# Card Fingerprint Tracking

> How Fidro detects the same card used across multiple customer accounts, card testing patterns, and how to block a card outright.

**Category:** chargeback-prevention | **Last updated:** July 26, 2026

---

A fraudster can rotate emails, devices, and IP addresses for free. Getting new stolen cards is the expensive part. That asymmetry makes the card itself one of the strongest fraud signals available, and Fidro tracks it automatically using Stripe's card fingerprint.

## What a card fingerprint is

Every card that passes through Stripe gets a `fingerprint`: a stable hash of the card number. The same physical card always produces the same fingerprint within your Stripe account, no matter which customer, payment method object, or checkout session it appears in. Two different cards never share a fingerprint.

Fidro reads the fingerprint from the charge data in your existing `payment_intent.succeeded` webhook. **No integration changes are needed** — if chargeback prevention is already set up, card fingerprint tracking is already running.

## The checks

Three checks run automatically on every analysed payment:

| Check | What it detects | Weight |
|-------|----------------|--------|
| Card reuse | The same card used by 2+ other customer emails within 30 days | High |
| Card velocity | 3+ charges on the same card within 24 hours | Medium |
| Card testing | One customer (by email, or IP as fallback) using 3+ different cards within 24 hours | High |

### Card reuse

The headline check. One card funding several accounts is the signature of account farming: a fraudster creating multiple accounts with one stolen card, or one person exploiting your free tier or promotional offers repeatedly.

Repeat purchases from the same customer never trigger this check — it only counts *other* emails seen with the same card. A returning customer using their saved card is invisible to it.

Severity scales with spread: a card seen across 2 other accounts scores lower than one seen across 5.

### Card velocity

Many charges on one card in a short window, regardless of which accounts made them. Catches rapid-fire abuse that spreads across identities too quickly for email-based velocity checks to connect.

### Card testing

The inverse pattern: one customer cycling through many different cards. This is how stolen card lists are validated — small charges to find which numbers are still live. Beyond the direct fraud, card testing drives up your enumeration ratio under [Visa's VAMP program](/blog/visa-vamp-2026-chargeback-thresholds), so catching it protects your standing with the card networks twice over.

## Blocking a card outright

When you confirm a card is bad, block its fingerprint so it is dead on arrival regardless of which email or IP presents it next. The fastest way is the **Block this card** button on any transaction's detail page in your [dashboard](/app/transactions). You can also do it via the API:

```bash
curl -X POST https://api.fidro.io/api/blocklist \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "card_fingerprint",
    "value": "Xt5EWLLDS7FJjR1c",
    "reason": "Confirmed stolen card - 3 farmed accounts",
    "severity": 10
  }'
```

Any future transaction using that card scores as blocked (weight 100), which lands it in the refund range immediately.

## Scoping and privacy

All fingerprint queries are scoped to your account. Fingerprints are never compared across Fidro customers — a card flagged in someone else's account has no effect on yours. Note that Stripe fingerprints are also only stable *within* one Stripe account, so cross-tenant matching would not be meaningful anyway.

Fidro stores only the fingerprint hash Stripe provides. Card numbers never touch Fidro.

## Warm-up period

The checks compare against your transaction history, and fingerprints are only recorded from the moment this feature went live. Expect the reuse and testing checks to gain accuracy over your first few weeks of data as history accumulates. If you want your existing transaction history fingerprinted immediately, contact support and we can backfill it from your past Stripe charges.

## Tuning

The default thresholds (2+ other emails, 3+ charges, 3+ distinct cards) fit most SaaS and subscription businesses. Edge cases like family members sharing a card across separate accounts sit below the reuse threshold by design. If your business has legitimate shared-card patterns (e.g. corporate cards across employee accounts), Enterprise plans support custom risk weights — contact us.