Stripe Radar: AI Combatting Fraud in ACH and SEPA

Stripe Radar leverages the power of artificial intelligence to detect and block fraud in ACH and SEPA transactions. Using machine learning models trained on billions of transactions, Stripe evaluates every payment in real time, blocking fraudulent transactions before processing. The most striking feature is how the system dynamically adapts its rules, reducing losses without increasing legitimate declines.

Photo: Jonas Leupe on Unsplash

How Radar's AI Engine Works

Stripe Radar uses machine learning architectures that examine over 250 signals per transaction. According to Stripe's official documentation, the system analyzes payer data, behavioral history, geolocation, device information, and transaction patterns. Honestly, the level of detail considered is impressive.

For ACH and SEPA payments, where money doesn't move instantly like with cards, Radar predicts risk before initiating the debit. Isn't it amazing how this is achieved? The time window is critical: an ACH payment can take several business days to complete, and reversals due to fraud can occur up to 60 days later.

The model specifically analyzes:

• Transaction velocity: Multiple debits from the same account in short periods.
• Amount anomalies: Transactions exceeding the merchant's historical amounts.
• Account data: Matches between account holder's name and registered data.
• Device patterns: Digital fingerprinting to detect suspicious changes.
• Stripe network: The same account's behavior with other merchants.

Unlike systems with static rules, Radar continuously adjusts its thresholds. There's no fixed "risk percentage"; the system considers the complete context.

Fraud Prevention Differences: ACH vs SEPA

Photo: CardMapr.nl on Unsplash

ACH, predominant in the U.S., and SEPA, in the Eurozone, present different fraud vectors that Radar addresses with differentiated strategies.

ACH: The Issue of Unauthorized Debits

In ACH, the most common fraud is debiting without the genuine consent of the account holder. According to financial sector sources, reversals due to "unauthorized debit" represent a significant fraction of total losses.

Radar for ACH focuses on:

• Ownership verification: Cross-references payer data with banking information.
• Microdeposits pattern: Analyzes behavior post-account verification.
• Plaid/instant verification signals: Integrates bank authentication data.
• Dispute history: Identifies accounts with chargeback history.

SEPA: Cross-Border Fraud and Compromised Accounts

SEPA payments, operating across 36 countries, face additional complexity. Typical fraud involves legitimate but compromised accounts.

Radar evaluates:

• Geographic discrepancies: German account with IP in a non-European country.
• Metadata changes: Sudden changes in merchant data or SEPA mandate.
• Timing patterns: Transactions at atypical hours.
• Mandate analysis: Evaluation of SEPA mandate's age and usage.

Configuration and Custom Rules

Stripe Radar offers two levels: Radar (included for all) and Radar for Fraud Teams (with customizable rules).

In standard Radar, the system operates automatically without configuration. For ACH and SEPA, the model is pre-trained with Stripe's global data, which benefits especially new merchants without their own history.

Radar for Fraud Teams allows creating specific rules using Stripe's language:

Block if :ach_debit: and :payment_amount: > 500 and :customer_created: < 7d

This rule would block ACH debits over $500 from customers less than 7 days old.

According to the official documentation, rules can combine complex logical operators and machine learning scores. For example:

Review if :sepa_debit: and :risk_score: > 65 and :ip_country: != :bank_country:

This would send to manual review SEPA payments with a high-risk score where the IP country's not the same as the bank's.

Technical Integration and Workflow

Implementing Radar doesn't require additional code if you're already using Stripe Payments. Analysis occurs automatically when a PaymentIntent is created or a SetupIntent is confirmed for ACH or SEPA.

Basic Technical Flow:

1. The merchant creates a PaymentIntent with payment_method_types: ['us_bank_account'] or ['sepa_debit'].
2. Radar evaluates the transaction in milliseconds.
3. The system returns risk_level (normal, elevated, highest) and risk_score (0-100).
4. Depending on configuration, the transaction is accepted, blocked, or marked for review.
5. If blocked, the payment_intent.payment_failed webhook notifies the merchant.

Merchants can consult the outcome of the Charge object to understand the decision:

{
  "outcome": {
    "network_status": "approved_by_network",
    "reason": "approved",
    "risk_level": "normal",
    "risk_score": 32,
    "seller_message": "Payment complete.",
    "type": "authorized"
  }
}

For high-risk payments, Radar can activate 3D Secure in some SEPA cases, adding an extra layer of authentication.

Comparison: Radar vs Alternative Solutions

| Feature | Stripe Radar | Plaid Monitor | Sift | Riskified | |---------|--------------|---------------|------|-----------| | Native ACH/SEPA Integration | Included | ACH only | Requires config | Requires config | | Global Data Network | Billions of tx | Hundreds of millions | Multi-sector data | E-commerce focus | | Initial Configuration | Zero-config | Separate API | Complex implementation | Extensive onboarding | | Adaptive ML | Automatic | Limited | Configurable | Configurable | | Base Model Cost | Included in Stripe | Variable by volume | From $500/month | Dynamic pricing |

Note: This comparison reflects general features publicly reported. Pricing and configuration details vary by contract.

Radar's distinctive advantage is its position within the payment flow. Honestly, it doesn't require sending data to an external service or waiting for additional API responses, reducing latency and technical complexity.

System Evolution and Continuous Machine Learning

Stripe trains its models with anonymized data from its entire processing network. This means that fraud detected at one merchant improves protection for all.

The system employs gradient boosted decision trees and deep neural networks depending on the signal type. For structured data, decision trees offer interpretability. For complex patterns and device analysis, neural networks identify non-linear relationships.

Each model is continuously re-trained. According to public presentations by Stripe engineers, the update cycle operates in hourly windows, not days, allowing rapid response to emerging fraudulent campaigns.

The feedback loop is critical: when a merchant marks a transaction as fraudulent, that information feeds the model. Stripe also integrates data from actual chargebacks and bank disputes to correct false negatives.

Specific Use Cases by Industry

SaaS Subscriptions with SEPA

Software companies with European clients face "free trial abuse" fraud, where stolen data is used to access premium services.

Radar detects patterns like:

• Multiple subscriptions from different email accounts but the same IP.
• Bank accounts used simultaneously in multiple merchants.
• Frequent payment method changes in short periods.

Marketplaces with ACH in the U.S.

Platforms like Etsy or Airbnb process significant volumes via ACH due to reduced costs.

Specific risk: account takeover, where an attacker accesses legitimate accounts and changes bank details to receive funds.

Radar monitors:

• Payment method changes.
• Time between bank account creation and first withdrawal.
• Discrepancies between historical shipping address and new bank account.

Government and Utility Payments

Entities collecting taxes or public services face the challenge of processing multiple small transactions.

Radar allows setting differentiated thresholds by amount, applying deep analysis only to transactions above a certain value.

Limitations and Considerations

No fraud prevention system is infallible. Radar minimizes both fraud and false positives, but the balance is configurable according to risk appetite.

Known Challenges:

• First-party fraud: Difficult to detect when the real account holder initiates but fraudulently disputes the payment.
• Regulatory changes: SEPA has evolved with PSD2 and Strong Customer Authentication; Radar adapts its rules.
• Limited data for new merchants: Without their own history, the model relies exclusively on network signals.

Stripe recommends merchants with significant volume combine Radar with:

• Identity verification.
• Manual analysis of high-value transactions.
• Specific business policies.

Success Metrics and Monitoring

The Stripe Dashboard provides visibility into Radar's performance:

• Fraud rate: Percentage of fraudulent transactions.
• Block rate: Automatically blocked attempts.
• Review rate: Transactions sent for manual review.
• False positive rate: Estimate of incorrect rejections.

For ACH, the dashboard shows:

• Return rate: Returns due to insufficient funds.
• Dispute rate: Disputes due to unauthorized debits.

In SEPA:

• Rejection rate: Rejections for invalid bank data.
• Chargeback ratio: Chargebacks initiated by account holders.

These KPIs allow for configuration adjustments. A high block rate with a low fraud rate suggests a too conservative configuration.

Recent Developments and Roadmap

While Stripe doesn't publish a detailed roadmap, conference presentations indicate research areas:

Large Language Models for Context Analysis: Evaluating descriptions and textual metadata to detect inconsistencies.

Federated Learning: Techniques to train models with sensitive data without centralizing information.

Real-time Network Analysis: Relationship graphs to identify fraud rings.

Stripe has also intensified collaborations with European banks, although details remain under confidentiality agreements.

Frequently Asked Questions

Does Radar work the same for ACH and SEPA as for cards?

No, the models are specific to each payment method. ACH and SEPA have characteristics and fraud vectors distinct from cards. Radar trains separate models but shares infrastructure and common signals.

Can I disable Radar if I have my own anti-fraud system?

Basic Radar is always active for all merchants using Stripe. It can't be completely disabled, but you can configure rules to automatically approve all transactions.

What happens if Radar incorrectly blocks a legitimate payment?

The customer will see a generic rejection message. The merchant can see the reason in the Dashboard and use the "Allow" function to mark the customer as trustworthy.

Does Radar protect against chargebacks in ACH and SEPA?

Radar reduces the likelihood of chargebacks by preventing fraud, but it doesn't eliminate them entirely. In ACH, disputes can occur up to 60 days later; in SEPA, up to 8 weeks.

---

EXCERPT: Stripe Radar uses ML with billions of transactions to block fraud in ACH and SEPA before processing, with no additional configuration needed.

---

Editorial note: This article was produced with AI assistance and reviewed by Javier Valencia. Verified facts are distinguished from editorial opinion throughout the text. External sources linked are independent of NewsTide.