stripe·May 27, 2026·3 min readCurated summary

Expanding Stripe Radar to protect more of your business

Stripe has significantly expanded Radar from card fraud prevention into a broader, AI-powered risk platform. It now protects transactions across global payment methods, supports off-Stripe fraud signals and custom models, detects newer abuses such as multi-account and pay-as-you-go fraud, and helps platforms assess merchant risk. Stripe’s goal is to let businesses intervene earlier and with greater precision while reducing false positives and operational losses. ## Global Payment Coverage and Custom Fraud Models - Radar now protects transactions across supported payment methods, including: - Bank debits - BNPL - Crypto - Digital wallets - Real-time payments - Cash vouchers - Fraud signals such as IP addresses and device fingerprints can now protect transactions across payment methods and businesses on the Stripe network. - Stripe reported a 71% reduction in suspected fraud over five months for businesses using Affirm, Cash App, Klarna, and PayPal. - New multiprocessor signals predict: - Whether a transaction may trigger an early fraud warning - Whether it is likely to result in a fraudulent dispute - Businesses can use these predictions to refund transactions early, gather evidence, or adjust dispute strategies. - Custom fraud models allow businesses to provide proprietary signals such as: - Product catalog information - Loyalty status - Behavioral data - Structured metadata - Early adopters detected at least 15% more fraud without increasing false positives. ## Defending Against New Fraud Types ### Multi-Account Abuse - Fraudsters create multiple accounts to reuse promotions or distribute stolen-card activity. - More than one in six AI-company sign-ups on Stripe are associated with multi-account abuse. - Radar evaluates accounts in real time using network-wide signals such as device fingerprints, IP addresses, and email domains. - ElevenLabs reportedly blocks around 2,000 abusive users per day from its free tier. ### Pay-As-You-Go Abuse - Customers can consume substantial resources and intentionally avoid paying when billed later. - Radar predicts nonpayment risk as usage accumulates. - Businesses can respond by requiring top-ups, suspending service, or applying other controls before billing. ### Malicious Bot Payments - Radar assigns a bot score to Stripe Checkout payments. - Businesses can distinguish legitimate automated agents from malicious bots. - The score can support controls against: - Inventory hoarding - Promotional abuse - Purchase-limit bypasses - High-velocity automated orders ## Platform and Merchant Risk Management - Platforms receive 0–100 fraud scores for businesses and transactions. - AI-powered explanations, notes, account history, and account-level metrics help risk teams investigate merchants. - New merchant-risk signals include: - **Fraudulent website signal:** Detects suspicious pricing, AI-generated copy, misspelled domains, and other website red flags. - **Fraudulent merchant signal:** Uses business information, bank details, transaction activity, and disputes to identify risky accounts. - **Merchant delinquency risk signal:** Predicts whether a merchant’s negative balance is likely to persist for at least 60 days. - Platforms can use these signals to automate verification, trigger reviews, pause payments or payouts, reject accounts, establish reserves, adjust payout schedules, or request additional identity verification. Stripe’s expanded Radar offering is designed to move fraud prevention earlier in the customer and merchant lifecycle. Businesses and platforms should combine these network-wide signals with their own risk tolerance and workflows to block abuse proactively while minimizing unnecessary friction.

Read original(opens in new tab)

Identity VerificationMachine LearningFraud DetectionPayment Processing+4

stripe·Mar 20, 2026·2 min readCurated summary

Three of the biggest fraud trends from MRC Vegas 2026

Fraud is becoming more automated, adaptive, and difficult to detect with traditional rules-based systems. At MRC Vegas 2026, leading fraud teams emphasized dynamic authentication, fraud controls embedded directly into agentic payments, and layered identity verification to address deepfakes and synthetic identities. The common goal is to reduce friction for trusted customers while applying stronger defenses where risk is highest. ## Dynamic Authentication Based on User Intent - Universal authentication creates unnecessary friction, increases false positives, and can cause businesses to lose legitimate customers and their long-term value. - Airbnb advocates building behavioral profiles over time to measure “high-trust velocity”—the likelihood that a user’s activity reflects legitimate intent. - Trusted users can proceed without additional challenges, while authentication is reserved for the small percentage of traffic proven to be risky. - Stripe Radar’s adaptive 3DS uses AI to trigger authentication only when transaction behavior appears unusual. - Stripe reports that eligible businesses have seen fraud reductions of more than 30% with this approach. ## Fraud Detection for Agentic Commerce - Ashley Furniture’s existing rules-based system handled different authorization needs for quick-ship products and custom orders. - That model became insufficient when AI agents began making purchases across channels. - Fraud detection must be part of the payment infrastructure and evaluate transactions in real time, rather than analyzing them only after purchase. - Stripe Shared Payment Tokens let agents use a customer’s saved payment method without exposing payment credentials. - Combined with Stripe Radar, these tokens transmit risk signals such as potential disputes, card testing, stolen-card usage, and issuer declines. - These signals help distinguish legitimate, high-intent agents from low-trust automated bots. ## Deepfakes and Synthetic Identity Fraud - Fake identities are easier to create because criminals can access document templates and generative AI impersonation tools. - Fraudsters may produce convincing fake IDs, images, voices, and videos with limited resources. - Effective verification depends on identifying inconsistencies that forgeries fail to reproduce, such as incorrect signatures, mirrored photos, or mismatched expiration dates. - No single verification check is reliable enough; multiple independent checks are necessary. - Stripe Identity uses AI to detect fake documents and spoofed photos, compare ID images with selfies, and validate Social Security numbers and addresses against databases. Businesses should replace blanket controls with risk-sensitive interventions: minimize friction for trusted users, integrate fraud detection into agent-driven payment flows, and use layered identity verification to catch increasingly convincing forgeries.

Read original(opens in new tab)

Identity VerificationMachine LearningGenerative AIStripe+4

cloudflare·Mar 4, 2026·3 min readCurated summary

Defeating the deepfake: stopping laptop farms and insider threats

Trust is becoming a critical security weakness as attackers use stolen identities, AI-generated deepfakes, and laptop farms to impersonate remote workers. Traditional zero trust controls verify devices and credentials but often fail to verify the actual person behind them. Cloudflare’s partnership with Nametag adds identity verification during onboarding and risk-based controls afterward, aiming to prevent fraudulent workers from accessing corporate systems. ## The Rise of Remote Worker Fraud - Organized groups, including North Korean operations, use “laptop farms” to infiltrate companies. - Devices are shipped to domestic addresses, physically connected to KVM switches, and remotely operated by fraudulent workers. - Attackers use stolen identities, generative AI for interviews, and deepfake tools to create convincing government IDs and selfies. - Valid credentials and corporate-issued devices can make these users appear legitimate to standard zero trust systems. ## Why Traditional Insider Threat Defenses Fall Short - DLP and UEBA tools typically detect suspicious behavior only after an attacker has gained access. - Conventional onboarding often trusts: - The identity provided by a new hire - The shipping address receiving the laptop - Credentials sent to a personal email address - Zero trust policies commonly verify device posture, location, and account permissions—but not whether the person is genuinely the employee. ## Identity-Verified Zero Trust - Cloudflare Access is adding Nametag’s workforce identity verification to its existing policy checks. - Nametag verifies that the person receiving, configuring, and using a device is: - A real person - The legitimate person named in the identity documents - The authorized employee - Verification occurs before access to email, code repositories, or other internal resources is granted. ## How the Nametag Integration Works - Nametag integrates with Cloudflare Access through OpenID Connect (OIDC). - It can operate as the primary identity provider or as an additional evaluation factor alongside Okta or Microsoft Entra ID. - A typical onboarding flow includes: - The user attempts to access an onboarding portal. - Cloudflare redirects them to Nametag. - The user provides a work email, takes a selfie, and scans a government-issued ID. - Nametag’s Deepfake Defense technology uses cryptography, biometrics, and AI to detect fake identities, injection attacks, and presentation attacks such as printed photos. - A successful verification returns an ID token to Cloudflare, which applies its Access policies. - The process reportedly takes less than 30 seconds, and biometrics are not retained afterward. ## Layered Insider Threat Protection - Identity verification complements Cloudflare’s existing controls: - API-driven DLP for detecting data exfiltration - Remote Browser Isolation for reducing browsing risks - Shadow IT reporting and CASB capabilities for identifying unmanaged services and misconfigurations - Together, these controls distinguish between knowing which account is connecting and knowing who is actually behind the keyboard. ## Continuous Verification - Initial identity checks are not sufficient because legitimate credentials can later be sold or compromised. - Cloudflare Access uses user risk scores to support context-aware policies. - A sudden increase in risk can trigger access revocation for one or multiple applications. Organizations facing remote hiring and insider-threat risks should supplement device and credential verification with strong identity assurance at onboarding, followed by continuous, risk-based monitoring.

Read original(opens in new tab)

Identity VerificationAICloudflareZero Trust+4

discord·Feb 24, 2026·3 min readCurated summary

Getting Global Age Assurance Right: What We Got Wrong and What's Changing

Discord’s CTO says the company mishandled communication around its global age-assurance rollout, leading users to believe that face scans or ID uploads would be required for everyone. Discord’s stated goal is to protect teens and restrict age-sensitive content while preserving the normal experience for most users and avoiding collection of users’ identities. The company plans to use internal signals for most age determinations and privacy-focused third-party verification only when necessary. ## Where Discord Says It Fell Short - Discord did not clearly explain how age assurance would work or who would be affected. - Many users mistakenly believed that everyone would need to submit a face scan or government ID. - The company acknowledges that skepticism about technology companies collecting personal data is justified. - Discord says the rollout was not intended to create a pretext for gathering more personal information. ## The Goal of Age-Appropriate Experiences - More than 90% of users are expected to continue using Discord without verifying their age. - Discord wants teenagers to receive stronger safeguards while allowing adults to access the full range of content. - The approach is being influenced by laws already taking effect in the UK and Australia, with Brazil, Europe, and several US states following. - Discord says building its own system could demonstrate that age can be verified without identifying users. ## Internal Age Determination - Discord’s systems may determine age using account-level signals, including: - Account age - Whether a payment method is attached - Server membership patterns - General account activity - The system will not read private messages, analyze conversations, or inspect posted content. - Discord compares this process to existing safety systems used to detect spam, raids, and coordinated abuse. - The company plans to publish its methodology before the global launch. ## What Happens If Verification Is Required - Fewer than 10% of users are expected to need additional verification. - Users who do not verify can keep: - Their accounts - Servers - Friends lists - Direct messages - Voice chat access - They will only lose access to age-restricted content and the ability to change certain default safety settings intended to protect teens. - A user’s age group will remain private and will not be visible to other Discord users. ## Third-Party Verification Partners - Discord plans to use vendors when its internal systems cannot confirm that a user is an adult. - Vendors are intended to return only an age group, not the user’s identity. - Discord says vendors cannot connect verification information back to a Discord account, and Discord cannot use the process to learn the user’s identity. - Partners undergo security and privacy reviews, contractual data-use restrictions, and retention and deletion requirements. - Verification data is generally deleted immediately after it is no longer needed. - Discord clarified that the vendor involved in a previous customer-service security incident is not used for age assurance and is no longer a partner. - The company tested Persona in the UK in January but decided not to proceed with that vendor. Discord’s revised approach emphasizes minimal data collection, multiple verification choices, and transparency about how age estimation works. Publishing the methodology and clearly explaining vendor safeguards will be essential to rebuilding user trust.

Read original(opens in new tab)

Identity VerificationMachine LearningData ProtectionPrivacy+3

line·May 30, 2025Original article

Complex user authentication processes are easy (opens in new tab)

Designing a robust membership authentication system is a critical early-stage requirement that prevents long-term technical debt and protects a platform’s integrity. By analyzing the renewal of the Demaecan delivery service, it is evident that choosing the right authentication mechanism depends heavily on regional infrastructure and a balance between security costs and user friction. Ultimately, a well-structured authentication flow can simultaneously reduce fraud rates and significantly lower user drop-off during registration. ### The Consequences of Weak Authentication Neglecting authentication design during the initial stages of a project often leads to "ghost members" and operational hurdles that are difficult to rectify later. * **Data Integrity Issues:** Without verification, databases fill with unreachable or fake contact information, such as invalid phone numbers. * **Onboarding Blockers:** Legitimate new users may be prevented from signing up if their recycled phone numbers are already linked to unverified legacy accounts. * **Marketing Abuse:** A lack of unique identifiers makes it impossible to prevent bad actors from creating multiple accounts to exploit promotional coupons or events. ### Regional Differences in Verification Authentication strategies must be tailored to the specific digital infrastructure of the target market, as "identity verification" varies globally. * **Domestic (Korea) Standards:** Highly integrated systems allow for "Identity Verification," which combines possession (OTP) and real-name data through telecommunications companies or banking systems. * **Global and Japanese Standards:** Most regions lack a centralized government-linked identity system, relying instead on "Possession Authentication" via email or SMS, or simple two-factor authentication (2FA). * **Verification Expiration:** High-security services must define clear validity periods for authentication data and determine how long to retain data after a user withdraws to prevent immediate re-abuse. ### Strategic Fraud Prevention via IVR When SMS-based possession authentication becomes insufficient to stop determined abusers, shifting the economic cost for the fraudster is an effective solution. * **SMS vs. Voice (IVR):** In Japan, acquiring phone numbers capable of receiving voice calls is more expensive than acquiring SMS-only numbers. * **IVR Implementation:** By switching to call-based (Inbound Voice Response) authentication, Demaecan increased the barrier to entry for abusers. * **Impact:** This strategic shift in authentication type reduced the fraudulent user rate from over 20% to just 1.5%. ### Optimizing Sign-up UX and Retention A complex authentication process does not have to result in high churn if the UI flow is logically organized and user-friendly. * **Logical Grouping:** Grouping similar tasks—such as placing phone and email verification sequentially—helps users understand the progression of the sign-up flow. * **Streamlined Data Entry:** Integrating social login buttons early in the process allows for email auto-fill, reducing the number of manual input fields for the user. * **Safety Nets:** Implementing simple "back" buttons for correcting typos during email verification and adding warning dialogs when a user tries to close the window significantly reduces accidental exits. * **Performance Metrics:** These UX improvements led to a 30% decrease in user attrition, proving that structured flows can mitigate the friction of multi-step verification. To build a successful authentication system, planners should prioritize the most cost-effective verification method for their specific market and focus on grouping steps logically to maintain a smooth user experience. Monitoring conversion logs is essential to identify and fix specific points in the flow where users might struggle.

Identity VerificationUser ExperienceFraud DetectionSms Authentication+4