---
updatedAt: 2026-02-24T22:37:09.000Z
agentTools:
  projectIndex: https://docs.pelcro.com/v2.4/llms.txt
---

# Fraud Prevention

## Overview

Fraud prevention webhooks notify your application when a fraud detection rule is triggered. These events are fired when the system's activity monitoring detects suspicious behavior and a **Notify** action is configured for the matching rule.

> 📘 **Premium Feature**
>
> Fraud Prevention is a premium add-on. Contact <support@pelcro.com> to activate it for your account. Additional fees may apply.

***

## Use Cases

* Alert your security team when suspicious activity is detected
* Log fraud events to an external SIEM or monitoring system
* Trigger manual review workflows for flagged customers
* Track fraud patterns across payment method creation events

***

## Events

| Event                                                      | Description                           |
| ---------------------------------------------------------- | ------------------------------------- |
| [`fraud_prevention.triggered`](#fraud_preventiontriggered) | A fraud prevention rule was triggered |

***

## fraud\_prevention.triggered

### Triggered When

* A fraud prevention rule with a **Notify** action is matched during activity monitoring (e.g., excessive payment method creation attempts).
* The event is dispatched from the `NotifyAction` pipeline action after creating the fraud prevention record.

### Payload

```json
{
  "type": "fraud_prevention.triggered",
  "id": "evt_a1b2C3d4E5f6g7H8i9J0k1L2",
  "created": 1704067200,
  "data": {
    "object": {
      "object": "fraud_prevention",
      "id": 12345,
      "customer": {
        "object": "customer",
        "id": 67890,
        "balance": 0,
        "created": "2024-01-01T00:00:00.000000Z",
        "currency": "usd",
        "delinquent": false,
        "display_name": null,
        "email": "customer@example.com",
        "email_confirm": true,
        "email_hardbounce": false,
        "first_name": "John",
        "has_password": 1,
        "language": "en",
        "last_login_method": "email",
        "last_name": "Doe",
        "mail_marketing": null,
        "metadata": null,
        "object_id": "cus_1a2B3c4D5e6F7g",
        "password_last_updated_at": null,
        "phone": "5551234567",
        "phone_confirm": null,
        "salutation": null,
        "tele_marketing": null,
        "title": null,
        "username": null
      },
      "site_id": 1,
      "source": {
        "object": "source",
        "id": 99999,
        "brand": "visa",
        "country": "US",
        "exp_month": 12,
        "exp_year": 2027,
        "last_four": "4242",
        "object_id": "pm_1a2B3c4D5e6F7g",
        "type": "card"
      }
    }
  }
}
```

> 🚧 **Minimal publishable fields**
>
> The fraud prevention object only exposes `id` and `site_id` from its own model. Sensitive fields like `flow`, `event`, `action`, `data`, and `marked_safe` are **not** included in the webhook payload. The nested `customer` and `source` objects provide the relevant context.

***

## Payload Reference

### Fraud Prevention Object Fields

| Field      | Type           | Description                                                                                                                                                                                     |
| ---------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `object`   | string         | Always `"fraud_prevention"`                                                                                                                                                                     |
| `id`       | integer        | Fraud prevention record ID                                                                                                                                                                      |
| `customer` | object \| null | The customer associated with the fraud event (see [Customer webhook fields](/docs/webhooks-customers#payload-reference))                                                                        |
| `site_id`  | integer        | Site ID where the fraud event occurred                                                                                                                                                          |
| `source`   | object \| null | The payment source involved, if applicable (see [Payment Methods webhook fields](/docs/webhooks-payment-methods#payload-reference)). Present when a `source_id` exists in the fraud event data. |

# Sibling pages

* [Email Templates](https://docs.pelcro.com/v2.4/docs/e-mail-templates-for-webhooks.md)
* [Addresses](https://docs.pelcro.com/v2.4/docs/webhooks-addresses.md)
* [Bills](https://docs.pelcro.com/v2.4/docs/webhooks-bills.md)
* [Campaigns](https://docs.pelcro.com/v2.4/docs/webhooks-campaigns.md)
* [Charges](https://docs.pelcro.com/v2.4/docs/webhooks-charges.md)
* [Customers](https://docs.pelcro.com/v2.4/docs/webhooks-customers.md)
* [Exports](https://docs.pelcro.com/v2.4/docs/webhooks-exports.md)
* [Invoices](https://docs.pelcro.com/v2.4/docs/webhooks-invoices.md)
* [Members](https://docs.pelcro.com/v2.4/docs/webhooks-members.md)
* [Newsletters](https://docs.pelcro.com/v2.4/docs/webhooks-newsletters.md)
* [Orders](https://docs.pelcro.com/v2.4/docs/webhooks-orders.md)
* [Payment Methods](https://docs.pelcro.com/v2.4/docs/webhooks-payment-methods.md)
* [Plans](https://docs.pelcro.com/v2.4/docs/webhooks-plans.md)
* [Products](https://docs.pelcro.com/v2.4/docs/webhooks-products.md)
* [Subscriptions](https://docs.pelcro.com/v2.4/docs/webhooks-subscriptions.md)
* [Vendors](https://docs.pelcro.com/v2.4/docs/webhooks-vendors.md)