Original Summary

We run a small SaaS where service businesses connect a Stripe Express account to get paid on their invoices. In September two waves of fraudulent accounts went through it. I haven't seen this written up much for smaller Connect platforms, so here's what it looked like. What the signups looked like - They came in bursts. The second wave was four accounts in about 30 minutes, and three of them shared an IP and a device fingerprint. - Names often didn't match the email address, like one name on the account and a completely different person's name in the email. That's a free check. - They moved fast. Create a business, connect Stripe Express, add one customer, create an invoice, all within minutes of signing up. Real users take much longer to get that far. - It was scripted. One account created two $30 invoices exactly one second apart. - Later we got a quieter version: an account opened under a real person's name and email. We only found out because he replied to Stripe's failed-payment email saying he had no idea who we were. What actually caught them We caught the second wave before any card was charged. What mattered: - Checking suspension on every payment route, not just the dashboard. Suspending an account does nothing if an invoice link you already sent still takes payment. We added a test that finds every payment route automatically, so a new one can't skip the check. - Flagging a business that runs several different cards within an hour. That's a card-testing pattern and nothing a real lawn care company does. The one that surprised me We'd been treating "card on file" as a fraud filter. In Stripe test mode, saving a card through a SetupIntent succeeded even with Stripe's own fraud test cards (the chargeDeclinedFraudulent and riskLevelHighest ones). A $1 manual-capture hold declined all of them. As far as we can tell, Radar scores charges, not saved cards. So if your fraud filter is "they added a card," it may not be filtering anything. The gap we still have Everything above catches them at payment time. Nothing stops four accounts from one IP at signup, and that's the next thing we're working on. How are other Connect platforms handling checks at signup without adding friction for real users? (Disclosure since the username gives it away: I'm the founder of CrewNest, a field-service app. No link, just sharing what we ran into.)   submitted by   /u/Crewnest [link]   [comments]

  • 情报分类：开源项目与落地
  • 分类依据：内容涉及项目实践、创业、副业或变现
  • 信息来源：Reddit · SaaS
  • 发布时间：2026/9/30 01:38:37