Fraud Signals Available in Paystack Transaction Data

When you call GET /transaction/verify/:reference or receive a charge.success webhook, the transaction object contains several fraud-relevant fields:

Field	Location	What It Signals
risk_action	Top-level	Paystack's internal risk score: "allow", "deny", or "review". "review" means proceed with caution.
ip_address	Top-level	Customer's IP at time of charge. Velocity-check this against recent failed attempts.
gateway_response	Top-level	Raw card network response: "Approved", "Do Not Honor", "Stolen Card", "Lost Card", "Restricted Card".
channel	Top-level	Payment method: "card", "bank", "ussd", "mobile_money". Card has highest fraud surface.
authorization.bin	Nested	First 6 digits of card. Cross-reference against known fraud BINs from your history.
authorization.country_code	Nested	Card-issuing country. Mismatch with customer's IP country is a weak fraud signal.
authorization.reusable	Nested	If true and the customer has no subscription, the card may have been saved without consent.

// fraud-score.js
var blockedIPs = new Set(); // Load from Redis or DB

function scoreFraud(transaction) {
  var score = 0;
  var flags = [];

  // Hard signals from Paystack risk engine
  if (transaction.risk_action === 'deny') {
    score += 100;
    flags.push('paystack_risk_deny');
  }
  if (transaction.risk_action === 'review') {
    score += 20;
    flags.push('paystack_risk_review');
  }

  // Gateway response signals
  var badResponses = ['Do Not Honor', 'Stolen Card', 'Lost Card', 'Restricted Card', 'Pick Up Card'];
  if (badResponses.some(r => transaction.gateway_response?.includes(r))) {
    score += 25;
    flags.push('bad_gateway_response:' + transaction.gateway_response);
  }

  // IP velocity signals
  if (blockedIPs.has(transaction.ip_address)) {
    score += 30;
    flags.push('blocked_ip');
  }

  // Channel signals — card on large amount
  if (transaction.channel === 'card' && transaction.amount > 5000000) { // NGN 50,000
    score += 10;
    flags.push('large_card_charge');
  }

  // Country mismatch
  var cardCountry = transaction.authorization?.country_code;
  var ipCountry = resolveIPCountry(transaction.ip_address); // your GeoIP lookup
  if (cardCountry && ipCountry && cardCountry !== ipCountry) {
    score += 15;
    flags.push('country_mismatch:' + cardCountry + '_vs_' + ipCountry);
  }

  return { score, flags, action: score >= 50 ? 'hold' : score >= 20 ? 'log' : 'pass' };
}

// Use in webhook handler
if (event.event === 'charge.success') {
  var fraud = scoreFraud(event.data);
  if (fraud.action === 'hold') {
    await db.orders.update({ id: orderId, status: 'fraud_hold', fraud_flags: fraud.flags });
    await alertTeam('Fraud hold on order ' + orderId + ' score ' + fraud.score);
    // Do NOT fulfill the order yet
  } else {
    await fulfillOrder(orderId);
  }
}

This guide is part of the Paystack security guide.

Sign up for the McTaba newsletter