# Stripe security audit — Radar, 3D Secure, card testing protection | RootCore LLC > Free Stripe security review — Radar rules, CVC and AVS checks, 3D Secure, block lists, dispute rate. Written report within 24 hours. Page: https://cyber-security.rootcr.com/en/stripe-audit/ Updated: 2026-08-20 --- # Stripe security audit > **In short:** On default Stripe settings most accounts have no CVC or AVS check enabled, no 3D Secure, and empty block lists. A card testing attack runs straight through. During the free audit we review the account settings and send a written report within 24 hours on what is missing and in which order it is worth fixing. ## Why is it worth a look? A large share of Stripe accounts runs on the default Radar settings. Attackers know this: an automated script runs stolen card numbers through your payment form, because nothing at your end stops it. The damage does not come from the attempts themselves but from what follows. Every failed transaction worsens the account's risk profile. Above a 0.75% dispute rate Stripe can suspend the account — funds are frozen, customers cannot pay, and recovery can take weeks or months.
80%
of Stripe accounts run on default Radar
$25B
annual global card fraud loss
0.75%
dispute rate above which Stripe can suspend an account
## What do we review? | Area | What we check | |---|---| | Radar rules | Whether CVC, AVS and 3D Secure rules are enabled or left at their default off state | | Card testing protection | Whether velocity limits exist and whether probing patterns are recognised | | 3D Secure / SCA | Whether strong customer authentication works on supported cards | | Block lists | Whether e-mail, IP, BIN and country lists are populated or empty | | Transaction patterns | Decline rate on recent charges, country mismatches, suspicious clustering | | Dispute rate | The current rate and the distance from the suspension threshold | | Webhook and descriptor | Webhook signature verification and the statement descriptor shown on card statements | ## What the report looks like
RootCore Stripe Security Audit
------------------------------

✗ Radar: CVC check DISABLED
✗ Radar: Postal code check DISABLED
✗ Radar: 3D Secure DISABLED
✗ Block lists: ALL EMPTY (0 items)
✓ Webhook signature verification OK
✓ Statement descriptor SET
⚠ Dispute rate: 0.00% (no data)

Score: 3/10 HIGH RISK

4 critical gaps. This is a sample report, not live data.
## How does it work? 1. **Request.** Fill in the [form](/en/#kapcsolat) or send an e-mail. You do not need to hand over API keys or passwords. 2. **Review.** We go through the list above. Where a setting is not visible from the outside, we write down exactly which screen to look at — or, if that is easier, we go through it together on a call. 3. **Report.** Within 24 hours you get a written summary: what is in order, what is missing, and in which order to fix it. It comes with no obligation. 4. **Configuration, if you want it.** We can implement the fixes, or your own developer can work from the report. ## What not to expect from us - **We do not ask for live API keys** for the audit, and we change nothing in your account without permission. - **We do not see card data** — Stripe does not hand it out, and we do not need it. - **We do not promise zero.** Fraud attempts cannot be eliminated; protection is about making the attempt not worth it and keeping it from doing damage. ## Continuous protection A one-off audit is a snapshot. If you also need continuous monitoring of payment traffic — maintaining velocity limits, refreshing block lists, alerting on attack patterns, watching the dispute rate — we have a monthly plan for that, cancellable and with no minimum term.
Audit
Free
one-off
Request audit
Continuous protection
$29
per month, cancellable
Subscribe
Stripe Technology Partner
## Frequently asked questions ### Is the audit really free? Yes. You get the report and you decide whether you want help with the fixes. There is no hidden cost and no automatic subscription. ### Do I have to give you an API key? No. The audit is based on account settings that we either review together or that you copy from the screens we name. Never send a live secret key to anyone — including us. ### How long does it take? The review itself is short; the report goes out within 24 hours. If you ask for a joint walkthrough, half an hour is usually enough. ### Is this not Stripe's job? Stripe provides the tools — Radar rules, 3D Secure, block lists — but configuring them is the merchant's job. The default state is deliberately permissive so that nobody's payments break; tightening it is your decision. ### What if my account has already been suspended? Then the audit is about what led there and what you need to be able to show Stripe. Lifting a suspension is Stripe's decision — we do not promise that; a documented clean-up is the best thing you can do.