Fraud Prevention: Blocking Mandates#

This guide shows how to block a Direct Debit mandate.

Overview#

Merchants experience fraud through a number of different channels. Oftentimes, particularly for chargebacks, they notice similar payers signing up, again and again, to try and defraud them. Until now merchants did not have a way for blocking these fraudulent payers. This feature provides the capability for merchants to create a blocklist for fraudulent payers based on email_id, email_domain, and bank_account. We match against this blocklist when the payer is setting up the mandate and block the mandate if there is a match.

What can be blocked?#

The blocking feature is applicable only for Direct Debit mandates and can be used across all schemes except for the faster_payments. Pay By Banks will not be blocked. For Instant First Payment where the DD mandate is set up along with the Pay By Bank, only the DD mandate will be blocked, the Pay By Bank will be allowed to go through successfully.

Effect on API Integration#

There are no breaking changes for any of the API integrations and merchants need not do anything from their side. The customer would see the success screen when going through the billing request flow or any Payment Pages which means that they have completed the flow but the mandate would fail later on. This would be similar to failed and cancelled mandate.

Effect of blocking on payments, subscriptions, and instalment_schedules#

Once a mandate is transitioned to a blocked state it becomes inactive and behaves similar to cancelled and failed mandates. We will not be able to create any payments or subscriptions. Blocking has no impact on existing mandates and payments. Only new mandates set up after the block is in place will be impacted.

Adding details to blocklists#

This can be done by following the instructions for the Block API here

There is also a support interface, details about this can be found here

Notifications#

Payer notification#

An email notification is sent to the customer when the mandate is blocked. There won't be any changes to any of the payment pages and the payer will see the success screen. However, we do not tell the customer explicitly that they have been blocked by the organisation in order to avoid them trying different email addresses or bank accounts. We provide the mandate_id as a reference code to the payer in the email which they can use to contact the merchant.

Merchant notification#

mandate_blocked webhook notification is sent to the merchant when the mandate is blocked.

{
  "events": [
    {
      "id": "EV123",
      "created_at": "2014-08-03T12:00:00.000Z",
      "action": "mandate_blocked",
      "resource_type": "mandates",
      "links": {
        "payment": "MD123"
      },
      "details": {
        "origin": "gocardless",
        "cause": "mandate_blocked",
        "description": "The mandate has been blocked because the customer's details matched against an entry in the blocklist populated by you."
      }
    }
  ]
}

Retrieving blocked mandates#

Dashboard#

Merchant can filter for mandate blocked events in the events tab of the enterprise dashboard. This will list all the mandates blocked.

API#

Send GET API request to mandate endpoint with below filter

GET https://api.gocardless.com/mandates?status=blocked

OR send API request to the events endpoint with the below query parameters

GET https://api.gocardless.com/events?resource_type=mandates&action=blocked

Retrieve the block state of a given mandate_id#

Dashboard#

API#

Send GET API request to mandate endpoint. The status of the mandate will be blocked

 GET https://api.gocardless.com/mandates/MD0000S2KNTB2V
 
  {
      "mandates": {
          "id": "MD0000S2KNTB2V",
          "created_at": "2021-09-01T15:36:09.104Z",
          "reference": "ANKITHATEST-3YD936",
          "status": "blocked",
          "scheme": "bacs",
          "next_possible_charge_date": null,
          "payments_require_approval": false,
          "metadata": {},
          "links": {
              "customer_bank_account": "BA0000S4DSSHQK",
              "creditor": "CR00008AWM8AC8",
              "customer": "CU00018NMYB3H1"
          }
      }
  }

Unblocking payers#

What to do if there is a false positive#

Since a mandate can not be unblocked, the merchant has to disable the block for this payer and ask the payer to set up the mandate again.

Alternatively, merchants using the Billing Request Flow or who have done the Custom Payment Pages integration using Billing Request can follow the below steps to set up the mandate again and to reduce the number of steps the payer has to go through.

Using the Billing Request Flow#

Step 1: Create a new billing request#

Pass the customer_id and bank_account_id to create a new billing request.

 POST https://api.gocardless.com/billing_requests
 "billing_requests": {
         "mandate_request": {
             "currency": "GBP"
             // "scheme": "bacs"
         }
         "links": {
             "customer": "CU000176GQ2BXM"
             "bank_account": "BA123456789"
         }
     }

Step 2a: Create a Billing Request flow#

Since we already have the customer and bank_account the payer need not fill out the form. The payer only has to confirm the details.

  POST https://api.gocardless.com/billing_request_flows
 
  {
    "billing_request_flows": {
      "auto_fulfil": true,
      "lock_bank_account": true,
      "lock_customer_details": true,
      "links": {
        "billing_request": ""
      }
    }
  }

Step 2b-1: For Custom payment pages (Using the Billing Request API)#

Confirm the customer and bank account details

  POST https://api.gocardless.com/billing_requests/BR12345678/actions/confirm_payer_details
 

Fulfil the billing request

POST https://api.gocardless.com/billing_requests/BR12345678/actions/fulfil
 

Step 2b-2: For Custom payment pages (Using Direct Debit APIs)#

If you create mandates using the 3 endpoints - customer create, bank account create and mandate create

Since the customer and bank_account are already available the merchant have to only create the mandate using mandate create API

POST https://api.gocardless.com/mandates HTTP/1.1
{
  "mandates": {
    "scheme": "bacs",
    "links": {
      "customer_bank_account": "BA123"
    }
  }
}

What's next?#