> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://smartchange.crisp.help/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # Fraud Prevention: How SmartChange Protects Organizations and Donors Every organization on SmartChange deserves a payments platform it can trust. We protect organizations, donors, and the wider giving ecosystem from fraud, money laundering, and sanctions violations. This article explains the layers we use, and the tools your own team can use to keep your account secure. # Real-time payment screening with Stripe Radar Every donation processed through Level Wins, SmartChange's parent company, is checked in real time by Stripe Radar. Radar is Stripe's fraud detection engine. It gives each payment a risk score. A higher score means a greater chance of fraud. We have set up Radar with custom rules for fundraising, where large one-time donations, prepaid cards, and international payments need extra checks. ## Our custom Radar rules | **Action** | **What it checks** | **Why** | |---|---|---| | **Allow** | Matches Stripe's default allow list | Trusted payment patterns | | **Block** | Radar's highest risk level | Automatic high-risk block | | **Block** | Matches Stripe's default block list | Known fraud patterns | | **Review** | Radar's elevated risk level | Elevated risk score | | **Review** | Large payment with a higher risk score | Large and suspicious payments | | **Review** | Prepaid card | Prepaid card activity | | **Review** | Disposable email and prepaid card | Higher-risk combination | | **Review** | Billing address outside the US | Non-US billing address | | **Review** | IP country differs from billing country | Location mismatch | These rules work in layers. Stripe's model blocks the highest-risk payments and flags elevated ones. Our custom rules add fundraising context on top. A prepaid card on its own is flagged for review. Paired with a disposable email, it gets closer scrutiny. A large payment is only reviewed when its risk score is also high, so legitimate major donors aren't flagged. Any flagged payment goes to manual review. Our team looks at each one before it is approved or declined, so legitimate donations aren't blocked by automation alone. ## CVC and address checks We require the card's CVC for every donation. Stripe sends the CVC, postal code, and billing street address to the card issuer, which checks them against its records. If they don't match, the check fails. A failed CVC or postal code check can mean a payment is fraudulent. ## Why prepaid cards get extra scrutiny Prepaid cards are one of the most common fraud methods in online payments. They are often confused with gift cards. **Gift cards** are issued by a retailer or a card network (like a Visa gift card) and loaded with a fixed amount. They usually don't need registration and aren't tied to a named person. Anyone holding the card can spend it. That makes them hard to trace. **Prepaid cards** are issued by a bank or fintech and work like a debit card. They can be reloaded, and most require the cardholder to register a name and address. Legitimate prepaid cards (Chime, Cash App, Green Dot, NetSpend) belong to real people. A Visa or Mastercard gift card runs on the same network as a prepaid card, and payment processors can't always tell them apart. Stripe Radar marks both as prepaid funding, so our rules treat them the same way. We don't block prepaid funding outright. Many legitimate donors use reloadable prepaid accounts. Instead, we flag it for review. We escalate when prepaid funding appears with other risk signals: a disposable email, a mismatched IP, an unusually large first-time donation, or many small donations that add up to a large total in a short time (a money-laundering method known as smurfing). # Anti-Money Laundering (AML) policy Level Wins has a formal AML and Counter-Financing of Terrorism (CFT) policy built on four parts. ## 1. Know Your Donor (KYD) We require full card information and CVV for every donation. Donors must give a verified mailing address and phone number. We do not accept anonymous donations. ## 2. Transaction monitoring Our systems watch donation activity for patterns that don't fit a donor's usual behavior. Stripe Radar screens every payment before it is processed. Our internal systems also alert our founding team when: - A single donation is unusually large - Frequent small donations add up to a large sum in a short time - A donation comes from a country or region with higher money-laundering risk Suspicious payments are caught by Radar at the point of processing. Large donations that do go through get a separate compliance review. ## 3. Suspicious Activity Reports (SARs) When our review finds a donation that can't be explained by lawful activity, we file a Suspicious Activity Report with FinCEN, the Financial Crimes Enforcement Network at the U.S. Treasury. We keep supporting records as federal law requires. The subject of a SAR is never told that a report was filed. Suspicious activity is escalated to our founding team before any further action. ## 4. Compliance oversight and training A designated Compliance Officer oversees our AML program. Staff who handle donation processing get ongoing AML training on new money-laundering methods and rule changes. The program is also reviewed by outside parties from time to time. # Sanctions compliance Level Wins operates only in the United States and follows all applicable U.S. trade and financial sanctions laws. Our sanctions policy applies to everyone connected with the company: employees, contractors, volunteers, agents, and partners. ## What we screen for - Restricted countries, territories, or jurisdictions - Sanctioned people or organizations (OFAC-designated parties) - Unusual or evasive behavior about a donor's identity or where the money comes from - Unusual payment terms, or reluctance to give identity information ## Red flag escalation Any red flag, from automated screening or a staff member, goes straight to company management. No transaction with a possible sanctions concern goes ahead without explicit clearance. Staff are protected from retaliation for reporting concerns in good faith. ## Expanding beyond the U.S. If Level Wins ever operates outside the U.S., we will research sanctions for each new market, update this policy and our contracts, and get management approval first. # Protecting your team's access You can also protect your organization's account. ### Two-factor authentication for your team 1. Click the **Settings** gear in the top bar, then **Compliance**. 2. Under **Security**, turn on **Require two-factor authentication**. 3. Everyone on the organization must then have an authenticator app before they can open the workspace. Each person sets up their authenticator from their own account settings. The **Readiness** panel in Settings → Compliance lists two-factor as optional, and worth turning on. ![Security section with Require two-factor authentication](https://storage.crisp.chat/users/upload-1/website/-/8/f/e/3/8fe32a7262b6a800/settings-compliance-security_2j7zef.jpg) ### Audit log **Settings → Audit log** shows who changed what in your organization, including changes made by the Agent and by connected apps. You can filter it and export it. The log is kept for seven years, and nobody can edit or clear it, including organization owners. See [See who changed what: the audit log](https://smartchange.crisp.help/en/article/see-who-changed-what-the-audit-log-q78qrj/). ![Settings Audit log with filters and Export](https://storage.crisp.chat/users/upload-1/website/-/8/f/e/3/8fe32a7262b6a800/settings-audit-log_16acish.jpg) ### Roles Give each person only the access they need. Only an **Organization owner** can see bank details, issue refunds, and manage the team. See [Understanding Team Roles and Permissions](https://smartchange.crisp.help/en/article/understanding-team-roles-and-permissions-in-smartchange-d1jcrs/). # A layered defense No single tool stops all fraud. That's why our approach has layers: - Stripe Radar scores the risk of every payment in real time - Our custom rules add fundraising context general models may miss - KYD checks donor identity before money is processed - Transaction monitoring catches unusual patterns over time - SAR reporting sends suspicious activity to the right authorities - Sanctions screening keeps us from knowingly processing money tied to restricted parties - Two-factor authentication, roles, and the audit log protect your team's access Questions? Email us at [support@smartchange.app](mailto:support@smartchange.app).