How to Secure Your SaaS Checkout Process
Strengthening Your Checkout Security
Protecting your SaaS checkout process is essential to prevent fraudulent sign-ups and misuse of sub-accounts. By implementing the following security measures, you can significantly reduce risk and create a safer environment for your business and legitimate customers.
1. Use the Latest Funnel/Website Version
For the most secure checkout experience, ensure you are using the latest version of your CRM's funnel and website builder. This version provides native integration with modern payment processors and supports advanced security technologies like 3D Secure authentication.
2. Add Custom Authorization for Trials
If your SaaS product offers a free trial, adding a custom authorization step is a highly effective way to verify the validity of a customer's payment method. This process creates a temporary payment intent to confirm the credit card is real and has sufficient funds, but does not actually charge the customer. The hold is released immediately.
You can configure this in your sales funnel settings under the product's additional options. It is recommended to set the authorization amount equal to your lowest-priced monthly plan.
3. Utilize Integrated Communication Services
Using your CRM's native phone and email services, rather than external providers, can enhance security and reduce financial risk. Integrated services help eliminate latency in billing for usage, which can prevent bad actors from accumulating charges before payment is collected. These services also include built-in security features like sending limits, usage ramps, and error rate monitoring for sub-accounts.
4. Enable Phone and Email Verification by Default
Add an extra layer of verification to your sign-up process.
- Email Verification: This is typically enabled by default for all new SaaS sign-ups. You can also enable it for all existing sub-accounts by navigating to your agency settings, then to Email Services and Sub-Account Settings.
- Phone Verification: You can require new sign-ups to verify their phone number via a security code. This setting can be found in your agency's SaaS Configurator under Security Settings.
5. Leverage Your Payment Processor's Fraud Tools
For comprehensive fraud prevention, use the advanced tools provided by your payment processor, such as Stripe Radar. This system uses machine learning to identify suspicious transactions and allows you to create custom rules to automatically block, review, or require additional authentication for payments.
You can access these tools directly from your payment processor's dashboard. We recommend setting up rules to:
- Require 3D Secure authentication for risky transactions.
- Automatically block payments that match high-risk criteria.
- Flag payments for manual review before they are finalized.
Frequently Asked Questions
What if a scammer still gets through?
If a fraudulent transaction occurs, immediately refund the payment through your payment processor and specifically mark it as fraudulent. This action helps the fraud prevention system learn and block similar attempts in the future.
What is custom authorization?
It's a validation step that places a temporary hold on a credit card to verify its legitimacy and available funds without making a permanent charge, which is ideal for products with a free trial period.
Why use integrated phone and email services?
They reduce billing latency risks and provide built-in security controls like sending limits and usage monitoring that are specifically designed for a multi-account SaaS environment.
How do I enable verification for sign-ups?
Phone verification can be toggled in your SaaS Configurator's Security Settings. Email verification is managed in your agency's Email Services settings under Sub-Account Settings.
What should I do with a flagged payment for review?
Log into your payment processor's fraud review dashboard. As an agency admin, you can manually approve or refund these transactions based on your assessment.