jonah-payments-postalcode

[warm summit]

Wouldn't hurt to implement this protection yourself. We take certain measures like implementing rate limits.

You could also consider using our advanced fraud detection: https://stripe.com/docs/disputes/prevention/advanced-fraud-detection

Which as long as you're using Elements, Checkout, etc should be in use by default and doesn't require you to explicitly enable anything

[mortal cave]

We have Radar for teams, does this automatically provide protection against the attack I described, or is it only rate limiting? And in this case, what specifically is being rate limited?

[warm summit]

It's just this: https://stripe.com/docs/rate-limits

All requests to stripe are rate limited

If you need more specific protection, you'd need to implement it yourself

Recommend reading: https://stripe.com/docs/disputes/prevention/card-testing

That suggests some card testing protection measures you can take if you think it'll be a concern in your integration

[mortal cave]

Thank you. Is this a common attack in your experience? I am assuming not too common or else stripe would implement it on their side?

[warm summit]

Hard to say

It doesn't happen to the majority of people if that's what you're asking

But hard to know who will become a target of this sort of attack

If you start finding that you're being targeted, you could implement a captcha to slow/stop the attacks

[dark raft]

jonah-payments-postalcode

[mortal cave]

Thanks @warm summit , you have been a royal help.