Smarter default fraud rules that weigh issuer signals
Stripe has updated its Radar fraud tooling to make default rules more flexible. Previously, Radar’s default rules would automatically block a transaction whenever the card’s CVC or postal code verification failed. The new adaptive rules combine Stripe’s machine learning risk scores with the issuer’s real-time CVC and postal code response, allowing lower-risk payments to proceed while still blocking higher-risk traffic.
The change is designed to reduce accidental declines of legitimate purchases. Businesses that adopt the new rules see a 1.3 percentage point increase in payment success rates with minimal impact on fraud rates, which could translate into billions of dollars in additional revenue annually across Stripe’s user base.
How issuer responses now factor into risk decisions
Two developments make the adaptive rules possible: Stripe’s AI infrastructure for continuously improving fraud models, and the Enhanced Issuer Network, which gives issuers secure access to Radar’s AI-powered fraud scores before they decide whether to authorize a transaction.
When an issuer authorizes a payment despite an incorrect CVC or postal code, that decision now serves as a signal—the issuer has seen Radar’s risk score and still chose to approve, indicating confidence in the transaction’s legitimacy.
Radar’s new rules incorporate that issuer response as an additional input. The process works as follows:
Illustration by Ibrahim Rayintakath
- Radar’s AI models generate a risk score based on data from millions of businesses and tens of billions of transactions.
- Based on the score, Radar either blocks the transaction, flags it for manual review, or passes it to the issuer.
- The issuer authorizes or declines and returns additional details, including whether the CVC or postal code was incorrect.
- Radar then combines the issuer’s response with the original risk score to make a final decision.
For example, depending on your other Radar rules, higher-risk transactions with an incorrect CVC will still be blocked, while lower-risk ones may be allowed through—improving payment success without weakening fraud protections.
Enabling the new rules
Merchants can enable the adaptive default rules directly from the Stripe Dashboard. The change does not affect any other default rules, and Radar continues to block high-risk traffic as before.
See Radar’s documentation for more details on adaptive default rules, or get started with Radar from the Dashboard.
