Stripe Radar Rules for Small Stores: Settings That Stop Fraud

On this page 7 sections

1. Stripe Radar Settings: What Radar Does by Default and What It Leaves to You
2. Stripe's Paid Radar Tier: Is the Upgrade Worth It?
3. Stripe Radar Rules Every Store Should Start With: Block, Review and Allow
4. Using Lists for Emails, Cards, IPs and Countries
5. Testing Stripe Radar Rules on Past Orders Before Going Live
6. Reviewing Flagged Payments Fast
7. Next Steps for Your Store

Key takeaways

• Radar's default protection stops the riskiest payments, but you have to tune everything between "highest risk" and "normal."
• Start strict cases as review rules rather than block rules. Promote a rule to block only after the queue shows it catches fraud.
• Lists and allow rules are powerful but can override protections, so keep their scope narrow and give them an owner.
• Check every new rule against past payments before it goes live, and hold shipment on flagged orders until someone reviews them.

If your store runs on Stripe, Stripe Radar rules decide which payments go through, which get blocked and which wait for a person to review them. The defaults protect against the worst fraud, but they don't know your products, your customers or your margins.

This guide covers:

• What Radar does on its own
• When Stripe's paid Radar tier may be worth it
• A starter set of block, review and allow rules
• How to use lists
• How to test rules on past orders
• How to work the review queue without slowing down good orders

Check your own account before you copy any rule. Stripe changes Radar's features, attribute names, packaging and pricing over time. The rule examples below follow the general pattern of Radar's rule language. Confirm the exact attribute names and options in the rule editor in your Stripe Dashboard and in Stripe's documentation, and check current pricing on Stripe's site before you buy anything.

Stripe Radar Settings: What Radar Does by Default and What It Leaves to You

Radar's core protection screens card payments using machine learning and assigns each payment a risk evaluation. In the Dashboard this generally appears as a risk level such as normal, elevated or highest. Depending on your account, you may also see a numeric score.

Out of the box, Radar generally:

• Blocks payments it rates highest risk
• Lets lower-risk payments through
• Offers built-in rules for failed CVC or postal code checks, which you may be able to turn on or off

That leaves several decisions to you:

• Elevated-risk payments. By default these usually go through. For a small store, this middle band is often where the fraud you actually see comes from.
• Your business context. Radar doesn't know that an order of several phone chargers shipped to a freight forwarder is unusual for your candle shop.
• Repeat offenders. After you confirm a fraudulent email, card or device, keeping it out is your job.
• Customer friction. Every rule that blocks good buyers costs you a sale. If legitimate cards are already failing at your checkout, read our guide to false declines at ecommerce checkout before you tighten anything.

Stripe's Paid Radar Tier: Is the Upgrade Worth It?

Stripe offers a paid Radar tier aimed at businesses that want more control. The feature split between the free and paid tiers changes, so compare the current versions on Stripe's site. Advanced tiers of fraud tools like this commonly add:

• Custom rules beyond the built-in defaults
• A manual review queue
• More visibility into risk scores and finer control over thresholds
• Backtesting, which shows how a rule would have performed on past payments
• More list management and reporting

Pricing depends on your Stripe plan. Check current pricing in your account or on Stripe's site.

A Simple Way to Decide

The upgrade pays off only if someone works the review queue. Custom review rules with no reviewer just delay good orders.

Stripe Radar Rules Every Store Should Start With: Block, Review and Allow

Radar rules follow a plain pattern. Each rule pairs an action, such as Block, Review, Allow or a request for 3D Secure authentication, with a condition.

When several rules match one payment, the order in which Stripe evaluates them decides which rule wins. Read Stripe's rules documentation for the current evaluation order before you rely on an allow rule to override a block.

Stripe Block Rules: Keep Them Few and Certain

Block only what you're confident is fraud. A blocked customer rarely tries again.

• Block if :risk_level: = 'highest': matches the default behavior. Leave it on.
• Block if :card_fingerprint: in @blocked_cards: cards you've confirmed as fraudulent.
• Block if :email: in @blocked_emails: emails tied to confirmed fraud.
• A velocity rule aimed at card testing, such as blocking when one IP address attempts many charges in a short window. Velocity attribute names vary, so choose them from the editor's autocomplete.

Turning on the built-in CVC-failure block is usually reasonable for a physical-goods store. Be more careful with postal code failures. Customers who have moved, made a typo or use a card issued abroad can fail that check legitimately.

Review Rules: Where Small Stores Get the Most Value

A review rule sends a payment to the queue instead of rejecting it. The charge typically still goes through, and you decide whether to fulfill the order or refund it.

Illustrative starter set:

• Review if :risk_level: = 'elevated'
• Review if :ip_country: != :card_country:
• Review if :billing_address_country: != :shipping_address_country:
• Review if :is_anonymous_ip: = true
• Review if :amount_in_usd: > 300 (illustrative: start at roughly two to three times your normal order size)

Setting a Stripe Risk Score Threshold

If your account shows a numeric risk score, you can review payments at the upper end of "normal" instead of relying only on the elevated label. Pair the score with order value so you aren't reviewing every small order.

Illustrative example: Review if :risk_score: > 50 and :amount_in_usd: > 150

These numbers are placeholders. Set your threshold by backtesting, covered below, not by guessing.

Allow Rules and 3D Secure

Allow rules let trusted payments skip your other rules, so a mistake here can switch off your protection. Keep them narrow, for example Allow if :email: in @verified_wholesale_buyers. Avoid broad conditions such as allowing an entire country or email domain.

Requesting 3D Secure is often a better middle ground than blocking. It asks the cardholder to authenticate with their bank. Depending on card network rules, that can shift liability for certain fraud disputes away from you.

Illustrative: Request 3D Secure if :risk_level: = 'elevated'

For more on how authentication works, see our overview of 3D Secure authentication.

Using Lists for Emails, Cards, IPs and Countries

Lists let you add or remove values without rewriting a rule. Radar generally includes basic block and allow lists, and tiers that support custom lists let you build your own.

Habits that keep lists useful:

1. Add entries for a reason. Note which order or dispute led to each one.
2. Prefer review over block for IP and country lists.
3. Clean up regularly. Remove IP entries after an attack ends.
4. Assign an owner. One person decides what goes on the allow list.

Testing Stripe Radar Rules on Past Orders Before Going Live

A rule that looks sensible can catch far more good orders than you expect. Test it before you switch it on.

1. Draft the rule in the Radar rule editor.
2. Run a backtest if your tier supports it. Check how many past payments would have matched and how many of those later became fraud disputes or fraud warnings from card issuers.
3. Read the ratio. Illustrative: a rule that matched 200 past payments, of which 2 were fraud, would have flagged 198 good customers. That might be workable as a review rule. As a block rule it would be costly.
4. Launch it as a review rule first and watch the queue for a few weeks.
5. Promote it to a block rule only if nearly everything it catches is fraud.
6. Log every change with the date and the reason, so you can trace a jump in declines to its cause.

If you can't backtest, use step 4 as your test. Run the rule in review mode and count what it catches before you trust it to block.

Retest before predictable volume changes. A holiday sale or an influencer mention can trip velocity and amount rules on legitimate traffic. It also helps to tell your payment provider ahead of time. See our guide to warning your processor before a sales spike.

Reviewing Flagged Payments Fast

A review queue only works if it keeps moving. Check it at least once a day, and hold fulfillment on flagged orders until someone makes a decision.

What to Check on Each Flagged Order

• Customer history. Has this buyer ordered before without problems?
• Address logic. Does the shipping address make sense next to the billing address? Is it a known freight forwarder or reshipper?
• Order pattern. Watch for several units of one easily resold item, rush shipping on a first order, or multiple cards tried before one worked.
• Contact details. Do the email, phone number and name plausibly belong to the same person?
• Radar's explanation. Read the factors Radar shows behind its risk evaluation.

How to Decide

• Looks legitimate: approve and ship. If the same pattern keeps showing up in good orders, loosen the rule.
• Unsure: contact the customer using the details they provided and ask them to confirm the order. Don't ship until they do.
• Looks fraudulent: refund promptly and add the card or email to a block list. A timely refund on a suspected fraud order generally costs less than a dispute. Confirm in your account or with Stripe how refunds interact with disputes and issuer fraud warnings.

Write down the reason for each decision. Over time, those notes show you which rules work and which ones only create noise.

Next Steps for Your Store

Start small:

1. Keep the default block on the highest-risk payments.
2. Add a handful of review rules.
3. Test each rule against past payments, or in review mode if you can't backtest.
4. Promote to block only what proves itself in the queue.

Revisit your rules after every dispute and before every big promotion.

If you're also weighing whether to stay on Stripe or move to a dedicated merchant account, our ecommerce payment processing guide walks through the options. MannyPay supports online payment processing for low-risk ecommerce stores, with gateway options such as Authorize.net and NMI and 3-D Secure authentication. To compare your options, request a free quote, and a MannyPay specialist will respond within one business day.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.