# Fraud screening (/docs/integrations/fraud-screening)

Before a card or wallet payment goes to your gateway, Comecero can screen it for fraud. A payment that looks risky is stopped before the bank sees it, so it costs you no gateway fee and no chargeback.

## What is checked [#what-is-checked]

When screening is on for your account, each payment a shopper makes is checked against:

- **Block lists** kept by Comecero: emails, cards, IP addresses and domains seen in fraud.
- **Blocked countries**: the shopper's IP, billing or shipping country.
- **Country mismatch**: the IP country is different from the address.
- **How often**: too many successful or failed payments from the same shopper in 24 hours.
- **A risk score** from the shopper's details and IP address.

Screening runs on payments a shopper makes. It does not run on subscription renewals or other automatic payments.

The rules are set per account by Comecero, with separate rules for test and live. To change them, for example to block or allow a country, contact support.

<Callout>Some accounts can have a risky payment checked with 3-D Secure instead of blocked. The shopper then confirms the payment with their bank, and the payment goes through if the bank approves it. Ask support if you want this for your account.</Callout>

## What a blocked payment looks like [#what-a-blocked-payment-looks-like]

A blocked payment fails like a declined card: HTTP `402`, error code `payment_declined`. The payment is saved with `status: failed` and `risk_decline: true`, so you can tell a fraud block from a bank decline.

```json title="Response 402"
{
  "error": {
    "type": "transaction_error",
    "code": "payment_declined",
    "message": "The transaction could not be processed. Please try again. If the problem continues, please try another payment method or contact support for assistance.",
    "status": 402,
    "meta": {
      "payment": {
        "object": "payment",
        "status": "failed",
        "risk_decline": true
      }
    }
  }
}
```

- The message does not say why, on purpose: it gives a fraudster nothing to work with. Show it to the shopper as it is.
- The answer comes back after a short pause of a few seconds.
- The [`payment:created_failure`](/api/webhooks/payment-created-failure) webhook fires, as for any failed payment.
- In the dashboard, the payment page says it was declined for high risk.

## Trusted customers [#trusted-customers]

When a good customer keeps being blocked, you can trust them. A trusted customer skips the country, mismatch, payment-count and risk-score checks. They still cannot pay with anything on Comecero's block lists.

This needs **Fraud tools** turned on for your account: ask support. Then the dashboard has a **Fraud** page:

- **Fraud checks** lists blocked payments (or all of them) with the reason, and you can search by email.
- **Trust** a customer from a check, by their exact email, with a note and an end date: 30 days, 90 days, 1 year or none.

## Your own checks [#your-own-checks]

Under **Settings > Payment**, in **Card Processing**:

- **Ignore Bad CVV Values**: when set to **No** (the default in live), a card whose security code does not match is refused with `402`, code `invalid_cvv`, and the hold on the card is released.

You can also add your own checks before you create a payment, for example limits on order size or on how many times one email can buy.

## Test a fraud block [#test-a-fraud-block]

In test mode, with screening on, these [test cards](/docs/getting-started/create-an-account#test-cards) are always blocked by fraud screening:

| Card number | Result |
|---|---|
| `4444555566669973` | Blocked: `402`, `payment_declined`, `risk_decline: true` |
| `4444555566669981` | Blocked: `402`, `payment_declined`, `risk_decline: true` |

Use them to check that your checkout shows the message and lets the shopper try another way to pay.