I still remember the first time I got hit by a card testing attack.
It was 3 AM. My phone started buzzing with Stripe notifications. By the time I logged in, a bot had tried 5,000 stolen credit cards on my $9.99 subscription tier.
Most failed. But the ones that went through? They turned into chargebacks three weeks later.
It cost me thousands in fees. It almost got my merchant account banned.
If you are running an SVOD service, you are a target. Fraudsters love streaming platforms because digital goods are easy to test cards on. There is no shipping address to verify.
This is where Stripe Radar comes in.
It is not just a "nice to have." If you use Stripe, it is the only thing standing between your bank account and a massive headache.
Here is how it works, and how to set it up so you don't accidentally block your real paying customers.
What is Stripe Radar?
Stripe Radar is a fraud detection tool built directly into Stripe's payment flow.
Most fraud tools look at your data in a silo. They only know what happens on your website.
Radar is different. Because Stripe processes payments for millions of businesses, they see everything. If a credit card was used for a fraudulent transaction on a shoe store site in London five minutes ago, Radar knows about it.
When that same card tries to sign up for your streaming service in New York, Radar blocks it instantly.
It uses machine learning to score every transaction from 0 to 99.
- 0: Low risk. Probably a real fan.
- 99: High risk. Definitely a bot or a stolen card.
You don't have to install anything extra. If you use Stripe, the basic version is already running in the background.
Why Stripe Radar Matters for OTT
Streaming services face specific types of fraud. We aren't shipping physical boxes, so we don't worry about "item not received" scams as much.
We worry about two things:
1. Card Testing
This is the big one. Fraudsters buy lists of thousands of stolen credit card numbers on the dark web. They need to know which ones still work.
They write a script to sign up for your service. If the $10 charge goes through, they know the card is good. They then go use that card to buy expensive electronics elsewhere.
You get hit with the transaction fees and the eventual chargeback fees.
2. Friendly Fraud
This happens when a real user signs up, watches your content for a month, and then tells their bank they never authorized the charge.
Radar helps here by capturing data proof—like IP addresses and device fingerprints—that you can use to fight the dispute.
How to Implement Stripe Radar
There are two versions of Radar. You need to pick the right one for your stage.
The Default: Radar (Machine Learning)
This comes free with standard Stripe pricing accounts. It uses general logic to block obvious fraud.
It handles the basics:
- Checks CVC (the three numbers on the back).
- Checks AVS (address verification).
- Blocks known bad IP addresses.
For most indie founders launching their first SVOD app, this is enough.
The Upgrade: Radar for Fraud Teams
This costs extra (usually a few cents per transaction). It gives you control.
You can write custom rules. For an enterprise OTT platform, this is mandatory. You need to be able to say, "Block any signup where the IP country doesn't match the card country."
Here is a quick comparison of when to use which.
Best Practices for Setting Rules
If you upgrade to Radar for Fraud Teams, do not go crazy with the rules immediately.
I have seen founders set rules so strict they blocked 20% of their legitimate signups.
Start with these three foundational rules.
1. The Velocity Check
Fraudsters move fast. Real humans do not sign up for five accounts in one minute from the same IP address.
Rule: Block if amount_charges_per_ip_address_hourly > 3.
This stops bots from hammering your signup page.
2. The 3D Secure (3DS) Trigger
3D Secure is that popup that asks the customer to verify the purchase with their bank app. It adds friction, so you don't want it for everyone.
But you do want it for risky transactions.
Rule: Request 3D Secure if risk_score > 60.
This forces the user to prove they own the card only when Stripe thinks something looks fishy.
3. The Geo-Mismatch
If you are a US-only service, you shouldn't be getting signups from Russia or Vietnam.
Rule: Block if ip_country != card_country.
Note: Be careful with this if you have a lot of travelers using your service. But for initial signups, it's usually safe.
Common Challenges and Solutions
Radar isn't perfect. Here is what usually goes wrong and how to fix it.
False Positives
This is when Radar blocks a real customer. It hurts. That customer is likely gone forever.
Solution: Monitor your "Review" queue.
Set a rule to place medium-risk transactions (score 40-60) into "Review" instead of "Block."
Check this queue once a day. If you see a real person (e.g., they used a corporate email address or contacted support), you can manually approve them and refund the charge if necessary to reset their access.
Integration with Your Platform
Stripe Radar works on the payment gateway level. But your OTT platform needs to talk to it.
If Radar blocks a charge, your OTT platform must know not to grant access to the video content.
This is why using a robust platform matters. If you are building on a solution like Vodlix, the integration with Stripe is handled for you.
Vodlix listens for the "charge.succeeded" or "charge.failed" webhooks from Stripe. If Radar blocks the transaction, Vodlix ensures the user doesn't get a free ride.
This seamless connection is critical. You don't want to be in a position where Stripe blocked the money, but your video player is still streaming content to the fraudster.
Final Thoughts
Fraud is a tax on success. The bigger your streaming service gets, the more attention you attract from bad actors.
You don't need a dedicated fraud department to handle this. You just need to configure Stripe Radar correctly.
Start with the default machine learning. If you see chargebacks creeping up, upgrade to Fraud Teams and set the velocity rules I mentioned above.
And ensure your streaming infrastructure can handle the signals Stripe sends back. A platform like Vodlix makes this part easy, letting you focus on acquiring subscribers rather than fighting bots.