Beyond single-account checks: spotting fraud rings

Stripe's global scale makes it a frequent target for payments fraud. The company has developed a range of automated tools for its risk analysts to separate legitimate users from fraudulent accounts. Among the most effective is a machine learning system that groups accounts into clusters based on similarity, exposing the networks of accounts that fraudsters create to scale their operations. This lets Stripe shut down rings in real time and frees analysts to focus on more complex cases.

Two distinct fraud models

Fraud in payments falls into two broad categories. Transaction fraud concerns individual charges, such as those protected by Stripe Radar, where a fraudster buys goods with stolen card details. Merchant fraud is different: someone creates a Stripe account with the intention of defrauding cardholders. They may run charges with stolen card numbers, hoping to be paid out before chargebacks arrive, or they may set up a sham business selling goods they never intend to deliver. In either case, Stripe ultimately absorbs the losses if the fraudster has already withdrawn funds.

Fraudsters rarely start from scratch. Low-effort attackers reuse account attributes and are caught immediately at signup. More sophisticated ones work to hide links to prior accounts, but some attributes are hard to fabricate. A bank account, for instance, requires significant effort to obtain new. Linking accounts via shared attributes is a proven detection method, but Stripe wanted to move from hand-built heuristics to machine learning.

From heuristics to learned similarity

The key insight is that if two accounts share enough attributes, they are likely controlled by the same actor. The challenge is quantifying that similarity: sharing a date of birth should count for less than sharing a bank account. Rather than hand-tune those weights, Stripe trains a model to learn them from data.

This is an example of similarity learning, a supervised approach. Stripe has millions of labeled examples of legitimate and fraudulent businesses, determined by downstream outcomes like chargebacks and fraud losses. Risk teams have also manually compiled examples of confirmed fraud rings, which serve as reference clusters for training. Edges between accounts within a cluster are positive examples; edges between accounts in different clusters are negative ones.

We use known clusters of accounts to train our predictive models.

Features are generated for each pair of accounts, capturing attributes such as email domain, overlapping card numbers, and text similarity. The rich data associated with Stripe accounts allows for an extensive feature set.

Gradient-boosted decision trees for scalability

Stripe chose gradient-boosted decision trees (GBDTs), specifically XGBoost, to represent the similarity model. GBDTs offer a good balance of ease of training, predictive power, and robustness. XGBoost is a strong off-the-shelf choice for structured, tabular data and fits well with Stripe's existing model training and serving infrastructure.

The model operates on pairs of accounts, so scoring all possible pairs is infeasible. Instead, Stripe builds a candidate set by creating edges between recently created accounts that share certain attributes. This heuristic prunes the search space effectively. Edges with a similarity score above a threshold are kept, and connected components are computed on the resulting graph. The output is a set of high-confidence account clusters that analysts can inspect as a unit.

Each edge is weighted by a similarity score; we identify clusters by finding connected components in the resulting graph.

The process is iterative. As a fraudster creates more accounts, clusters grow and similarity becomes easier to detect. Each ring that is shut down provides more training data, improving the model's accuracy over time.

Operational advantages of clustering

Beyond catching obviously fraudulent accounts, clustering delivers several concrete benefits:

  • Higher catch rates on repeat fraud. Fraudsters find it difficult to fully separate new accounts from old ones, whether through reused attributes or subtler signals. The system blocks hundreds of fraudulent accounts weekly with very few false positives.
  • Raising the cost of fraud. Each new account requires investment in stolen IDs, bank accounts, and other resources. Clustering invalidates those resources once they are linked to a fraudulent account, making it more expensive and slower to operate at scale.
  • More efficient analyst reviews. Analysts can apply judgments to an entire cluster at once, spotting common patterns and outliers more reliably than reviewing accounts in isolation.
  • A reusable primitive. The similarity model also serves other systems, such as expanding training sets for models with sparse data.

Fraud as an adversarial game

The goal is to shift the economics of fraud so that it has a negative expected value for attackers. By raising the cost of unused bank accounts, IP addresses, and other tools, Stripe weakens the supply chain for stolen credentials and disincentivizes fraud at scale. Using a common tool like XGBoost allowed for rapid deployment that fits naturally into Stripe's platform and adapts easily as fraud patterns evolve. The ongoing work focuses on new techniques to keep Stripe's global payment network low-friction and reliable for millions of businesses.