Stripe is a payment processor

Stripe is a payment processor and not a digital wallet. When choosing a payment processor, you’ll be responsible for fraud prevention, for the charges you choose to accept and the costs incurred by fraud. You need to assess the risk of each payment to your business.

• A digital wallet is a payment method, like a debit or credit card. Vendors like Paypal and MercadoPago offer digital wallets in addition to payment processing.

• A payment gateway or payment processor such as Stripe, on the other hand, works as a channel for the payment transaction between the buyer's payment method (which may be a credit or debit card from an issuing bank) and the seller.

In terms of fraud and dispute prevention, with digital wallets buyers are known, so there’s less chance of fraud and thus less disputes raised by fraud issues. Payment processing is not the same as dedicated fraud protection -- although we have anti-fraud tools and we try to eliminate risky transactions without blocking legitimate charges, there is simply no algorithm that can be as effective as manual order review by the merchant.

In other words, if you choose Stripe to process charges, you’ll be responsible for the charges you choose to accept and the costs incurred by fraud, so you need to assess the risk of each payment to your business. Stripe will not be able to guarantee that a payment is not fraudulent, we can only confirm that a charge was successful or unsuccessful, which does not guarantee its legitimacy. The type of fraud attack will depend on the type of business, and for that reason the business owner must be aware of suspicious payments and manage the protection of their Stripe account.

If you think a charge may be fraudulent, please note that we generally recommend that users refund suspicious-looking payments before they become disputes to avoid going through the entire dispute process. Also, keep in mind that when you process refunds to your customers, Stripe does not charge additional fees, but will retain the fees associated with the original transaction.

In this link you’ll find the most common types of fraud indicators to get started:

https://stripe.com/docs/disputes/prevention/identifying-fraud#common-types-of-fraud-indicators

---

Understanding the Dispute Process

What are disputes?

If you accept credit cards on your site or store, you'll most likely have to handle chargebacks or inquiries. When a customer has an issue with a credit card charge, they can dispute it with their bank. The bank will initiate a dispute process with either an inquiry or a chargeback.

When a customer disputes a payment, the bank will discount both the payment and dispute amount from your Stripe balance. Stripe is not liable for dispute fees, and these are only returned to your balance if you win the dispute. Regardless of the type of dispute, it’s extremely important that you submit evidence within the deadline when you received a dispute.

You can read more about disputes and how they work here:

https://stripe.com/docs/disputes/how-disputes-work

Where can I see my disputes in the Dashboard?

You can see all disputed payments in your dashboard under Payments>Disputes:

https://dashboard.stripe.com/disputes

How the dispute process works in Mexico

Disputes work differently across card and payment networks, but typically follow similar patterns. The dispute process involves multiple parties and many steps.

Differently from other countries, in Mexico Visa and Mastercard rules on disputes are not applied (only for international payments). Instead, these rules are set by the Bank of Mexico and CNBV, and enforced by Mexican acquirers and card issuers. This makes the dispute process less predictable than in other countries, which makes it more difficult to win a dispute in Mexico.

Fraud is also very common in Mexico and represents a high risk to merchants getting started with online payments. This is even more important for businesses on high-risk segments, who should take extra attention to their anti-fraud approach. The segments are typically electronics, fashion, jewellery (anything with high resale value is a potential target for fraud).

For this reason, we strongly recommend merchants in Mexico to invest in the prevention of fraud and disputes by following our best practices:

https://support.stripe.com/questions/checklist-to-prevent-disputes-and-fraud-in-mexico

Dispute life cycle and the importance of submitting evidence

When a cardholder issues a dispute, the bank will notify Stripe and, as we are legally required to do so, the bank withdraws the disputed amount plus the bank's MXN $ 150.00 fee for managing the case. Stripe is not liable for dispute and chargeback fees, these are discounted by the bank and only returned to the merchant if the dispute is won on their behalf. This amount will be discounted from your balance and funds passed on to the bank, that will hold them until a resolution is reached.

Once the chargeback is created, you have a limited amount of time (usually 7–21 days) to respond with evidence that the charge was legitimate. The time given varies depending on the card network. If you do not submit evidence by the time the deadline passes, the cardholder wins the dispute and keeps the funds. That’s why it’s extremely important that you submit evidence within the deadline when you received a dispute.

Submitting evidence to disputes

At Stripe, we go beyond to help you submit evidence to disputes and advise users on how to respond or accept disputes. Our role is to assist with the submission of evidence and notify the bank of updates. It’s important to note that the dispute process is fully handled by the cardholder’s bank, and Stripe doesn’t participate in the decision of whether a dispute is valid or not.

If you submit evidence, it is sent to the cardholder’s bank that has a limited amount of time (usually 60–75 days) to respond, varying based on the card network. Stripe updates the dispute’s status as soon as the bank’s response is available, but that response is often not known until the deadline passes. The decision from the cardholder’s bank is the final step in the dispute process.

In that context, if the dispute is found in favor of the cardholder by the bank or if no evidence is presented, the cardholder will keep the amount of the dispute and their bank will keep the dispute fee. If you win the dispute, both the disputed amount and dispute fee will be returned to your Stripe balance.

Note: Banks review evidence only once, so you can only submit it once. You need to make sure your evidence is complete and sufficient before submitting.

You’ll find a full guide on how to respond to disputes here:

https://support.stripe.com/questions/responding-to-disputes-video-guide

---

Understanding Fraud

Identifying Common Fraud

There are many types of fraud indicators, some of which are easy to identify such as false numbers or email addresses, other types may be more intuitive and nuanced, such as a conversation with a customer that seems off. Having an understanding of the various ways fraudsters use false information to make fraudulent transactions will better help you to protect against them.

Learn about the most common types of fraud and how to identify them here:

https://stripe.com/docs/disputes/prevention/identifying-fraud (available in ES)

Card Testing

Card testing is a type of fraudulent activity where someone tries to determine if stolen card information can be used to make purchases. Other common terms for card testing are “carding”, “account testing”, and “card checking.” Fraudulent activity such as card testing is an unavoidable part of online commerce. At Stripe, we’re constantly improving our tools and systems to detect and reduce fraud, but you must remain vigilant with respect to fraud.

Card Testing attacks on websites can be identified by a number of signs:

• Low-value transactions – a series of low-value transactions of similar or repeated value, from the same IP address

• Velocity and Frequency – a surge of transactions over a specified timeframe (e.g., high transaction amount of similar value over 5 minutes) could indicate use of programmed bots

• High Decline Rate – significant increase in declines, as well as decline reasons including (but not limited to): invalid card number, suspected fraud, stolen card, no card record, etc.

• CVV Errors – repeated number of incorrect CVV code errors, as stolen or generated card numbers often do not have CVV information

• More declines within 24 hours – gibberish email address, customer name, declines across 5 or more cards, emails/info can be the same or different across cards

• In the Dashboard, look into Developer > Logs for excessive 402 errors related to payments. Note that these are typically small payments, meaning they appear ordinary and can remain undetected for longer.

Stripe has many automated and manual controls in place to mitigate card testing, including rate limiters, alerts, ongoing reviews, and more. However, these measures alone can’t prevent all card testing, but your continued attention to this issue can make it much more difficult for those who want to defraud you.

In order to combat the card testing, we recommend you add friction to the payment flow to make it more difficult for card testers to make payment attempts. While we recognise this may also add friction to your regular customer payments, we need to address the fraudulent activity on your account to ensure continued regular processing.

We also suggest implementing any other mitigations to prevent future card testing that you see fit. You’ll find a few suggestions in this link:

https://stripe.com/docs/card-testing

---

Protecting your account from Fraud and Disputes

The best way to manage disputes is to take action to prevent them from happening at all. An effective dispute and fraud prevention strategy uses a number of methods that are best suited for your business while keeping any customer burden—and losses—to a minimum.

We recommend reviewing the best practices for preventing disputes below but you can also reach out to our support team with any questions.

Some of the measures you can take to reduce the likelihood of disputes are:

Collect as much information as possible during the payment process in your website

When more information is collected from the customer during the payment process, it increases the ability for Stripe or the card issuer to verify the customer and the payment.

Examples of this information include:

• Customer name

• Customer email address

• CVC number

• Full billing address and postal code

• Shipping address (if different from billing address)

• Communication with customers

Clear and frequent contact with your customers can help prevent many of the reasons for disputes

Make your customer service contact information easy to find, keep customers updated throughout their order process, and provide updates about deliveries. Examples of good practices are:

• Making your terms of service and policies easy to find on your website, and require customers to agree to them.

• Contact information should also be easy to find, in case your customers would like to flag any issues with their orders/payments.

• When shipping physical goods to customers, use carriers and services that provide online tracking and delivery confirmation whenever possible.

• Use a recognisable name for your statement descriptor. This can be set or updated in your account settings and we recommend using your website domain or business name.

• Country and card type limiting

If you’re experiencing increased fraud coming from certain countries

You can set up rules to block payments from any country you do not want to accept payments from, using the :ip_country: and :card_country: rule attributes.

• https://dashboard.stripe.com/settings/radar/rules

Delay shipping orders

If you’re shipping physical goods, consider delaying the shipment of goods by 24-48 hours. This time gives cardholders a chance to spot any fraud on their accounts. However, not all cardholders check their statements on a daily basis, and their card issuer may not proactively contact them about the transaction.

Use 3DS

Using 3D Secure prompts customers to complete an additional authentication step before they can complete the purchase flow. If 3D Secure authenticates a payment, the liability for any fraud-related disputes for that payment typically shifts from the merchant to the issuer. This means that in most cases, the merchant won’t be responsible for fraud costs on 3D Secure authenticated payments.

3DS is available to all merchants in Mexico - steps to implement here:

https://stripe.com/docs/payments/3d-secure#incorporating-3ds

One thing to note is that the buyer's 3DS experience is controlled by their issuing banks, and can vary widely in expected conversion rate. Some banks are more streamlined than others, but triggering 3DS on all payments could lead to some negative effects on conversion. Users would definitely know their business and their risk profile the best, so it's worth for them to think about how best to balance protecting against fraud while ensuring a good checkout experience.

Consider purchasing Radar for Fraud Teams, which allows you to create custom rule(s) that triggers 3DS for purchases meeting criteria like high risk transactions. Depending on the integration, Radar for Fraud Teams' rules for triggering 3DS might be useful: https://stripe.com/docs/payments/3d-secure#three-ds-radar

• These rules would enable users to easily only use 3DS based on a minimum order amount while also skipping 3DS for a trusted list of customers.

3DS will prevent and increase the chance to win disputes, however data offering to complete the 3DS is an obstacle in Mexico. Even so, many users in Mexico have had good results in terms of fraud protection by activating 3DS.

It’s important to note that: It is not currently possible to trigger 3DS2 rules without using the Payment Intents API or the new Checkout.

Radar for Fraud Teams

Stripe's advanced fraud tool, Radar for Fraud Teams is an add-on suite of tools for any business experiencing high levels of risk. This video demonstrates how to use Radar for Fraud Teams in the Stripe Dashboard.

The 0 to 100 risk score from Radar for Fraud Teams can be used to configure a rule that requires manual review for transactions above a risk threshold like 50.

How to set Radar Rules: https://stripe.com/docs/radar/rules