Payment Fraud at Checkout

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // The browser does NOT compute the Risk Score. The callback's first arg
  // is the client IP the server saw (not a score). Keep the requestID:
  // it is your join key to the webhook you receive server-side.
  mod.forceCheckAuthenticatedUser('a1b2c3d4hasheduserid', (ip, requestID) => {
    document.getElementById('shield-request-id').value = requestID;
  });
</script>

<form id="checkout-form" method="POST" action="/api/checkout">
  <input type="hidden" id="shield-request-id" name="shieldRequestId" />
  <!-- payment fields -->
  <button type="submit">Pay</button>
</form>

app.post('/api/checkout', async (req, res) => {
  const { shieldRequestId, paymentData, userId } = req.body;

  // Wait up to ~2s for the webhook; falls back to the History API.
  const shield = await waitForScore(shieldRequestId, 2000);

  // No result yet is not the same as "clean". Hold for review rather than
  // silently letting a payment through on missing data.
  if (!shield) {
    return res.status(202).json({ status: 'review', reason: 'verifying' });
  }

  const score = shield.score;

  // High band: your code decides to block or hard-challenge.
  if (score >= 60) {
    await flagForReview(userId, shield);
    return res.status(202).json({
      status: 'verify',
      reason: 'Extra verification is required to complete this payment.',
    });
  }

  // Medium band: step up to 3DS / OTP before the charge.
  if (score >= 30) {
    return res.status(202).json({ status: 'step_up', method: '3ds' });
  }

  // Clean / Low band: proceed with the charge in your own flow.
  return processPayment(paymentData, userId, res);
});