Canonical Labs

Fraud down, good customers back. Case by case.

Collectibles, trading cards, digital packs, precious metals: the verticals off-the-shelf fraud defaults find hardest. Real engagements, by industry.

  • First rules live the same afternoon
  • Five hours from a lost dispute to a live rule
  • −85% fraud disputes a week
  • 50+ rule changes in four weeks
  • 3,000+ fraud devices blocklisted
  • 5 fraud rings mapped
  • 1,000+ good customers let back in
  • 60+ bank-verified payments, no disputes
  • 100+ rule combinations backtested in two days

Stripe Radar Set Up

New on Stripe, or moving to it at full volume. Rules live before the first payment.

Stripe Radar Set Up · Case 1

Digital-pack marketplace

Context

A pack-opening marketplace moving its card payments to Stripe at full volume.

The problem

Its old processor had absorbed the fraud. It went live with no dispute history, no rules of its own, and every payment from day one.

What we did

  1. First rules live the same afternoon it went live, built from what we see at similar marketplaces.
  2. Block lists for usernames, phones and emails, a VIP list, and Sigma switched on in the first days.
  3. Backtested looser blocks: ~20% less volume blocked, and every disputed payment still caught.
  4. Cut the VIP list by about 85% once some VIPs started acting like fraud, and blocked a small ring sharing cards and masked IPs after the client confirmed it.

“It’s been super good having you on board. You manage our rules, the fraud keeps coming down, and we get to focus on the business.”

Operations leadDigital-pack marketplace
  • Same dayfirst rules live, the afternoon it went live on Stripe
  • <0.4%dispute rate at wrap-up

The result

−38%

blocked payments in one week, while approvals rose by 3 points

Blocked, wk 1Blocked, wk 2

Stripe Radar Set Up · Case 2

Gaming and collectibles app

Context

A gaming and collectibles app moving its payments to Stripe, wallet payments first.

The problem

No transaction history to learn from, and card payments still to come. The rules had to be right before the first payment.

What we did

  1. Wrote 12 rules before a single transaction came through, from how the business sells and where fraud hits its vertical.
  2. Trust tiers for new and confirmed customers, passed to Stripe Radar through payment metadata.
  3. Card rules ready in shadow for the day card payments open.

The result

12rules

live before the first payment, tuned to the vertical with no transaction data yet

Stripe Radar Tune Up

Fraud rising on a setup that already exists. Audit, backtest, then rules that pay for themselves.

Stripe Radar Tune Up · Case 1

Trading-card app

Context

A digital trading-card app that sells packs on live-stream events.

The problem

60+ fraud disputes a week when we started, a dispute rate still climbing, and a team holding back growth until fraud was handled.

What we did

  1. Backtested more than 100 combinations of Stripe Radar attributes in two days, then proposed five rules: two to ask for 3DS, three to block.
  2. Went live before a big event weekend, each rule with its false-positive risk and a way to switch it off in seconds.
  3. Ran a workshop on bank reason codes and the evidence each one needs.
  4. Replayed a month of payments to move ID checks from signup to the first cash-out, so good customers stop dropping out at the door.

“That’s a slam dunk in my mind. The backtest tables back it up, so let’s turn it on.”

Fraud leadTrading-card app
  • 100+rule combinations backtested in two days

The result

−85%

fraud-coded disputes a week, five weeks after we started

Wk 1Wk 2Wk 3Wk 4Wk 5

Moved to retainer

Big live events look a lot like fraud. Rules tuned before each one and watched through the night, any of them off in seconds.

Incident Response

An attack happening now. Stop the spike first, then give good customers their way back in.

Incident Response · Case 1

Collectibles marketplace

Context

A high-volume collectibles marketplace, new to Stripe.

The problem

The move brought a fraud spike, then a bot attack from one region. The rules that cut disputes also caught good customers, and only a weekly look at outcomes shows which.

What we did

  1. New rules written from the attributes of lost disputes, each backtested before it shipped.
  2. Five hours from a lost dispute to a live rule that would have caught six figures of disputes in the month before.
  3. Blocklisted 3,000+ devices tied to known fraud and mapped five fraud rings, 50+ accounts, for the client to confirm.
  4. Audited our own blocks, found the good customers inside them, and relaxed the rules in stages.

“We’ve been really happy working with you. At this point we just trust your judgment.”

Engineering leadCollectibles marketplace
  • <0.5%three-month dispute rate, inside target
  • 100+fraud payments stopped by the device list, no good customer among them

The result

$500K

spent since by good customers we found behind one of our own block rules, once we relaxed it

Moved to retainer

Still unlocking revenue: rules reviewed against real transactions, blocks relaxed 10% of traffic at a time. Good customers back in, disputes under 0.5%.

Incident Response · Case 2

Card-breaks marketplace

Context

A card-breaks marketplace taking deposits by bank transfer (ACH) and card.

The problem

Banks were pulling ACH deposits back 10 to 15 days after the money was spent and withdrawn.

What we did

  1. Spotted a block rule set too high to ever fire.
  2. Split the thresholds for bank and card payments.
  3. Backtested the new rules against the disputed deposits before anything went live.

The result

4×

as much disputed ACH volume caught as good volume touched

Custom Solutions

ACH, bank verification and orders taken by phone: the fraud that sits beyond Stripe Radar.

Custom Solutions · Case 1

Precious-metals dealer

Context

A precious-metals dealer selling on the web and through brokers on the phone.

The problem

One buyer took delivery of the metals and then disputed the ACH payment: a $50K+ loss, on a business where margins are thin.

What we did

  1. Benchmarked peer dealers and found that bank-login verification (Stripe Financial Connections) is how they stop ACH fraud.
  2. Wrote the risk policy and draft rules for their developers, then caught a phone field missing from the live build.
  3. Backtested and shipped three relaxations for web orders, so fewer real buyers get declined.
  4. Drafted red, yellow and green guardrails for the brokers taking orders by phone.

“Thirty days without a single ACH dispute. I’m gonna party like a rock star tonight.”

CFOPrecious-metals dealer
  • 60+bank-verified payments in the first weeks, no disputes
  • $50K+the single ACH loss that started it

The result

0

ACH disputes in 30 days, after multiple every month before

A month beforeThe last 30 days

Moved to retainer

Blocks relaxing in small steps under active monitoring, so a new attack is stopped in its tracks before it turns into a loss.

The work after the work

Fraud moves after the engagement ends, and disputes land weeks after the payment. So most clients keep us on: a steady week of watching, small tested changes, and nothing switched on without their say.

A week on retainer
  1. Mon Sync Weekly sync A call on what changed, then a written update.
  2. Tue Rollout One Stripe Radar rule relaxed An over-broad block rule now lets 10% of traffic through.
  3. Wed Review Blocklist review Candidates go to you first. Nothing is blocked until you agree.
  4. Thu Rings Rings spotted Shared cards and devices, flagged before the first dispute.
  5. Fri Networks Network thresholds Card-network monitoring programs checked against the week.
  6. Sat Live watch Event night Live watch on big launch and event nights.
  7. Sun History Clean history Old rules disabled, never deleted, so every change stays traceable.

Relaxed Stripe Radar ruleA block rule that was stopping good customers, eased step by step while checking against real payments.

100% of traffic
  • Every day. We watch blocks, declines, early fraud warnings and disputes.
  • Every month. A performance report: block rate, approvals, disputes, and what every rule did.
  • When something spikes. A reply within hours, and rule changes as fast as you sign off.

What you get from every engagement

  • Versioned rule setEvery rule with its change log.
  • Backtest memosWhat each change catches, and what it costs.
  • List strategyBlock, allow and VIP lists, and who maintains them.
  • Dispute playbookWhat to send, by bank reason code.
  • Weekly written updatesWhat changed, why, and what is next.
  • Final reportWhere you started, where you are, what to watch.