Every card payment is screened by our fraud checks before it's charged. On top of that, Settings → Risk gives you a handful of rules, each a single control with a plain sentence, plus automatic refunds for pre-dispute alerts. Owners and admins can change the rules, and the owner sets automatic refunds; rules apply to new payments.
Payment rules
| Rule | What it does | Setting |
|---|---|---|
| Block cards from selected countries | Payments with cards issued in the countries you choose are declined. | Up to 50 countries, by where the card was issued. |
| Require 3D Secure above an amount | Customers confirm larger payments with their card issuer, which usually makes the issuer, not you, responsible for fraud disputes on them. | An amount from $0.00 (every payment) up to $1,000,000.00. |
| Maximum amount per payment | Card payments over this amount are declined. | An amount from $1.00 to $1,000,000.00. |
| Block high-risk payments | Payments our fraud screening scores as risky are declined before the card is charged. | How strict: see the levels below. |
High-risk levels
“Block high-risk payments” declines payments by the 0–100 risk score our fraud screening gives each one:
- Only the riskiest payments (score 90 or more)
- High-risk payments (score 75 or more)
- Elevated and high risk (score 60 or more)
3D Secure
With “Require 3D Secure above an amount”, customers confirm larger payments with their card issuer, usually in their banking app. That usually makes the issuer, not you, responsible for fraud disputes on those payments. Set the amount to $0.00 to ask for it on every payment.
Automatic refunds for pre-dispute alerts
Card networks sometimes warn us that a customer is about to dispute a payment. A refund before the dispute is opened avoids the dispute. The owner can turn on automatic refunds in Settings → Risk with a limit from $1.00 to $10,000.00 (we suggest $100.00).
- Only alerts nobody on your team has acted on, that are still open, are refunded.
- The payment must be refundable and untouched: never a second refund, never a payment already refunded or disputed.
- Both the payment and the amount the issuer reported must be at or under your limit.
- It is always a full refund, and you receive
payment.refunded.
Refund approvals
In Settings → Team & approvals, set an approval limit (up to $1,000,000.00). Refunds above it, made by anyone but the owner, wait in Orders until the owner approves or declines them, and the owner is notified. With no limit there is no approval step.
Checkout rules
Settings → Risk → Checkout rules run on every card checkout before the card is charged, on payment links and invoices alike. Each starts off. When one matches, it either declines the payment (the customer sees the usual decline, never which rule) or holds it for review. Next to each rule, the dashboard shows how many of the last 30 days' checkouts it would have matched, before you switch it on.
| Rule | What it checks | Setting |
|---|---|---|
| Too many attempts with one card | Someone testing stolen cards tries the same card again and again. This counts every checkout attempt with the same card number. | Attempts per hour and per 24 hours (we suggest 5 and 10). |
| Too many attempts from one email | Counts checkout attempts with the same email address, whatever card is used. | Attempts per hour and per 24 hours (we suggest 5 and 15). |
| Too many attempts from one connection | Counts checkout attempts from the same internet connection (IP address). Shared networks such as offices and schools can reach it sooner. | Attempts per hour and per 24 hours (we suggest 10 and 30). |
| Block email domains | Payments from email addresses at the domains you list, and their subdomains. | The domains you list; their subdomains match too. |
| Disposable email address | Throwaway inboxes (like Mailinator or Guerrilla Mail) that people use to avoid being contacted later. We keep the list up to date. | Nothing to set: we keep the list of throwaway email providers up to date. |
| Location doesn't match billing country | The country the customer is connecting from isn't the country of their billing address. Travelers and VPN users can match too. | Nothing to set. |
| First-time customer over an amount | A customer who has never paid you before spends more than this in one payment. | An amount (we suggest $500.00). |
| Most one customer can spend in 24 hours | The total of one email address's payments in the last 24 hours, including this one. | An amount (we suggest $2,000.00). |
To ask for 3D Secure, use the “Require 3D Secure above an amount” payment rule: 3D Secure can't be requested one payment at a time.
Manual review
A held payment is authorized on the customer's card but not taken. The customer sees “Payment received — the business is confirming your order”, and gets their receipt only once you approve. Owners and admins decide in Payments → Review, which shows why it was held, the card, where the customer is, 3D Secure, the fraud score, their history with you and the time left. Members can look.
- Approve: the payment is taken and handled like any other — receipt, invoice, discount code,
payment.succeeded. - Reject: the payment is canceled, the hold on the card released, and the customer told politely by email. Nothing is taken.
- You receive
payment.review_requiredwhen a payment is held, and your owners and admins get the “Payment held for review” alert. - A card can be held for 5 days at most. If nobody decides within 4 days, we cancel it (or approve it, if you choose so in Settings → Risk), and remind your team a day before.
- Holds apply to one-time card payments. A subscription or bank payment that matches a hold rule goes through as usual. A payment rule on your account set to review is held the same way.
One-click checkout
When a customer ticks “Save my card for faster checkout”, we record their consent. Next time, on any of your payment links or invoices, they're offered “Pay faster with a saved card”: we email them a 6-digit code, and only then show their saved cards (brand, last four and expiry). They can trust their device for 30 days to skip the code. A saved card is only ever shown to the same email, with the same business. Customers can remove cards, sign out trusted devices or turn faster checkout off from your billing page. It's on by default; turn it off in Settings → Risk.
Disputes
When a customer disputes a payment you receive dispute.opened, the payment's status becomes disputed and dispute.status tracks it: needs_response, under_review, then won, lost or closed, with dispute.closed when it's decided. Respond from Disputes in the dashboard; your terms and refund policy from Settings → Payments can be used as evidence.
We build the response for you: an evidence pack from your own records, with 3D Secure, the security code and address checks, the device and browser used at purchase and the customer's history for fraud claims. Its status is on every dispute in the Disputes API as evidence.