Every payment is a frame in a movie. Stripe’s foundation model took card-testing detection from 59% to 97%

Nathan Labenz opens The Cognitive Revolution with a scale check. In 2024 Stripe processed $1.4 trillion in payments, roughly 1.3% of global GDP, for everyone from a teenager selling a Figma template to more than half of the Fortune 100. About 50,000 new transactions arrive every minute. Emily Sands, Stripe’s head of data and AI, says the company is no longer just a payments API. It now sells programmable financial infrastructure across checkout, fraud, bank routing, retries, and dispute paperwork, and businesses on Stripe grew seven times faster than the S&P 500 last year.

Every one of those charges becomes training data. The artifact Sands is here to unpack is a payments foundation model: a transformer that turns tens of billions of transactions into compact vectors, “like giving each transaction its own latitude and longitude.” Downstream teams then use that map for fraud, authentication, and dispute validity without training a new model from scratch each time. Labenz’s framing is that this is a distinct modality hiding in what looks like text, and that no payment is an island.

The proof case is card testing. Fraudsters fire hundreds of tiny authorizations — 30 cents, 50 cents — across stolen cards, burying them in floods of legitimate traffic at a large retailer. Classic models could not find those needles. The foundation model treated the attempts as frames in a movie: two hundred nearly identical requests, the same low-entropy user agent, rotating proxies, arriving about every 40 seconds, lit up as an island in embedding space and got blocked. Detection at large merchants jumped from 59% to 97%.

At Stripe’s density, Sands says, payments start to look a lot like language. There is a syntax: card BINs, merchant category codes, amounts. There is an analog to semantics: how a device or a card gets reused over time. Language transformers learn embeddings so similar words cluster. The premise here is the same: what if every charge, or short sequence of charges, had its own vector? Inputs are the raw signals — card details, merchant categories, IPs — plus what that card, device, merchant BIN, or customer did in the last few minutes or the last k transactions. “It’s actually that history that turns out to be a huge unlock.”

Labenz notes that human working memory holds about seven items and asks what the model sees that people cannot. Sands’s answer is combinatorial. Figuring out whether a fraud attack is happening has very little to do with the particular transaction and almost everything to do with where it sits relative to the transactions around it. “You’re not looking at a single screen. You’re looking at a clip of a movie.” And many clips include that screen: what the buyer was doing, what the merchant was doing, what the card was doing, what the IP was doing. Traditional ML had to hand-engineer counters for each of those sequences. The foundation model learns from all of Stripe’s history, captures subtle interactions a feature list would miss, and, internally, changes how fast new models can be built.

Nothing about using a card in Boston is fraud. If that same device just paid from a home IP in Palo Alto, and the Boston spend looks nothing like the holder’s habits, that is a red flag. Conversely, someone rotating a small number of cards to buy thousands of accounts from an AI provider may own the cards and still be running reseller refund abuse to steal compute. Entities are nodes; transactions are edges. The question is whether those edges make sense together, and against combinations Stripe has seen before. The network is dense enough that 92% of cards a merchant sees for the first time, Stripe has already seen on another merchant — so most hops are short — but fraud and conversion are tail events, so the model also has to traverse wide on novel traffic.

Labenz’s architectural guess is right: this is not next-token prediction. Version 1 used BERT-style masked modeling plus a second stage of explicit similarity fine-tuning, with most of the work in curating sequences, building encodings, and post-training so neighbors in payment space cluster and oddballs separate. Version 1.5 moves toward encoder-decoder setups and compressed memory sequences — a few vectors that distill the full story instead of averaging across noise. Lightweight task-specific heads sit on top. On the charge path, the job has to finish in tens of milliseconds, which means placing new charges and sequences into the dense space, not generating a whole sequence. One forward pass is what keeps latency viable.

Stripe already had hundreds of production models, most of them point solutions built over years of hand-engineered features. The modular trick is that embeddings live in Shepherd, the feature platform, and modelers often start by adding them as just another feature and backtesting. Sometimes that is a false negative: shoving a raw embedding into a six-year-old state-of-the-art model does not move the number. On lower-priority v1 models, there is lift immediately, and that tells the org how much signal comes from understanding the payment versus the customer versus the merchant. Shared embeddings are the organizational lever. Spinning up a new model becomes a weekend project, not a quarter project, which opens the aperture for which ML solutions the team will attempt.

A detail Sands had not revealed before: the foundation model’s first job was not blocking fraud in production. They deployed it internally on card testing, passed labels to expert humans, validated them, and fed those labels into the traditional card-testing model. That older model jumped because it finally had a more comprehensive source of truth. The new model’s first assignment was to teach the old one. The same horizontal pattern now exists for merchants. A Merchant Intelligence service crawls the web, produces embeddings, and answers questions about supportability, fraud, account takeover, creditworthiness, and go-to-market, replacing a pile of teams that had each rolled their own LLM wrapper.

Ecommerce fraud is up about 15% industry-wide year on year, Sands says, while dispute rates for businesses on Stripe are down 17%. The job is to iterate faster than attackers, including in production. Dynamic risk thresholds are one example. A merchant has a Radar score above which traffic is blocked; when an attack starts, Radar learns that a slice of traffic looks collusive — a geo, a set of BINs, a cart size with elevated scores — and lowers the block threshold for that subset. Attacks are almost never a single event. They are clusters. The model is learning a policy of how to act, even if that policy is not yet trained fully online.

Payments are not only pass or block. Adaptive 3-D Secure is the middle arm: a second-factor check with the issuer, common in Europe, uncommon and often needlessly frictional in the United States. Stripe pushes 3DS only when the model thinks the charge may not be good. Legitimate buyers complete it; attackers do not. AI companies feel fraud more than SaaS because inference and compute make marginal costs high. Early adopters were ElevenLabs and Character AI. US checkout users who turned the feature on with one dashboard click saw an average 30% drop in fraud without a conversion hit. Sands’s broader lesson: if users can give you missing information cheaply, “don’t constrain yourself to being a modeler. Be a product thinker.”

Dispute labels arrive late — days to months, after a cardholder notices a bill and a bank files with the network. Stripe does not wait. It uses proxy signals and weak labels all the way to real-time issuer feedback such as CVC or ZIP mismatch. A blunt rule would block every mismatch and kill good revenue from people who fat-finger a code on a phone. Radar instead intersects the model score with the issuer response. A marginally risky user with a wrong CVC gets blocked; a known-good repeat buyer from a legit IP gets through, and Stripe shares its risk score so the issuer is more willing to approve too. Labenz double-checks: they really do let wrong-CVC transactions through. Yes. Rules are useful and blunt. Models are fine-grained and hard to explain. Blending them does better than either camp’s purity test.

Plenty of suspicious payments never become a dispute at all: free-trial cancelers, refund abusers, bot accounts that never check out. Sands cites 47% of businesses saying this so-called friendly fraud — a misnomer, she notes — hurts them more than stolen cards, especially AI companies with real compute costs. The foundation model flags those payments and generates explainers (enumerated email, a small rotating set of IPs). An LLM-as-judge then scores each transaction-label pair against the cluster it belongs to. Labels that are trustworthy enough go to the AI company to action; noisy ones go back for more work. There is no ground truth. The judge fills the gap. And fraudsters are not attacking raw weights. Stripe exposes products and APIs, then layers model defenses, rules, soft blocks, and the merchant’s own signup and bot checks. Attackers fight a system, not one model.

Labenz asks the uncomfortable platform question: with 1.3% of global GDP flowing through the system, is Stripe now unassailable? Sands does not claim the rest of financial services is closed. On data, she says the real advantage is not raw size, even at $1.4 trillion and volumes growing about 38% year over year. It is the compounding loop. More data makes better models. Better models deliver more value. Businesses grow faster and send more transactions through Stripe. That loop is also why Stripe can make horizontal bets. At Sessions it announced modularity: Radar, Billing, and the optimized checkout suite can run multi-processor, on transactions, plans, and checkouts that do not even settle on Stripe, which opens a still larger data network.

Would they raise $10 billion to train a Stripe-1 against Claude and GPT? Sands draws a boundary. Stripe’s mission is the economic infrastructure for AI, showing up as four bets. First, be the best partner for AI companies — two-thirds of the Forbes AI 50 already run on Stripe — on monetization, billing, tax, and fraud. Second, enable agentic commerce for consumers, sellers, and platforms. Third, make Stripe native inside tools developers already use: Vercel, Replit, Cursor, Mistral’s Le Chat. Fourth, deploy the payments foundation model across the network for fraud detection, authorization rates, and a broader intelligence layer. There could someday be a fifth bet. Today they are “hyper-focused on the economic infrastructure for AI, not being an AI model shop directly.” Domain-superhuman payments, delivered through products and APIs, fits the company. An open model shop would also widen the attack surface they have been careful to keep closed.

The same modular instinct shows up in modalities. Payments-plus-text is only the start; new encoders are tools a router can invoke. Sands describes two lightweight merchant agents still in shadow, not production: one crawls sites for fraud and is “incredibly relentless”; the other spots counterfeits orders of magnitude better than trained human reviewers, patiently finding the unlicensed Spider-Gwen sticker in a print shop while correctly treating tagged secondhand Canada Goose as fair game. She is interested in financial time series and images next. The point is not multimodality for its own sake. It is where the extra encoder unlocks a product decision.

Talk-to-your-data products usually die on accuracy anxiety: the model is pretty good, then it makes a mistake, and nobody will hand it to a non-analyst. Stripe has two advantages. Most of what a merchant wants to know — who sold what, for how much, to whom, who retained or churned — already lives in Stripe data. And that data is well structured, because it is generated from robust, documented transaction flows. Many internal projects cannot tell whether text-to-SQL failed or the tables were unlabeled and the rows were not deduped. Stripe leapfrogs that. Models still err, so the product answers only with reasonable confidence and overlays a plain-language explanation: these were the Black Friday dates, these timestamps (most Stripe events are UTC, and many businesses do not think only in UTC), three years of history, this is how percentage growth was computed. Boring on purpose. That layer lets a non-analyst trust the output instead of YOLO-ing it or refusing to use it.

There is a push path too. Usage-based AI startups tend to ask the same investor and operating questions, so Stripe can make those queries great, put them on the dashboard, and benchmark a company against peers. Smart benchmarking is one application of Merchant Intelligence: find websites with similar user bases and a similar stage. Sands is not doing mechanistic interpretability neuron by neuron. The environment is controlled, so the priority is output-level explanation a fraud analyst or a follow-on agent can act on — gibberish email, enumerated name, device concentration — and LLM-as-judge again scores whether the cluster matches the tag, including fraud further up the funnel at account creation, before a card is even entered.

Labenz, a Stripe customer for about a decade, used to mirror transactions so he would not be locked in. Usage-based billing makes that mirror even harder. Sands’s advice is direct: do not. Stripe APIs run at six nines and are safe as a system of record. Usage-based billing APIs process 100,000 events per second with monitoring, alerting, and invoicing built in. A five-to-twenty-person startup gets no differentiation from syncing events, building monitors, and reconciling. Attach an order ID or shipment ID as metadata when you need to join business objects. Use Sigma and Stripe Data Pipeline for analytics instead of standing up a warehouse. Large enterprises with many off-Stripe systems are a different case. Most startups are safer treating Stripe as ground truth.

Lovable is the all-in case study: $100 million ARR in eight months, incorporated via Atlas, optimized checkout localized in over 100 countries with about 150 payment methods, Billing for subscriptions, Link for one-click (“nerds love to buy from nerds,” and AI buyers concentrate there), Radar for fraud, Sigma for analytics. Retail AI, a support-agent company, crossed $10 million ARR in its first year; Link is 38% of its payments, smart retries recover about 60% of failed charges, and Stripe Tax covers 100 countries. On agentic commerce, Sands says it is early and already real: hotels inside Perplexity, Hipcamp booking campsites with virtual cards, developers buying Vercel inside Cursor. A full “business in a box” that picks the vendor stack is not tomorrow, but SaaS procurement is inefficient enough that she thinks there will be a there there. For now the transferable rule is the one she gave on 3DS: stop being only a modeler, and design the cheap extra action that resolves the hard cases.