Triage Authorize.Net fraud holds with a Slack brief
Turn every held Authorize.Net payment into a plain-English review card in your fraud channel with an approve, decline, or investigate recommendation.
Authorize.Net
HubSpot
SlackFinanceOperationsNotifications & AlertsFeedback TriageWhen Authorize.Net holds a transaction for suspected fraud, draft a triage brief for the risk reviewer instead of piping through the raw alert. The trigger is the Authorize.Net webhook event net.authorize.payment.fraud.held. The related .approved and .declined events are informational and should be ignored; only .held requires human review inside the Authorize.Net Merchant Interface.
Step 1. Take the transId from the webhook payload and call the Authorize.Net Get Transaction Details operation. Pull the AVS response code, the CVV (card code) response code, the transaction amount, the billing email, and any processor messages.
Step 2. Take the billing email and call HubSpot Get Contact using email as the idProperty. Capture whether the contact already exists, their lifecycle stage, and any prior deal value or total spend that HubSpot exposes. If the contact is not found, treat it as a first-time email with no prior history.
Step 3. Post one message to the #fraud-review Slack channel using Slack Send a Message. The message must include: the transaction id and amount, the billing email, a plain-English translation of the AVS code (for example, address matched, ZIP mismatched, address unavailable), a plain-English translation of the CVV code (for example, CVV matched, CVV not provided, CVV mismatched), a note on whether this amount looks normal for this contact based on their HubSpot history or a note that they are a brand new email, and a recommended next action of approve, decline, or investigate further with the reasoning shown as a short bullet list. Include a link to the Authorize.Net Merchant Interface so the reviewer can click through.
Hard rule: the agent only writes a recommendation. It must never call any operation that would resolve, approve, or void the hold. A human clicks through to Authorize.Net to make the final decision, because a wrong auto-approve turns into a chargeback.
Reference: Authorize.Net webhooks documentation at https://developer.authorize.net/api/reference/features/webhooks.html.
What does this prompt do?
- Watches Authorize.Net for payments held for fraud review
- Looks up the transaction details, card verification results, and any HubSpot history for the billing email
- Translates the address and CVV verification codes into plain English so anyone on the team can read them
- Posts one Slack message in your fraud review channel with a recommended next step and a link back to the Authorize.Net dashboard
What do I need to use this?
- An Authorize.Net merchant account with webhooks turned on for the fraud-held event
- A HubSpot account containing your customer records
- A Slack workspace with a channel dedicated to fraud review
- Access to the Authorize.Net Merchant Interface so a human can actually approve or void the hold
How can I customize it?
- Point the alert at a different Slack channel, or split high-value holds into their own channel
- Adjust what counts as a normal purchase amount for a returning customer
- Tune the approve, decline, and investigate recommendations to match your own risk thresholds
FAQs
Does this automatically approve or decline the payment?
Do I need webhooks turned on inside Authorize.Net?
What happens if the billing email is not in HubSpot?
Can I send the brief somewhere other than Slack?
Will this catch every fraud attempt?
Related templates
When your flight moves, your calendar times get corrected automatically and you get a Slack note naming the meetings you're about to miss.
Every 15 minutes, forwarded phishing reports get traced back to the server that really sent them, with a verdict in Slack and the worst senders reported.
Twice every weekday, the conversations from your social inbox land on the right HubSpot contact timelines, with a Slack recap for sales.
Every weekday at 7am, sign in to the tender portals you track, filter new notices against your bid criteria, and open a deal for the ones worth chasing.
Every morning, find the addresses that hard bounced or filed a spam complaint, update the matching HubSpot contacts, and post a short Slack recap.
When a HubSpot deal hits Closed Won, the customer's plan, seats and renewal dates land in your DynamoDB accounts table, with a Slack note showing what changed.
Stop reading raw fraud alerts.
Let an agent pull the transaction details, check your CRM, and post a plain-English recommendation in Slack every time a payment is held.