Authorize.Net Fraud Hold Triage Brief in Slack

PromptCreate

When Authorize.Net holds a transaction for suspected fraud, draft a triage brief for the risk reviewer instead of piping through the raw alert. The trigger is the Authorize.Net webhook event net.authorize.payment.fraud.held. The related .approved and .declined events are informational and should be ignored; only .held requires human review inside the Authorize.Net Merchant Interface.

Step 1. Take the transId from the webhook payload and call the Authorize.Net Get Transaction Details operation. Pull the AVS response code, the CVV (card code) response code, the transaction amount, the billing email, and any processor messages.

Step 2. Take the billing email and call HubSpot Get Contact using email as the idProperty. Capture whether the contact already exists, their lifecycle stage, and any prior deal value or total spend that HubSpot exposes. If the contact is not found, treat it as a first-time email with no prior history.

Step 3. Post one message to the #fraud-review Slack channel using Slack Send a Message. The message must include: the transaction id and amount, the billing email, a plain-English translation of the AVS code (for example, address matched, ZIP mismatched, address unavailable), a plain-English translation of the CVV code (for example, CVV matched, CVV not provided, CVV mismatched), a note on whether this amount looks normal for this contact based on their HubSpot history or a note that they are a brand new email, and a recommended next action of approve, decline, or investigate further with the reasoning shown as a short bullet list. Include a link to the Authorize.Net Merchant Interface so the reviewer can click through.

Hard rule: the agent only writes a recommendation. It must never call any operation that would resolve, approve, or void the hold. A human clicks through to Authorize.Net to make the final decision, because a wrong auto-approve turns into a chargeback.

Reference: Authorize.Net webhooks documentation at https://developer.authorize.net/api/reference/features/webhooks.html.

What does this prompt do?

Watches Authorize.Net for payments held for fraud review
Looks up the transaction details, card verification results, and any HubSpot history for the billing email
Translates the address and CVV verification codes into plain English so anyone on the team can read them
Posts one Slack message in your fraud review channel with a recommended next step and a link back to the Authorize.Net dashboard

What do I need to use this?

An Authorize.Net merchant account with webhooks turned on for the fraud-held event
A HubSpot account containing your customer records
A Slack workspace with a channel dedicated to fraud review
Access to the Authorize.Net Merchant Interface so a human can actually approve or void the hold

How can I customize it?

Point the alert at a different Slack channel, or split high-value holds into their own channel
Adjust what counts as a normal purchase amount for a returning customer
Tune the approve, decline, and investigate recommendations to match your own risk thresholds

FAQs

Does this automatically approve or decline the payment?

No. The workflow only writes a recommendation. A human still clicks through to the Authorize.Net Merchant Interface to approve or void the hold, which keeps a wrong auto-approve from turning into a chargeback.

Do I need webhooks turned on inside Authorize.Net?

Yes. The workflow starts from the fraud-held webhook event, so outgoing webhooks have to be enabled and pointed at your workspace in the Authorize.Net merchant settings.

What happens if the billing email is not in HubSpot?

The Slack message flags that this is a first-time email with no prior history, so the reviewer knows they are looking at a brand new customer rather than a returning one.

Can I send the brief somewhere other than Slack?

The prompt is written for Slack today. Changing the destination means editing the final step so it posts to email, Microsoft Teams, or wherever your risk reviewer lives.

Will this catch every fraud attempt?

It only triages the transactions that Authorize.Net has already flagged as held for review. It does not scan cleared transactions or create new holds on its own.

Related templates

Call overdue Xero customers with an AI collections agent

Every weekday at 10am, an AI voice agent phones your most overdue Xero accounts, logs what each customer promised, and reports back to finance in Slack.