Clear and descriptive statement descriptors are set in charge payloads
Why it matters
When statement_descriptor or statement_descriptor_suffix is omitted, charges fall back to the Stripe account's legal name — often a holding company or DBA that the customer does not recognize on their bank statement. Unrecognized line items drive chargebacks filed as 'fraudulent transaction' even when the purchase was legitimate, and excess chargeback ratios escalate Stripe Radar risk scoring, raise processing fees, and can trigger account review. This hits the user-experience and content-integrity taxons directly: the customer sees a string they cannot tie back to your store, and the dispute is decided against you regardless of delivery proof.
Severity rationale
Low because the issue surfaces as chargeback friction and post-purchase confusion rather than data loss or takeover.
Remediation
Set a recognizable descriptor on every paymentIntents.create or charges.create call so the value rendered on the bank statement matches the brand the customer transacted with. Keep it between 5 and 22 characters, use only the allowed character set (letters, numbers, space, -, ., ', &), and prefer statement_descriptor_suffix when the Stripe account prefix is already the storefront name. Apply this in src/lib/stripe/createPaymentIntent.ts:
await stripe.paymentIntents.create({
amount,
currency: 'usd',
statement_descriptor_suffix: 'GARDEN SHOP',
})
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Payment Security Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ecommerce-payment-security·automated