Fraud Prevention & Risk Management

Payment fraud patterns: card testing (bots validating stolen cards with small charges), stolen cards for goods, account takeover with saved payment methods, friendly fraud (customer disputes a legitimate purchase), and promo/refund abuse. Layer defenses: PSP risk scoring (e.g. Stripe Radar, Adyen RevenueProtect), 3DS for high-risk transactions (liability shift), velocity limits (cards per account, attempts per IP/device), CAPTCHA on unusual checkout bursts, manual review queues with manual capture, and good evidence collection (delivery confirmation, IP, device, logs) for disputes.

Fraud patterns

Python (velocity rules + review)

async def pre_payment_checks(account, ctx) -> Decision:
    if await limiter.count(f"cards_added:{account.id}", window=86400) > 3:
        return Decision.block("too_many_cards")
    if await limiter.count(f"declines:ip:{ctx.ip}", window=3600) > 5:
        return Decision.challenge("captcha")
    risk = await risk_model.score(account, ctx)                 # plus PSP risk score after auth
    if risk > 0.8:
        return Decision.review(capture_method="manual")         # authorize, review, then capture/void
    return Decision.allow()

Common pitfalls

• No limits on adding cards (card-testing haven).
• Blocking too aggressively (false declines lose revenue).
• No evidence collection for disputes.

Key points

• Layer PSP scoring, velocity rules and 3DS
• Manual review with manual capture
• Balance fraud loss vs false declines

Further reading: Stripe: Card testing