How to block fraudulent customers in Stripe

1// Radar evaluates every PaymentIntent automatically
2// Risk levels: normal, elevated, highest
3// Check a charge's risk assessment:
4const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
5
6async function checkRiskLevel(chargeId) {
7  const charge = await stripe.charges.retrieve(chargeId);
8  const outcome = charge.outcome;
9
10  console.log('Risk level:', outcome.risk_level); // normal, elevated, highest
11  console.log('Risk score:', outcome.risk_score); // 0-100
12  console.log('Seller message:', outcome.seller_message);
13  console.log('Type:', outcome.type); // authorized, blocked, manual_review
14}
15
16checkRiskLevel('ch_chargeId');

1// Example Radar rules (create these in Dashboard → Radar → Rules):
2//
3// Block payments from disposable email domains:
4//   Block if :email_domain: in ('mailinator.com', 'guerrillamail.com', 'tempmail.com')
5//
6// Block payments from specific countries:
7//   Block if :card_country: in ('XX', 'YY')
8//
9// Block payments over a threshold from new customers:
10//   Block if :is_new_customer: and :amount_in_usd: > 500
11//
12// Block if CVC check fails:
13//   Block if :cvc_check: = 'fail'
14//
15// Block if ZIP code does not match:
16//   Block if :zip_check: = 'fail' and :amount_in_usd: > 100
17
18console.log('Create these rules in Dashboard → Radar → Rules');

1// Add an email to the block list
2async function blockEmail(email) {
3  const rule = await stripe.radar.valueListItems.create({
4    value_list: 'rsl_blockedEmails', // Create this list first in Dashboard
5    value: email,
6  });
7  console.log('Blocked email:', rule.value);
8}
9
10// Add a card fingerprint to the block list
11async function blockCard(cardFingerprint) {
12  const rule = await stripe.radar.valueListItems.create({
13    value_list: 'rsl_blockedCards',
14    value: cardFingerprint,
15  });
16  console.log('Blocked card fingerprint:', rule.value);
17}
18
19// Create a value list first
20async function createBlockList() {
21  const list = await stripe.radar.valueLists.create({
22    alias: 'blocked_emails',
23    name: 'Blocked Emails',
24    item_type: 'email',
25  });
26  console.log('Block list created:', list.id);
27}
28
29createBlockList();

1const express = require('express');
2const app = express();
3
4app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
5  const sig = req.headers['stripe-signature'];
6  let event;
7  try {
8    event = stripe.webhooks.constructEvent(
9      req.body,
10      sig,
11      process.env.STRIPE_WEBHOOK_SECRET
12    );
13  } catch (err) {
14    return res.status(400).send(`Webhook Error: ${err.message}`);
15  }
16
17  if (event.type === 'charge.failed') {
18    const charge = event.data.object;
19    if (charge.outcome && charge.outcome.type === 'blocked') {
20      console.log('FRAUD BLOCKED:', {
21        chargeId: charge.id,
22        riskScore: charge.outcome.risk_score,
23        riskLevel: charge.outcome.risk_level,
24        reason: charge.outcome.reason,
25        email: charge.billing_details?.email,
26        ip: charge.metadata?.customer_ip,
27      });
28      // Log to your fraud monitoring system
29    }
30  }
31
32  res.json({ received: true });
33});
34
35app.listen(3000);