---
title: Abuse Prevention
slug: extensions/abuse-prevention
docTags: 
createdAt: 2026-09-22T18:20:22.602Z
---

Abuse prevention rides on the same checkout order call as fraud. There's no separate endpoint or cartridge configuration. The cartridge's job is to carry the order data and enforce whatever decision Forter returns.

Policies are defined entirely in the Forter Portal's Policy Builder: a **Policy Type** (Item Not Received, Limited Item, Promotion/Coupon, Reseller, Reshipper, or Returns) paired with an **Action** (Decline or Monitor).

## How each action is enforced

- **Decline** is enforced exactly like a fraud decline, governed by the same `forterCancelOrderOnDecline` setting and decline message. See [Post-Auth Flow](https://docs.forter.com/extensions/post-auth-flow) and [Pre-Auth Flow](https://docs.forter.com/extensions/pre-auth-flow).
- **Monitor** takes no action. The order proceeds, and Forter records the policy hit for its own reporting.

## Identifying which policy fired

When a decline is policy-driven, the response includes `merchantPolicyId`, a GUID identifying the Policy Builder policy that made the call. It's stored as `order.custom.forterMerchantPolicyId`. See [Getting the Decision onto the Order](https://docs.forter.com/extensions/getting-the-decision-onto-the-order) for how decision fields land on the order.

`forterMerchantPolicyId` is empty on a fraud decline that wasn't policy-driven. Check it on the order's Attributes tab in Business Manager, under the Forter group.