Stripe Radar and Fraud Prevention for Online Giving
DonorDock Giving Pages include built-in security measures to protect donor information and reduce fraud. Organizations using Stripe can also use Stripe Radar for additional fraud detection and controls at the payment-processor level.
This guide explains the protections built into DonorDock, what card testing may look like, and how Stripe Radar can be used when your organization needs additional fraud prevention.
Security on DonorDock Giving Pages
DonorDock Giving Pages use encrypted connections and secure payment processing to protect information submitted by donors. DonorDock maintains SOC 2 Type II certification, uses HTTPS/TLS connections, and includes CAPTCHA technology on Giving Pages to help protect against automated fraudulent activity.
When Stripe processes payments, Stripe tokenizes sensitive card information rather than storing it on DonorDock servers.
These protections help reduce fraudulent activity, but no online payment form can prevent every attempted fraudulent transaction. Stripe provides additional payment-level fraud protection through Stripe Radar.
What Is Stripe Radar?
Stripe Radar is Stripe's fraud-prevention system. It evaluates payment activity and uses Stripe's fraud models and configured rules to decide whether to allow a payment, block it, send it for review, or require additional authentication.
Radar works within Stripe, so you manage fraud decisions and Radar settings from your organization's Stripe account rather than in DonorDock.
What Is Card Testing?
Card testing occurs when someone uses stolen card information to determine whether the cards are still active. These attempts are often automated and may involve many payment attempts in a short period. Stripe notes that card-testing activity commonly uses lower-dollar transactions and high-volume attempts so the person can quickly determine which cards work.
For a nonprofit, card testing may look like an unusual group of Online Giving transactions or attempts that do not resemble your normal giving activity. You may notice patterns such as:
A sudden increase in small-dollar transactions
Many payment attempts within a short period of time
A large number of declined transactions
Repeated attempts associated with the same IP address
Many different cards or donor details being used rapidly
An individual unusual Gift does not necessarily mean fraud is occurring. Look for patterns and review the corresponding payment activity in Stripe before changing your fraud settings.
Review Suspicious Payments in Stripe
If you notice suspicious Giving Page activity, review the transactions directly in Stripe. Stripe contains the processor-level information used to evaluate the payment, including its payment status and available Radar information.
Depending on the Radar features available on your account, Stripe may also provide information about the payment's risk level, the rules that were evaluated, and why a transaction was blocked or flagged.
Reviewing the activity in Stripe can help determine whether you are seeing an isolated failed payment, legitimate donor activity, or a larger pattern that may require additional fraud controls.
Use Stripe Radar Rules for Additional Protection
Organizations that have access to custom Radar rules can create additional rules based on the type of suspicious activity they are experiencing.
Stripe documents several rules designed to reduce card-testing activity. For example:
Block if :total_charges_per_ip_address_hourly: > 1
This rule blocks additional charges when the same IP address has already attempted more than one charge within the previous hour.
Stripe also provides a more aggressive rule that can be used when repeated blocked transactions are coming from the same IP address:
Block if :blocked_charges_per_ip_address_hourly: > 1
Stripe recommends this type of rule as an additional option for organizations experiencing card-testing activity.
These are examples rather than universal settings that every organization should enable. Your normal donor behavior should be considered before adding restrictive rules.
For example, multiple legitimate donors could submit Gifts from the same IP address when they are using the same office, school, church, event venue, or household internet connection. A rule that is too restrictive could therefore prevent legitimate donations.
Add a Custom Radar Rule
If custom rules are available on your Stripe account, they can be managed from the Rules section of Stripe Radar.
Log in to your Stripe account at dashboard.stripe.com
Open "Radar" and navigate to the Rules section
Locate the appropriate rule type, such as the Block Rules section
Select "Add Rule"
Enter the Radar rule you want to use
Test the rule using Stripe's available testing or backtesting tools
Review the results to determine whether legitimate transactions could also have been affected
Add and enable the rule once you are comfortable with its behavior.
After adding a rule, continue reviewing Stripe activity to make sure it is reducing the suspicious behavior without creating unnecessary problems for legitimate donors.
Temporarily Disable a Giving Page During an Active Attack
If a Giving Page is receiving a significant amount of suspicious activity, you can temporarily stop new Gifts from being submitted while you review the activity and adjust your Stripe fraud settings.
Open the Giving Page and turn on "Disable This Page and Show a Custom Message". Instead of displaying the active donation form, the existing Giving Page URL will display the placeholder message you configure.
This can be useful when you need to stop new submissions immediately without archiving the Giving Page or changing the links and QR codes your organization has already distributed.
After you review the activity and make any necessary changes in Stripe, turn the setting off and save the Giving Page to make the form available again.
Disputes, Chargebacks, and Processor-Level Fraud Decisions
Stripe processes payments and handles processor-level fraud decisions, disputes, and chargebacks. Review and manage these items directly through your Stripe account.
DonorDock Support can help with Giving Page behavior and the Gift records created in DonorDock, but DonorDock does not control Stripe's risk evaluation or decide whether Stripe blocks, approves, or disputes a transaction.
For additional information about Radar rules, fraud reviews, disputes, or a specific suspicious payment, refer to Stripe's current Radar documentation or contact Stripe Support.