Early Fraud Warnings

An Early Fraud Warning (EFW) is a signal, relayed through your processor, that the issuing bank has flagged a charge as fraudulent—usually because the cardholder reported it. An EFW is a strong pre-chargeback signal: acting on it early lets you stop recurring billing before a dispute is filed. Unlike Visa Order Insight, CE, RDR, and Mastercard Consumer Clarity—which are network dispute-prevention programs—EFWs arrive on your processor’s fraud feed. PayNext ingests them from Stripe and Unlimit today, normalizes them into one shape, records them on the payment as fraud_prevention.early_fraud_warning, and reacts on the customer’s subscriptions.

Sources

Each source writes the same fraud_prevention.early_fraud_warning sub-object and triggers the same reaction. Whatever the processor reports natively, PayNext translates it into one fraud type, so you read every EFW the same way.

Source	How it arrives
Stripe (Radar)	Stripe Radar raises the warning; PayNext receives the `radar.early_fraud_warning.created` event.
Unlimit (Fraud Reports)	PayNext ingests Unlimit’s fraud-report feed, deduplicating each report.

New sources can be added without changing the payload. Whatever the source, an EFW always surfaces as fraud_prevention.early_fraud_warning with one of the fraud types below.

Fraud types

Every EFW carries a fraud_type — why the issuer flagged the charge. This is a closed PayNext vocabulary: the value is always one of the seven below, regardless of which processor delivered the warning.

`fraud_type`	Meaning
`unauthorized_use_of_card`	A genuine card was used without the cardholder’s permission—card-not-present fraud, account takeover, or misuse by someone with access to the card. The most common type for online payments.
`made_with_stolen_card`	The card was reported stolen by the cardholder before the transaction.
`made_with_lost_card`	The card was reported lost by the cardholder before the transaction.
`made_with_counterfeit_card`	The transaction was made with a counterfeit (cloned) card.
`card_never_received`	The card never reached the cardholder—intercepted in the mail or at issuance.
`fraudulent_card_application`	The card itself was obtained with a fraudulent application—identity or synthetic fraud at issuance.
`misc`	The issuer’s reason doesn’t map to any of the specific types above.

Subscription handling

An EFW means the cardholder is reporting the charge as fraud—a strong signal that billing should stop. When an EFW lands on a payment that belongs to an active subscription, PayNext cancels the subscription immediately; status becomes cancelled. The cancellation is attributed automatically: the subscription’s cancellation_details.reason is set to fraud_prevention, with trigger_payment_id pointing at the reported payment. This lets you tell fraud-driven cancels apart from your own merchant_initiated ones. All of the customer’s active subscriptions at your account are cancelled. Subscriptions the same customer holds at other merchants are not affected. Track changes via the subscription_v2.cancelled webhook.

An EFW does not issue a refund automatically. If you want to refund the reported charge, do it separately via API or Dashboard.

Setup

Source	What’s required
Stripe	Stripe Radar must be active on your Stripe account (EFWs are a Radar feature). PayNext consumes the warning webhook automatically—no code changes.
Unlimit	Contact PayNext support to enable fraud-report ingestion for your Unlimit integration. Ingestion and deduplication are fully managed.

Once enabled, the reaction is automatic—no code changes are required.

`early_fraud_warning` payload

Recorded on the payment whenever an EFW is received. A later warning for the same payment overwrites the fields (last-write-wins).

{
  "early_fraud_warning": {
    "fraud_id": "issfr_1Q9d2X2eZvKYlo2C4j9rT4Yk",
    "fraud_type": "unauthorized_use_of_card",
    "updated_at": "2026-04-23T12:45:51Z"
  }
}

Field	Type	Description
`fraud_id`	string	Identifier for the warning, assigned by the source processor.
`fraud_type`	string	Why the charge was flagged. One of the fraud types above; a reason that doesn’t map to a specific type is recorded as `misc`.
`updated_at`	string (ISO-8601)	Timestamp of the most recent warning, UTC with `Z` suffix.

Read the payload

Payload state	Meaning
`early_fraud_warning` absent	No EFW has been received for this payment
`early_fraud_warning` present	The issuer flagged this charge as fraud; the customer’s subscriptions have been cancelled with reason `fraud_prevention`
`fraud_type = "misc"`	An EFW was received but the source’s reason didn’t map to a specific type

Webhook events

An EFW fires a payment_v2.updated event (with the updated fraud_prevention block) and, when it cancels a subscription, a subscription_v2.cancelled event carrying cancellation_details.reason = "fraud_prevention". See the Payment and Subscription webhook objects for the full schemas.

Introduction

Use Cases

Platform

Payments

Fraud Prevention

Advanced Features

Developers

Sources

Fraud types

Subscription handling

Setup

`early_fraud_warning` payload

Read the payload

Webhook events

​Sources

​Fraud types

​Subscription handling

​Setup

​early_fraud_warning payload

​Read the payload

​Webhook events

Sources

Fraud types

Subscription handling

Setup

`early_fraud_warning` payload

Read the payload

Webhook events