How to check fraud risk in Stripe payments

1const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
2
3async function getRiskAssessment(chargeId) {
4  const charge = await stripe.charges.retrieve(chargeId);
5  const outcome = charge.outcome;
6
7  console.log('Risk score:', outcome.risk_score); // 0-100
8  console.log('Risk level:', outcome.risk_level); // normal, elevated, highest
9  console.log('Type:', outcome.type); // authorized, blocked, manual_review
10  console.log('Reason:', outcome.reason); // rule match or null
11  console.log('Seller message:', outcome.seller_message);
12
13  return outcome;
14}
15
16getRiskAssessment('ch_chargeId');

1async function getVerificationDetails(chargeId) {
2  const charge = await stripe.charges.retrieve(chargeId);
3  const checks = charge.payment_method_details?.card?.checks;
4
5  if (checks) {
6    console.log('CVC check:', checks.cvc_check); // pass, fail, unavailable, unchecked
7    console.log('Address line 1:', checks.address_line1_check);
8    console.log('ZIP check:', checks.address_postal_code_check);
9  }
10
11  // Flag suspicious combinations
12  const suspicious =
13    checks?.cvc_check === 'fail' ||
14    (checks?.address_postal_code_check === 'fail' && charge.amount > 10000);
15
16  if (suspicious) {
17    console.log('WARNING: Suspicious verification results');
18  }
19
20  return checks;
21}
22
23getVerificationDetails('ch_chargeId');

1const express = require('express');
2const app = express();
3app.use(express.json());
4
5app.get('/api/fraud/recent', async (req, res) => {
6  try {
7    const charges = await stripe.charges.list({
8      limit: 50,
9      created: {
10        gte: Math.floor(Date.now() / 1000) - 86400, // Last 24 hours
11      },
12    });
13
14    const riskReport = charges.data.map(charge => ({
15      id: charge.id,
16      amount: charge.amount,
17      currency: charge.currency,
18      status: charge.status,
19      riskScore: charge.outcome?.risk_score,
20      riskLevel: charge.outcome?.risk_level,
21      outcomeType: charge.outcome?.type,
22      cvcCheck: charge.payment_method_details?.card?.checks?.cvc_check,
23      zipCheck: charge.payment_method_details?.card?.checks?.address_postal_code_check,
24      email: charge.billing_details?.email,
25      country: charge.payment_method_details?.card?.country,
26      created: new Date(charge.created * 1000).toISOString(),
27    }));
28
29    // Sort by risk score descending
30    riskReport.sort((a, b) => (b.riskScore || 0) - (a.riskScore || 0));
31
32    res.json({
33      total: riskReport.length,
34      highRisk: riskReport.filter(r => r.riskLevel === 'highest').length,
35      elevated: riskReport.filter(r => r.riskLevel === 'elevated').length,
36      charges: riskReport,
37    });
38  } catch (err) {
39    res.status(400).json({ error: err.message });
40  }
41});
42
43app.listen(3000);

1app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
2  const sig = req.headers['stripe-signature'];
3  let event;
4  try {
5    event = stripe.webhooks.constructEvent(
6      req.body,
7      sig,
8      process.env.STRIPE_WEBHOOK_SECRET
9    );
10  } catch (err) {
11    return res.status(400).send(`Webhook Error: ${err.message}`);
12  }
13
14  switch (event.type) {
15    case 'charge.succeeded': {
16      const charge = event.data.object;
17      if (charge.outcome?.risk_level === 'elevated' ||
18          charge.outcome?.risk_level === 'highest') {
19        console.log(`HIGH RISK PAYMENT: ${charge.id}`);
20        console.log(`Score: ${charge.outcome.risk_score}`);
21        console.log(`Amount: ${charge.amount} ${charge.currency}`);
22        // Send Slack/email alert to your fraud team
23      }
24      break;
25    }
26    case 'radar.early_fraud_warning.created': {
27      const warning = event.data.object;
28      console.log(`EARLY FRAUD WARNING: charge ${warning.charge}`);
29      console.log(`Fraud type: ${warning.fraud_type}`);
30      // Immediately review or refund the charge
31      break;
32    }
33    case 'review.opened': {
34      console.log('Manual review opened:', event.data.object.charge);
35      break;
36    }
37  }
38
39  res.json({ received: true });
40});