Does `fraudulent` mean the customer did something wrong?

Not necessarily. It means Stripe's fraud detection flagged the transaction. The cardholder may be completely legitimate and simply got caught by a rule tuned for a broader pattern of abuse.

Can I just retry the charge later?

You can, but it is unlikely to succeed and repeated attempts against a Stripe fraud block can affect your account's risk standing. Treat it as a signal to review, not a signal to retry.

Should I email the customer to fix their card?

Only after checking that the account looks legitimate. If the account was created recently, has other declined cards, or shows unusual usage, hold off and review manually first.

Why doesn't Foxhound send its normal dunning email for this code?

Because `fraudulent` sits in Foxhound's fraud classification bucket, which suppresses the automated retry and email sequence in favor of flagging the case for careful handling.

Is this the same as a chargeback?

No. A chargeback happens after a successful charge, when the cardholder disputes it with their bank. `fraudulent` happens before the charge succeeds, when Stripe's own systems block it up front.

Decline code

Fraudulent

Stripe declined this payment because its fraud detection flagged the transaction as suspicious. This is Stripe's own risk system speaking, not the issuing bank. Stripe's systems look at the card details, the device, the IP address, the transaction pattern, and a range of other signals before a charge ever reaches the bank, and when enough of those signals line up wrong, Stripe blocks the charge itself. The decline code `fraudulent` is Stripe stating, in its own words, that "the payment was declined because Stripe suspects that it's fraudulent." That distinction matters. Most decline codes on this list come from the cardholder's bank. This one comes from Stripe's Radar fraud engine sitting in front of the transaction. The card itself might be perfectly valid and the cardholder might be the legitimate account owner, but something about the attempt (a mismatched billing address, a device with a bad reputation, a velocity pattern that looks like card testing) tripped a rule.

Back to decline codes

fraudulentNever retried

Draft content: this page's explanatory copy is Pass 3 template writing pending a dedicated content pass. The classification badge above and the recovery behavior described below are live, not draft: both come directly from the recovery engine.

Why it happens

For a SaaS business, `fraudulent` usually shows up in one of two contexts. First, at signup: someone is testing a stolen card number against your checkout page, often as part of a larger card-testing operation hitting many merchants at once. Second, on a renewal charge for an account that has been active for a while, where a compromised card was used at signup and the fraud signal only becomes clear once Stripe accumulates more data on the pattern. Recurring billing without three-D Secure at signup gives fraudsters a way to validate stolen cards cheaply, and Stripe's fraud scoring is one of the mechanisms that catches this after the fact.

How to fix it

No. Retrying a charge that Stripe itself flagged as fraudulent does not fix anything, because the block is coming from Stripe's own risk assessment, not a temporary issue at the bank. Retrying repeatedly against a Stripe fraud block can also hurt your account's standing with Stripe, since it looks like the kind of behavior fraud systems are built to catch. Do not automatically retry. Do not automatically re-email the customer asking them to update their card, since if the account itself was created fraudulently, that email goes to the wrong person or invites the fraudster to try a different card. Pull up the account: how old is it, does the billing name match anything else on file, were other cards on the same account also declined, is the usage pattern consistent with a real customer. If the signals look legitimate (an established customer whose card just got caught by an overzealous rule), a human can review and decide whether to ask the customer to retry the charge themselves through a hosted payment page, which carries its own fresh risk signals. If the signals look bad, the right move is to lock the account and stop billing, not to keep trying.

How Foxhound recovers it

Fraud and security declines are never retried, silently or otherwise. Foxhound sends a gentle, clearly worded email sequence across 30 days that names the situation plainly and points the customer to their card issuer, rather than repeating the same charge against a flag the issuer already raised.

Questions

Not necessarily. It means Stripe's fraud detection flagged the transaction. The cardholder may be completely legitimate and simply got caught by a rule tuned for a broader pattern of abuse.
You can, but it is unlikely to succeed and repeated attempts against a Stripe fraud block can affect your account's risk standing. Treat it as a signal to review, not a signal to retry.
Only after checking that the account looks legitimate. If the account was created recently, has other declined cards, or shows unusual usage, hold off and review manually first.
Because `fraudulent` sits in Foxhound's fraud classification bucket, which suppresses the automated retry and email sequence in favor of flagging the case for careful handling.
No. A chargeback happens after a successful charge, when the cardholder disputes it with their bank. `fraudulent` happens before the charge succeeds, when Stripe's own systems block it up front.

See what this looks like on your account

The free audit shows what Stripe already recovered and what is still dying, no signup required.

Run your free audit