Triage Authorize.Net fraud holds with a Slack brief

When Authorize.Net holds a transaction for suspected fraud, draft a triage brief for the risk reviewer instead of piping through the raw alert. The trigger is the Authorize.Net webhook event net.authorize.payment.fraud.held. The related .approved and .declined events are informational and should be ignored; only .held requires human review inside the Authorize.Net Merchant Interface.

Step 1. Take the transId from the webhook payload and call the Authorize.Net Get Transaction Details operation. Pull the AVS response code, the CVV (card code) response code, the transaction amount, the billing email, and any processor messages.

Step 2. Take the billing email and call HubSpot Get Contact using email as the idProperty. Capture whether the contact already exists, their lifecycle stage, and any prior deal value or total spend that HubSpot exposes. If the contact is not found, treat it as a first-time email with no prior history.

Step 3. Post one message to the #fraud-review Slack channel using Slack Send a Message. The message must include: the transaction id and amount, the billing email, a plain-English translation of the AVS code (for example, address matched, ZIP mismatched, address unavailable), a plain-English translation of the CVV code (for example, CVV matched, CVV not provided, CVV mismatched), a note on whether this amount looks normal for this contact based on their HubSpot history or a note that they are a brand new email, and a recommended next action of approve, decline, or investigate further with the reasoning shown as a short bullet list. Include a link to the Authorize.Net Merchant Interface so the reviewer can click through.

Hard rule: the agent only writes a recommendation. It must never call any operation that would resolve, approve, or void the hold. A human clicks through to Authorize.Net to make the final decision, because a wrong auto-approve turns into a chargeback.

Reference: Authorize.Net webhooks documentation at https://developer.authorize.net/api/reference/features/webhooks.html.