Abuse Prevention
Abuse prevention rides on the same checkout order call as fraud. There's no separate endpoint or cartridge configuration. The cartridge's job is to carry the order data and enforce whatever decision Forter returns.
Policies are defined entirely in the Forter Portal's Policy Builder: a Policy Type (Item Not Received, Limited Item, Promotion/Coupon, Reseller, Reshipper, or Returns) paired with an Action (Decline or Monitor).
How each action is enforced
- Decline is enforced exactly like a fraud decline, governed by the same forterCancelOrderOnDecline setting and decline message. See Post-Auth Flow and Pre-Auth Flow.
- Monitor takes no action. The order proceeds, and Forter records the policy hit for its own reporting.
Identifying which policy fired
When a decline is policy-driven, the response includes merchantPolicyId, a GUID identifying the Policy Builder policy that made the call. It's stored as order.custom.forterMerchantPolicyId. See Getting the Decision onto the Order for how decision fields land on the order.
forterMerchantPolicyId is empty on a fraud decline that wasn't policy-driven. Check it on the order's Attributes tab in Business Manager, under the Forter group.