Reducing Payment Fraud for Stripe Merchants Without Raising False Declines

You are a product manager at Stripe. How would you make Stripe's fraud detection better without getting in the way of genuine payments? Explain which fraud problems you would go after, what you would change in the product, and how you would show that fraud went down while good customers still got through. ```hint Both errors cost money Treat a genuine payment that gets blocked as a loss, just like a fraudulent one that slips through, and ask which merchants and buyers feel each kind of error most. That changes what a better system should optimize. ``` ### Clarifying Questions - Is the focus fraud against merchants, such as stolen cards and automated card testing, or also bad actors who sign up as merchants themselves? - Which merchants matter most here: small businesses relying on Stripe's default protection, or large businesses with their own fraud teams? - Is success lower fraud losses at today's approval rate, a higher approval rate at today's fraud level, or the lowest combined cost of both? - Should I cover only online card payments, or also wallets, bank payments and in-person payments? ### What a Strong Answer Covers - Framing fraud prevention as a trade-off among missed fraud, false declines and checkout friction, with a way to compare their costs - Segmentation of merchants and fraud types (stolen cards, card testing, disputes raised by real cardholders) and the pain points each creates - Solutions beyond "a better model": graduated responses such as extra authentication, merchant controls and explanations, and work with card issuers - Metrics that capture both sides, including how to estimate false declines that are never observed and how to handle the delay before fraud is confirmed - Risks such as attackers adapting, unfair treatment of some customer groups, and authentication regulation ### Follow-up Questions - Your change cuts fraud sharply, but approval rates for international buyers fall. What do you do? - A wave of card-testing attacks hits small merchants overnight. How should the product respond in the first hour? - How would you get a large merchant with its own fraud team to trust Stripe's decisions?