments: The total amount, in your local currency, associated with payments allowed by your rules.
• Risk score: The corresponding risk outcomes assigned by our AI models to the set of payments allowed by your rules.
• Disputes from overrides: The total number of allowed payments that were disputed.
• Volume, disputes from overrides: The total amount, in your local currency, associated with disputes from allowed payments.

Select an allow rule to see the following metrics:

Aturan blokir

You can view the following block rules:

• Blocked payments: The total number of payments blocked by your rules.
• Volume, blocked payments: The total amount, in your local currency, associated with payments blocked by your rules.

If you use Radar for Fraud Teams, you can also view the following:

• Risk score: The corresponding risk outcomes assigned by our AI models to the set of payments allowed by your rules.
• Est. false positive rate: The estimated percentage of non-fraudulent payments that were blocked for both your block rules as a set and by individual rules. These estimates are made using the estimated false positive rates of the corresponding AI risk scores, which we calculate with experiments across the Stripe network.
• Est. fraudulent payments prevented: The estimated number of fraudulent payments that your block rules prevented. Stripe uses AI risk scores, calculated by analyzing millions of transactions across the Stripe network, to predict payments with a high probability of being disputed or declined because of fraud, and estimate which of those payments were successfully blocked by your rules.

Select a block rule to see the following metrics:

Aturan tinjau

If you use Radar for Fraud Teams, you can view the following review rules:

• Payments sent to review: The total number of payments sent to manual review by your rules.
• Volume, approved reviews: The total amount, in your local currency, associated with approved payment reviews.
• Refund rate: The percentage of reviews that were refunded.
• Disputes from approved reviews: The total number of payments approved in your review, but were ultimately disputed.
• Volume, disputes from approved reviews: The total amount, in your local currency, associated with disputes from approved payment reviews.

Select a review rule to see the following metrics:

Lihat Riwayat Aturan

Anda dapat meninjau riwayat perubahan yang dilakukan terhadap aturan Radar. Jejak audit ini membantu memahami kapan suatu aturan dibuat, disunting, diaktifkan, dinonaktifkan, serta oleh pengguna mana dalam tim.

To see the activity for a specific rule, go to the Rules tab on the Radar page and click the name of the rule.

Log Aktivitas Aturan menampilkan ringkasan semua modifikasi. Klik kejadian tertentu untuk melihat detail selengkapnya, seperti predikat aturan lengkap sebelum dan sesudah pembaruan. Anda hanya dapat melihat perubahan aturan selama 180 hari terakhir.

Meninjau aktivitas ini secara rutin dapat membantu Anda mengaitkan perubahan aturan dengan dampaknya terhadap bisnis.

Regularly monitor your manual review queue

If your review queue is too large to manage, make sure you have the correct rules in place. If most reviews result in a refund because of fraud, consider additional rules to block payments. If most payments are approved, consider making your review rules more focused.

Menganalisis pembayaran yang disengketakan dan dikembalikan dananya

Disputes are inherently linked to fraud, so the more you do to reduce fraud, the lower your dispute rate. Check to see if disputed payments share any similar characteristics (for example, from the same locations or of similar amounts). You can also perform this type of investigation by looking at payments that were refunded during a review. If you see trends, you can test and create the appropriate rules. If any payments appear to be fraudulent, refund and report them as fraud to avoid potential disputes.

Anda juga dapat menggunakan produk pelaporan kami Sigma dan Data Pipeline, untuk data penipuan dan sengketa query.

Anda dapat merespons setiap sengketa yang masuk menggunakan Dashboard atau melalui API, dan dokumentasi sengketa kami akan menyertakan beberapa saran tentang cara menyajikan kasus yang terdokumentasikan dengan baik.

Anticipate large changes to your business that might impact your fraud rate

If you’re planning any major product releases or changes to your service (for example, a new, high-value product or expanding your service into new countries), you might want to monitor these payments in the beginning. For these kinds of changes, it’s a good practice to set up some review rules so you can examine any new payments. Reviewing these payments and identifying patterns can help you set up new rules to help protect your business from fraud.

Aturan mendukung beberapa metode pembayaran New

By default, Radar rules screen payments for cards, ACH, and SEPA Direct Debits for most users. We support the high risk block rule for all of these payment methods. If you use Radar for Fraud Teams or Radar for Platforms, we also support custom rules using the :payment_method_type: attribute to write rules that apply only to specific payment methods, for example: Block if :payment_method_type: = 'us_bank_account'. Learn more about supported attributes.

Bangun aturan akun

With Radar for Platforms, you can also add and manage account rules from the Rules tab on the Radar page in the Dashboard.

To add an account rule

1. Klik + Tambahkan aturan.
2. Select the rule type: Review or Payout pause (which raises a review AND payout pause).
3. Di editor aturan, buat aturan menggunakan sintaks {action} if {attribute} {operator} {value} dengan:
   • {action}: is how Radar responds when the rule criteria is met. This value is pre-populated based on the rule type you selected.
   • {attribute}: is the element of the payment to evaluate, such as the amount or card type. Begin typing with : to open a list of valid attributes.
   • {operator}: is how to compare the attribute to the value, such as =, >, !=, and so on.
   • {value}: is the value of the attribute to evaluate.
4. Klik Coba aturan.
5. Perbaiki kesalahan validasi yang terdeteksi, jika perlu.
6. On the Review new rule page, view the accounts that would match this rule today to confirm whether you want to enable it.
7. Click Activate rule to apply this rule to all existing and future accounts.

Testing account-level rules takes longer than transaction testing, however we recommend testing to avoid unintentionally raising accounts for review or pausing automatic payouts. First, test raising accounts for review behavior. Then, test automatic payout pauses after you’re confident the rule impacts accounts as expected.