Fraud & Risk
Monitor transaction risk, respond to fraud alerts, and review flagged payments before fulfilling orders.
Why This Matters
Proactive fraud monitoring reduces chargebacks, protects revenue, and keeps your account in good standing. Niftipay flags suspicious activity automatically — but you are responsible for reviewing and acting on those alerts.
Fraud Alerts
Fraud Alerts lists orders auto-flagged with suspicious activity. Filter by status, IP, or email, search, and export to CSV. Not all alerts indicate confirmed fraud — review context before taking action.
Reading an alert
Each row carries the columns Status, Severity, Flags, Amount, Email, IP, Z-Score, Cardholder, Date, and Actions. Severity of New or Critical indicates how urgently the order needs review — flagged items are reviewed before fulfilment.
fp_pro_suspect_score — A high composite risk score from the fraud engine.
fp_pro_proxy — The payment originated from a proxy or anonymising network.
Cross-link: review related Chargebacks, Chargeback Cases, and Blocked Devices views below.
What triggers an alert, and what you can do
Signals
An order appears on Fraud Alerts when it triggers one or more of these:
- Unusual amount — the order amount is significantly higher than your average.
- Disposable email — the email uses a known temporary domain.
- Card or IP velocity — the same card, BIN, IP or device is being used across orders faster than normal.
- Country mismatch — the IP country does not match the country on the payment.
- Processor flag or weak authentication — the processor flagged the payment, 3-D Secure was not used, or the customer retried many times.
Actions
The Actions menu on each row offers two choices. Blocking an IP or email from this page has been retired — real-time fingerprint checks now decide whether a card payment can proceed, and no new blocks are written.
- Mark as reviewed — records that someone has looked at the alert.
- Dismiss — closes the alert without blocking anything.
- Blocking is retired — an alert is a signal for you to act on the order; neither action blocks a customer, and no new IP or email blocks are written.
Risk Alert Events
Where configured for your account, Niftipay can emit risk_alert webhook events when an IP address is flagged for repeated chargebacks. Review these alerts promptly where enabled.
UNDER REVIEW status
Transaction automatically held for manual review. Do not fulfil the order until the status resolves.
risk_alert webhook (where supported)
An IP address associated with your orders has been flagged for repeated chargeback activity.
CHARGEBACK status
A chargeback has been filed. Funds at risk — act immediately.
Chargebacks View
The Chargebacks view shows a daily chargeback count for the selected period, with three totals: chargebacks, paid orders, and the chargeback ratio between them. Search by chargeback ID, order reference or IP address, filter by date range, export to CSV, and click a chargeback ID for full details. Chargeback outcomes depend on payment method, processor, evidence, and merchant agreement.
Chargeback Cases
Chargeback Cases provide an audit view of blocked values, related card data, case status, and chargeback history.
How blocking works
Chargeback Cases is the audit history of the IP and email blocks the legacy fraud system wrote. Automatic and manual blocking are both retired: no new cases are created, nothing on this page refuses a payment today, and real-time fingerprint checks decide whether a card payment proceeds. Each historical case keeps its case number, which was the number shown to a customer when that block refused a payment.
- Columns: Case #, Type (IP or email), Blocked Value, Status, Card Names, Cards, Chargebacks, Created.
- Search by case number, IP address or card name; export the list to CSV.
- Click a case to see the related chargebacks and card details.
- A historical block can still be lifted from this page, which marks the case reinstated.
Blocked Devices
Blocked Devices is a read-only audit history for devices blocked by the legacy fraud system. Manual device blocking has been retired: fingerprint-based real-time checks now decide whether a payment can proceed, no new device blocks are written, and the rows here cannot be changed.
Suspicious Payment Indicators
Multiple failed payment attempts from the same customer
Unusually high transaction amounts outside your normal range
Customer pressure to fulfil an order before payment is confirmed
Mismatched customer details between order and stated identity
Requests to change the payout or delivery address after payment
Next Steps
- 1Include risk_alert webhook handling in your integration
- 2Review UNDER REVIEW orders within 24 hours
- 3Refer to Refunds & Disputes for chargeback escalation steps
Need help? Email support@niftipay.com with your merchant name, order or payment reference, screenshots or error messages, and a short description of the issue.