A fraudster can rotate emails, devices, and IP addresses for free. Getting new stolen cards is the expensive part. That asymmetry makes the card itself one of the strongest fraud signals available, and Fidro tracks it automatically using Stripe's card fingerprint.
What a card fingerprint is
Every card that passes through Stripe gets a fingerprint: a stable hash of the card number. The same physical card always produces the same fingerprint within your Stripe account, no matter which customer, payment method object, or checkout session it appears in. Two different cards never share a fingerprint.
Fidro reads the fingerprint from the charge data in your existing payment_intent.succeeded webhook. No integration changes are needed — if chargeback prevention is already set up, card fingerprint tracking is already running.
The checks
Three checks run automatically on every analysed payment:
| Check | What it detects | Weight |
|---|---|---|
| Card reuse | The same card used by 2+ other customer emails within 30 days | High |
| Card velocity | 3+ charges on the same card within 24 hours | Medium |
| Card testing | One customer (by email, or IP as fallback) using 3+ different cards within 24 hours | High |
Card reuse
The headline check. One card funding several accounts is the signature of account farming: a fraudster creating multiple accounts with one stolen card, or one person exploiting your free tier or promotional offers repeatedly.
Repeat purchases from the same customer never trigger this check — it only counts other emails seen with the same card. A returning customer using their saved card is invisible to it.
Severity scales with spread: a card seen across 2 other accounts scores lower than one seen across 5.
Card velocity
Many charges on one card in a short window, regardless of which accounts made them. Catches rapid-fire abuse that spreads across identities too quickly for email-based velocity checks to connect.
Card testing
The inverse pattern: one customer cycling through many different cards. This is how stolen card lists are validated — small charges to find which numbers are still live. Beyond the direct fraud, card testing drives up your enumeration ratio under Visa's VAMP program, so catching it protects your standing with the card networks twice over.
Blocking a card outright
When you confirm a card is bad, block its fingerprint so it is dead on arrival regardless of which email or IP presents it next. The fastest way is the Block this card button on any transaction's detail page in your dashboard. You can also do it via the API:
curl -X POST https://api.fidro.io/api/blocklist \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"type": "card_fingerprint",
"value": "Xt5EWLLDS7FJjR1c",
"reason": "Confirmed stolen card - 3 farmed accounts",
"severity": 10
}'
Any future transaction using that card scores as blocked (weight 100), which lands it in the refund range immediately.
Scoping and privacy
All fingerprint queries are scoped to your account. Fingerprints are never compared across Fidro customers — a card flagged in someone else's account has no effect on yours. Note that Stripe fingerprints are also only stable within one Stripe account, so cross-tenant matching would not be meaningful anyway.
Fidro stores only the fingerprint hash Stripe provides. Card numbers never touch Fidro.
Warm-up period
The checks compare against your transaction history, and fingerprints are only recorded from the moment this feature went live. Expect the reuse and testing checks to gain accuracy over your first few weeks of data as history accumulates. If you want your existing transaction history fingerprinted immediately, contact support and we can backfill it from your past Stripe charges.
Tuning
The default thresholds (2+ other emails, 3+ charges, 3+ distinct cards) fit most SaaS and subscription businesses. Edge cases like family members sharing a card across separate accounts sit below the reuse threshold by design. If your business has legitimate shared-card patterns (e.g. corporate cards across employee accounts), Enterprise plans support custom risk weights — contact us.