Canonical Labs

Incident Response

Stop the attack within days, without blocking everyone.

An attack happening now? We start the same day: find the live vector in your payment data, ship emergency Stripe Radar rules and blocklists within hours of your sign-off, and bring disputes back to baseline.

Talk to a Fraud Expert
Length
4 to 6 weeks
First result
Emergency rules in days
Where
Inside your Stripe
Engineering lift
None

Who it is for

  • Disputes or card testing spiked this week, and it is still going.
  • One account, one ring or one bot is behind a loss you can already see.
  • You need someone in your Stripe today, not after a discovery phase.

What is included

  • The live vector found in your payment data
  • Emergency rules and blocklists, backtested first
  • Rings mapped by card, device and IP
  • Triage of the disputes that already landed
  • Back-to-baseline monitoring and a post-mortem

Inside an engagement. From one $50K+ loss to a live blocklist in a week.

A real client engagement, shown step by step as it happened.

Post-mortem · 4 of 4

The weeks after

  • 2x

    fewer disputes than the four weeks before we started, by week eight

    Four weeks beforeWeek eight

  • −80%

    fraud volume against before we started, five weeks in

    Fraud left, against before we started

  • <0.4%

    dispute rate: fewer than one payment in 250

    One dot, one payment

“We’ve been really happy working with you. At this point we just trust your judgment.”

Engineering lead, collectibles marketplace

$500K

spent since by good customers we found behind one of our own block rules, once we relaxed it

How an Incident Response runs.

No discovery weeks: from the first call to the post-mortem, in a shared Slack channel the whole time.

  1. Same day

    Call and access

    Tell us what you are seeing. We join a shared Slack channel and take a developer seat the same day, with no discovery weeks first.

    Seat and Slack

  2. Day 1

    The live vector

    How the attack works, found in your own payment data: the accounts, cards and devices behind it, and what it has cost so far.

    Vector found

  3. Days 1 to 3

    Emergency rules and blocklists

    Rules and blocklists aimed at the vector, backtested against your good customers first, live within hours of your sign-off.

    Emergency rules

  4. Week 1

    Rings and dispute triage

    Rings mapped by card, device and IP and sent to you to confirm before anything is blocked, and a plan for the disputes that already landed.

    Ring list and dispute plan

  5. Weeks 2 to 4

    Back to baseline

    Emergency blocks relaxed step by step so good customers return, with monitoring that flags the next wave.

    Monitoring

  6. Weeks 4 to 6

    Report and early-warning signals

    A post-mortem of the attack, the rules that stay, and early-warning signals in Sigma so you see the next one coming.

    Post-mortem and signals

  7. After

    While the disputes land

    An attack’s disputes land over 30 to 60 days. We watch them in, and stay on a retainer if you want us to.

    Check-in or retainer

“We’re not out chasing smoking guns. We’re preventing the gun from going off.”

Leadership, trading-card app

Questions buyers ask.

Usually the same day. There are no discovery weeks: a call, a developer seat and a shared Slack channel, and we are reading your payment data. Emergency rules often go live within days.

No. Everything we change lives in Stripe Radar, lists and Stripe settings. Sometimes a signal you already have (account age, trust level, KYC status) would make rules sharper; we write a one-page spec for passing it in the payment metadata, and it is your call whether to ship it.

A developer seat on your Stripe account, Sigma switched on, and a shared Slack channel. You can remove the seat at any time.

Every rule is backtested first, with a list of the good customers it could touch. And we audit our own blocks: on one account we found good customers behind one of our own block rules, and relaxed it.

The configuration stays in your account and keeps working. You get the final report and the playbook, and we check in while disputes mature. A retainer is there if you want us to keep running it.

Our Stripe Radar services work inside Stripe. For other payment providers, ACH, identity checks or anything else, that is what Custom Solutions is for.

Each engagement is fixed in scope and priced on the engagement. We scope it with you on the first call.