Set Up Rules with Risk Manager
Risk Manager is a tool that helps you catch and manage payments that pose a potential fraud risk. By creating rules with Risk Manager, you can trigger your own fraud alerts or automatically decline suspicious payments without the need to manually review the payments you process with Square.
What is a rule?
A rule allows you to choose what happens to a payment if certain conditions are met. You can set a rule to either trigger a risk alert, decline a payment or invoke Square 3DS, if enabled on your Square account. You can also set your rule to be based on factors such as the Square risk evaluation, billing or shipping mismatch, invalid CVV or suspicious transaction amounts.
Read more about different rule conditions and payments terms with Risk Manager.
Why do I want to set a rule?
If there are certain conditions of a payment that indicate suspicious behaviour (e.g. a shipping address and billing address do not match), you can set a rule to take automatic action rather than manually reviewing each online payment.
How do I create a rule?
To create a rule within Risk Manager:
Go to Reporting > Risk Manager from your online Square Dashboard.
Click Rules > Create Rule.
Indicate a Rule Name, Action, Location and Condition(s).
Click Activate Rule.
Once your rule is saved, payments that meet the requirements set by your rule conditions will either trigger a risk alert or the payment will be declined.
Which payments are affected by rules?
The only transactions affected by rules are eCommerce payments. Rules will not decline or trigger alerts on payments taken in person or via other payment methods such as Afterpay, Square Invoices or Virtual Terminal.
If you have multiple business locations, you’ll have the option to set different rules for each location or apply a single rule to multiple business locations.
What can I set a rule to do?
You can set a rule to decline a payment or trigger a risk alert on a payment. Note: Setting a risk alert does not stop a payment from processing.
See additional information on managing risk alertswith Risk Manager.
Why do I have rules I didn’t create?
When you first start using Risk Manager, you’ll have two default rules set up. These rules trigger risk alerts when Square gives an incoming payment a High or Moderate risk evaluation. If you want to modify these default rules (e.g. alert me when Square’s risk evaluation on a payment is high and when it’s over $1000) you can delete the default rule and create a new one with those conditions. Until you delete your default rules, you’ll continue to receive alerts for them.
How do I edit a rule?
Rules are not yet editable in Risk Manager. Once a rule is created, it is not possible to be changed. If you need to remove a rule, you can navigate to the Rules tab, select the rule in question and click Delete Rule.
What happens if two or more rules deliver conflicting results?
Rule actions are ranked first by Decline, then by Alert. If you have a payment that hits both a decline rule and an alert rule, the decline will take precedence over the alert.
How do I monitor the performance of a rule?
You can view payments that were flagged by alerts by going to the Alerts tab within the Risk Manager section of your online Square Dashboard.
You can view your declined payments by going to Reporting > Risk Manager > Blocked Payments. You can also view which rule triggered a decline.
Note: Although this tool is designed to help prevent payment disputes, the risk of a payment dispute is present with all card payments. Sellers will continue to be liable for all payments they accept and the disputes they receive. Square is not assuming liability for payments, regardless of the risk evaluation that is delivered.