> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paynext.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Early Fraud Warnings
> React to issuer fraud reports before they become chargebacks—automatically cancel affected subscriptions and surface the warning on the payment.
An **Early Fraud Warning (EFW)** is a signal, relayed through your processor, that the issuing bank has flagged a charge as fraudulent—usually because the cardholder reported it. An EFW is a strong pre-chargeback signal: acting on it early lets you stop recurring billing before a dispute is filed.
Unlike Visa Order Insight, CE, RDR, and Mastercard Consumer Clarity—which are network dispute-prevention *programs*—EFWs arrive on your **processor's** fraud feed. PayNext ingests them from Stripe and Unlimit today, normalizes them into one shape, records them on the payment as `fraud_prevention.early_fraud_warning`, and reacts on the customer's subscriptions.
## Sources
Each source writes the same `fraud_prevention.early_fraud_warning` sub-object and triggers the same reaction. Whatever the processor reports natively, PayNext translates it into one [fraud type](#fraud-types), so you read every EFW the same way.
| Source | How it arrives |
| :-------------------------- | :----------------------------------------------------------------------------------------------- |
| **Stripe (Radar)** | Stripe Radar raises the warning; PayNext receives the `radar.early_fraud_warning.created` event. |
| **Unlimit (Fraud Reports)** | PayNext ingests Unlimit's fraud-report feed, deduplicating each report. |
New sources can be added without changing the payload. Whatever the source, an EFW always surfaces as `fraud_prevention.early_fraud_warning` with one of the fraud types below.
## Fraud types
Every EFW carries a `fraud_type` — why the issuer flagged the charge. This is a closed PayNext vocabulary: the value is always one of the seven below, regardless of which processor delivered the warning.
| `fraud_type` | Meaning |
| :---------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `unauthorized_use_of_card` | A genuine card was used without the cardholder's permission—card-not-present fraud, account takeover, or misuse by someone with access to the card. The most common type for online payments. |
| `made_with_stolen_card` | The card was reported stolen by the cardholder before the transaction. |
| `made_with_lost_card` | The card was reported lost by the cardholder before the transaction. |
| `made_with_counterfeit_card` | The transaction was made with a counterfeit (cloned) card. |
| `card_never_received` | The card never reached the cardholder—intercepted in the mail or at issuance. |
| `fraudulent_card_application` | The card itself was obtained with a fraudulent application—identity or synthetic fraud at issuance. |
| `misc` | The issuer's reason doesn't map to any of the specific types above. |
## Subscription handling
An EFW means the cardholder is reporting the charge as fraud—a strong signal that billing should stop. When an EFW lands on a payment that belongs to an active subscription, PayNext **cancels the subscription immediately**; `status` becomes `cancelled`.
The cancellation is attributed automatically: the subscription's [`cancellation_details.reason`](/guides/platform/subscriptions#cancellation-details) is set to `fraud_prevention`, with `trigger_payment_id` pointing at the reported payment. This lets you tell fraud-driven cancels apart from your own `merchant_initiated` ones.
All of the customer's active subscriptions at your account are cancelled. Subscriptions the same customer holds at other merchants are not affected. Track changes via the `subscription_v2.cancelled` webhook.
An EFW does **not** issue a refund automatically. If you want to refund the reported charge, do it separately via API or Dashboard.
## Setup
| Source | What's required |
| :---------- | :------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Stripe** | Stripe Radar must be active on your Stripe account (EFWs are a Radar feature). PayNext consumes the warning webhook automatically—no code changes. |
| **Unlimit** | Contact PayNext support to enable fraud-report ingestion for your Unlimit integration. Ingestion and deduplication are fully managed. |
Once enabled, the reaction is automatic—no code changes are required.
## `early_fraud_warning` payload
Recorded on the payment whenever an EFW is received. A later warning for the same payment overwrites the fields (last-write-wins).
```json theme={"system"}
{
"early_fraud_warning": {
"fraud_id": "issfr_1Q9d2X2eZvKYlo2C4j9rT4Yk",
"fraud_type": "unauthorized_use_of_card",
"updated_at": "2026-04-23T12:45:51Z"
}
}
```
| Field | Type | Description |
| :----------- | :---------------- | :-------------------------------------------------------------------------------------------------------------------------------------------- |
| `fraud_id` | string | Identifier for the warning, assigned by the source processor. |
| `fraud_type` | string | Why the charge was flagged. One of the [fraud types](#fraud-types) above; a reason that doesn't map to a specific type is recorded as `misc`. |
| `updated_at` | string (ISO-8601) | Timestamp of the most recent warning, UTC with `Z` suffix. |
## Read the payload
| Payload state | Meaning |
| :---------------------------- | :----------------------------------------------------------------------------------------------------------------------- |
| `early_fraud_warning` absent | No EFW has been received for this payment |
| `early_fraud_warning` present | The issuer flagged this charge as fraud; the customer's subscriptions have been cancelled with reason `fraud_prevention` |
| `fraud_type = "misc"` | An EFW was received but the source's reason didn't map to a specific type |
## Webhook events
An EFW fires a `payment_v2.updated` event (with the updated `fraud_prevention` block) and, when it cancels a subscription, a `subscription_v2.cancelled` event carrying `cancellation_details.reason = "fraud_prevention"`. See the [Payment](/webhooks/objects/payment/payment) and [Subscription](/webhooks/objects/subscription/subscription) webhook objects for the full schemas.