What we can attribute directly
Stripe published an overview of how it built Radar for fraud prevention.
The system learns from payment-network data and operates as part of real-time payment decisions.
Read Stripe — How we built Radar Primary source · last checked 26 Aug 2026The operating envelope
Very low latency, extreme imbalance, delayed chargebacks, adaptive attackers, merchant variation, and false-decline cost.
Model teams, platform owners, operators, downstream product systems, and people affected by decisions.
Versioned data, configs, traces, artifacts, deployments, and outcomes aligned on one timeline.
Rules become brittle and local merchants lack enough labeled fraud to learn robustly alone.
Trace the system before naming the bug.
- 01
Producers emit versioned data or model artifacts.
- 02
A platform validates, computes, stores, schedules, or routes them.
- 03
Training or inference consumes the exact declared version.
- 04
Telemetry joins the decision to system, data, and model identity.
- 05
Operators compare outcomes, stop conditions, and the last known-good path.
Follow the evidence boundary by boundary.
Symptoms
Rules become brittle and local merchants lack enough labeled fraud to learn robustly alone.
Investigation
Join authorization-time features with mature outcomes; inspect leakage, merchant/country slices, calibration, and attack shifts.
A new attack increases chargebacks before labels mature. Which proxy signals and safe controls can respond without poisoning retraining?
Open investigation scaffold
- Write the earliest known-bad timestamp.
- Compare exact identities on either side of that boundary.
- Find the smallest affected slice and a known-good counterexample.
- Separate mitigation from root-cause confirmation.
Repair the contract, not only the symptom.
Fraud is a changing network problem where labels and exposure are delayed and policy-dependent.
Combine shared statistical learning, contextual signals, rules, feedback, and calibrated operating thresholds.
Rollout
Shadow, canary by merchant cohort, constrain false declines, and retain deterministic controls for active attacks.
Reason about the tempting shortcuts.
- Optimizing global accuracy.
- Assuming yesterday’s calibrated threshold survives an attack shift.
Make recurrence visible early.
Fraud loss and false decline by slice
Define owner, slice, normal range, alert persistence, and the exact mitigation the alert should trigger.
Score calibration and attack clusters
Define owner, slice, normal range, alert persistence, and the exact mitigation the alert should trigger.
Label maturity and review yield
Define owner, slice, normal range, alert persistence, and the exact mitigation the alert should trigger.
Risk modeling connects delayed supervision, adversarial drift, calibrated decisions, and layered controls.
Carry this pattern into assignments as a design constraint and into incident reviews as a hypothesis—not as proof about an unpublished system.