Square Risk ManagerSquare’s Fraud Detection Tool—What It Covers and Where It Falls Short
In a Nutshell
Square Risk Manager is a customizable fraud detection tool built into your account. It lets merchants set rules around online transactions, like flagging, blocking, or triggering additional authentication for purchases that match suspicious patterns. But, there are two critical limitations that a lot of merchants overlook: it only applies to online transactions, and it plays no role in managing disputes after they’ve been filed
What Protections Does Square Risk Manager Offer Merchants?
In the last chapter, I talked about how the Square dashboard can be a really helpful tool for managing Square chargeback risk. But, I also specified that it was not a reliable solutions for chargeback management.
The dashboard can give you some useful information about past disputes, but it’s not gonna really do anything to proactively stop a chargeback from happening. That’s where Square Risk Manager enters the picture.
Square Disputes
Have questions about how chargebacks work on the Square platform? Start here. This guide covers everything Square merchants need to know about disputes, including how the process works, time limits, fees, tools, and how to fight back.
What is Square Risk Manager?
- Square Risk Manager
Square Risk Manager is a customizable fraud detection tool offered free to all merchants using Square. It lets merchants set rules around online transactions, like flagging, blocking, or triggering additional authentication for purchases.
[noun]/skwer • risk • man • i • jər/
Square Risk Manager monitors incoming online transactions against patterns associated with fraud and lets you choose how to respond — alert, block, or require 3DS authentication — before a payment gets processed. It’s available to all Square merchants at no charge.
Risk Manager monitors the signals associated with incoming online transactions, and picks up on red flags that tend to be associated with fraud, like:
- IP addresses located far from the shipping or billing address
- Mismatches between billing and shipping information
- Multiple orders in rapid succession from the same or similar sources
- Device and browser signals associated with prior fraudulent activity
When Risk Manager detects a pattern that matches your preconfigured rules, it takes the action you’ve specified. It can alert you for manual review, decline the transaction automatically, or trigger 3D Secure (3DS) authentication to try and verify the buyer’s identity. The action it takes is up to you.
How to Activate & Configure Risk Manager
Activating Risk Manager takes a few steps in your Square Dashboard. Configuration involves building rules that determine when the system alerts, auto-declines, or applies 3DS.
Risk Manager is not turned on automatically. The service is inactive by default, and you have to manually enroll your business and configure your custom rules or alert settings to use it. Good news, though: getting up and running with Risk Manager is easy.
To activate the service, simply:
- Login to your Square Dashboard
- Navigate to Payments & Invoices > Risk Manager (you can also search it from the main menu)
- Click Get Started and select the business locations where you want it active
- Click Enroll in Risk Manager
That’s it! You’re now ready to configure your parameters to help fine tune your risk management needs. You can choose to:
- Create a Whitelist: Specific cards or customers that should always be approved regardless of other signals. Useful for trusted regulars and established business accounts.
- Create a Blacklist: Specific payment cards, email addresses, or other identifiers that should be permanently declined in all situations, regardless of other signals.
- Set Custom Rules: Define conditions that trigger a specific action when matched. For example, if α is true, but β is false, then take χ action.
- this is a checklist
For custom rules, you can tell Risk Manager to respond in one of three ways:
- Create an Alert: Notify you to review the transaction manually before deciding
- Decline the Sale: Automatically block the transaction due to high probability of fraud
- Deploy 3DS: Require buyer authentication via 3D Secure before accepting
My advice is to start with alert-based rules, rather than auto-declines. If your rules for auto-declining orders are too broad, you’re going to end up blocking a lot of legitimate customers. That friction has a real cost in terms of lost sales and, ironically, potential disputes from customers who can’t complete a specific action.
Square Risk Manager Only Works for Online Transactions
Risk Manager applies exclusively to online transactions. In-person payments processed through Square hardware — whether a card reader, Terminal, or Register — are completely outside its scope.
Risk Manager only works for transactions that are conducted online. This is one of the most important things to understand about the product.
If you’re an online-only merchant using Square, then Risk Manager is your primary pre-transaction fraud tool and worth careful configuration. But, Risk Manager doesn’t monitor or apply rules to any transactions processed in person through any card-present hardware.
In-person merchants that tend to rely on Square for card processing — food trucks, salons, pop-up retailers, event vendors — get no protection for core sales from Risk Manager. For all these sellers, your primary fraud protection comes from EMV-compliant hardware, transaction practices, and customer verification.
What if you’re a multichannel merchant? Like you make sales both online and in person? Here, Risk Manager covers only your online channel. Your in-person channel requires separate attention.
This isn’t a flaw unique to Square; it’s a deliberate choice that reflects how card-present and card-not-present fraud protection work differently at a technical level. But, it also means that enabling Risk Manager isn’t going to accomplish anything for a large portion of Square’s merchant base.
What Risk Manager Doesn’t Do
Risk Manager prevents suspicious online transactions from processing, but it does nothing for transactions that have already been completed, and it plays no role in managing disputes once they’re filed.
Risk Manager operates exclusively at the pre-authorization stage. Once a transaction gets processed, Risk Manager’s role ends completely. It does not:
- prevent chargebacks on transactions that’ve already been completed
- generate dispute responses or help fight existing disputes
- learn from past dispute outcomes to adjust rules automatically
- flag patterns in your existing dispute history
Square disputes come from three sources: criminal fraud (stolen card details used to make a purchase), merchant error (billing mistakes, fulfillment problems, unclear descriptors), and friendly fraud (a legitimate cardholder abusing the dispute process). Risk Manager is designed specifically to intercept the first category before the transaction processes. Risk Manager provides no protection against merchant error and friendly fraud, though.
Reducing merchant error requires operational improvements: better billing descriptors, accurate order fulfillment, proactive communication. Reducing friendly fraud requires strong documentation practices, clear policies, and willingness to challenge invalid disputes with evidence.
A complete approach to Square dispute prevention is going to use Risk Manager as one component of a broader strategy, not as a standalone solution. Risk Manager is your pre-transaction filter; the Disputes Dashboard is your post-dispute response interface. They’re both complementary components of the same larger strategy I just mentioned.
