Stripe Radar Rule Library

Block if :seconds_since_last_authorization_charge_attempt: < 60

Why it works: Card-testing scripts retry the same card 5-10 times in seconds. Legitimate users rarely retry the same card within a minute — they switch cards or abandon. 60s is conservative enough to spare retries from genuine network errors.

Block if :total_charges_per_email_address_hourly: > 5

Why it works: One email address producing more than 5 charges per hour is almost certainly a scripted sign-up flow or a synthetic-identity ring. Caps multi-account fraud without affecting legitimate single-purchase users.

Block if :total_charges_per_ip_address_daily: > 10
   and :card_funding: != "credit"

Why it works: One IP making 10+ charges per day with debit/prepaid cards is a card-testing fingerprint. Excluding credit cards reduces false positives on shared corporate or household IPs.

Block if :risk_score: > 65
   and :card_country: != :ip_country:

Why it works: Combines Stripe's ML risk score with a hard signal of geographic mismatch. Each signal alone produces false positives; together they catch elevated risk only when geography also looks off — dramatically reducing FP rate vs. naive risk-score-only blocking.

3D Secure if :ip_country: in ("XX","YY","ZZ")
   or :card_country: in ("XX","YY","ZZ")

Why it works: Geography-targeted 3DS gating preserves checkout conversion on low-risk traffic (typically 90%+ of subscription app volume) while putting friction only on high-risk regions. Customize the country list to your observed dispute concentration — do not blanket-apply.

Block if :card_bin: in (your dispute-bin list)

Why it works: Maintain a list of card BINs that have produced 2+ chargebacks against your business in the prior 6 months. New transactions on those exact BINs have materially elevated dispute probability. Refresh the list monthly from your dispute reports.

Block if :risk_score: > 55
   and :amount: > 5000
   and :is_subscription: = false

Why it works: One-time credit-bundle purchases ($50+) sit in a different risk profile than subscription renewals. The default ML threshold is calibrated for subscriptions; lowering it on one-time high-value transactions catches stolen-card fraud that the default misses. Adjust the amount threshold to your bundle pricing.

Review if :risk_score: > 50
   and :is_first_charge_for_customer: = true

Why it works: First-charge events are riskier than renewals (no prior usage history to validate). Reviewing — not blocking — at a lowered threshold catches edge cases for manual evaluation while preserving conversion. Promote to Block only after observing the matched cohort.

3D Secure if :email_domain: in
  ("mailinator.com","tempmail.com","guerrillamail.com",
   "10minutemail.com","trashmail.com")

Why it works: Disposable-email domains correlate strongly with single-use sign-up fraud. Forcing 3DS — not blocking — preserves the ability for legitimate edge cases to authenticate while filtering scripted disposable-email abuse. Maintain the list manually or via an email-reputation API.

3D Secure if :risk_score: > 60
   and :is_subscription_renewal: = true

Why it works: Subscription renewals are usually frictionless by design, but elevated-risk renewals (likely stolen-card continued use) benefit from re-authentication. Targeted 3DS step-up here is materially cheaper than the eventual chargeback if the card was stolen.

3D Secure if :is_stripe_link_payment: = true
   and :is_first_charge_for_customer: = true

Why it works: Stripe Link's saved-credentials flow bypasses CVC/AVS validation, which is one of the silent fraud vectors many merchants miss. For first-charge customers, forcing 3DS on Link transactions restores authentication. Existing customers with usage history are exempt.

Review if :is_stripe_link_payment: = true
   and :ip_country: in (your high-risk country list)

Why it works: Stripe Link's frictionless flow concentrates fraud in geographies where Link-saved cards have lower likelihood of having been validated by the user recently. Reviewing — not blocking — preserves conversion while flagging the cohort for analysis.

Block if :customer_disputed_charges_count: > 0

Why it works: A customer who has disputed even one prior charge on your business has materially elevated probability of disputing again. Blocking new charges from these customers is the most direct prevention. Combine with manual refund workflow for legitimate edge cases.

Review if :amount: > 10000
   and :is_subscription: = false
   and :risk_score: > 40

Why it works: One-time $100+ purchases combined with moderate risk score (above 40, well below default 65 block) are exactly the dollar-value-disputable transactions that produce "unrecognized charge" friendly fraud. Manual review catches edge cases without blocking the legitimate majority.