Stripe's Payments Foundation Model: How Data & Infra Create Compounding Advantage, w/ Emily Sands
Summary
Stripe’s defensibility comes from payment density, not raw volume alone. The company processed $1.4 trillion in 2024 and sees roughly 50,000 new transactions per minute; 92% of cards presented to a merchant for the first time have already appeared elsewhere on Stripe. Volumes are growing 38% year over year. Each payment adds context to a network where more data improves models, better models improve merchant economics, and growing merchants return still more data—the “compounding loop” behind Stripe’s intelligence advantage.
The payments foundation model treats transactions as a distinct modality and converts them into reusable representations. Its custom tokenizer efficiently compresses structured signals, while the model learns short histories across buyers, cards, devices, IPs, and merchants, assigning each transaction a vector akin to “latitude and longitude.” Those embeddings can feed Stripe’s hundreds of existing models, making some new applications “a weekend project, not a quarter project” without forcing teams to replace mature systems.
Card-testing detection supplied the clearest proof that this architecture matters economically. Fraudsters hide hundreds of tiny authorizations inside legitimate traffic, but their repeated timing, proxies, and low-entropy identifiers become an isolated cluster in embedding space; detection at large merchants rose from 59% to 97%. The foundation model was initially used internally to propose labels that experts validated before feeding them into a traditional classifier—a pragmatic hybrid, not a wholesale model rewrite.
Stripe is shortening the fraud-response loop while optimizing conversion rather than maximizing blocks. With industry e-commerce fraud up about 15% year over year, Stripe businesses’ dispute rate fell 17%; dynamic thresholds tighten only around an emerging attack slice, while adaptive 3DS introduces authentication as a middle path between approve and reject. ElevenLabs and Character AI were early users, and U.S. checkout users saw an average 30% fraud reduction without a reported conversion hit.
Rules, weak signals, and LLM judges remain essential because definitive fraud labels can arrive months late—or never. Stripe combines model scores with real-time issuer feedback such as CVC or ZIP mismatches, sometimes approving a known-good buyer despite a typo and passing its risk score to the issuer. For suspicious activity and “friendly fraud,” which 47% of businesses reportedly say hurts more than stolen credentials, an LLM judges whether generated explanations fit the transaction’s broader cluster.
The horizontal-AI strategy extends beyond payments into merchant intelligence and practical multimodality. A shared service crawls the web, generates merchant embeddings, and supports risk, credit, Stripe Capital, account-takeover, and sales decisions; teams can request custom findings instead of building separate agents. In shadow testing, one agent assessed merchant-site fraud while another spotted counterfeit goods “orders of magnitude” better than trained human reviewers, including a Spider-Gwen sticker with no sign of official licensing hidden among thousands of products.
Stripe argues that startups should use it as the financial system of record, turning infrastructure reliability into customer operating leverage. Its APIs run at six nines of uptime and usage-based billing handles 100,000 events per second; Lovable reached $100 million ARR in eight months while using Stripe across incorporation, Checkout, Billing, Link, Radar, and analytics. Sands said she thought Retell AI had over $10 million in ARR in its first year; Link powered 38% of its payments and smart retries recovered about 60% of failed charges, illustrating how small teams can outsource financial plumbing.
Agentic commerce is already forming a new distribution channel, but broad autonomous purchasing remains early. Current examples mostly execute clear intent—Perplexity hotel bookings, Hipcamp campsite reservations, or buying Vercel services inside Cursor—while a more discretionary “business in a box” remains prospective. A closing participant pressed whether Stripe’s data position is becoming unassailable; Emily Sands acknowledged differentiated intelligence but kept the strategy bounded to four infrastructure bets, saying Stripe is “not being an AI model shop directly.”
Deep dive
1. Stripe’s transaction network has become an AI training asset
Sands defined Stripe as broader “programmable financial infrastructure”: it supplies the rails and intelligence for everyone from a teenager selling a Figma template to more than half of the Fortune 100. Companies processed $1.4 trillion through Stripe last year, and every charge becomes training data.
Stripe now optimizes the full payment lifecycle—checkout UX, fraud, bank routing, retries, and dispute paperwork—rather than supplying only an API. Sands framed these tools as “structural growth tailwinds,” noting that Stripe businesses grew seven times faster than the S&P 500 last year.
The foundation model turns tens of billions of transactions into compact vectors, “like giving each transaction its own kind of latitude and longitude.” Those representations can support fraud detection, authentication, and dispute decisions without training a new model from scratch for every task.
At roughly 50,000 new transactions per minute, Sands argued that payments begin to resemble language: card BINs, merchant codes, and amounts provide syntax, while reuse patterns across cards and devices provide an analogue to semantics. A custom tokenizer compresses this highly structured, information-dense modality.
2. A payment’s meaning resides in several overlapping histories
The hardest signal is not inside one transaction but across the “combinatorial sequence” surrounding it. Sands compared the task to examining multiple clips containing the same movie frame: the buyer’s, card’s, device’s, IP’s, and merchant’s recent activity may each change its meaning.
A Boston purchase is not inherently fraudulent, but it becomes suspicious when the card was just used from its owner’s device and home IP in Palo Alto. Rotating through a few cards to buy thousands of AI accounts can instead indicate reseller or refund abuse, even when the cards themselves are genuinely owned by the user.
Sands’s graph formulation: people, cards, and merchants are nodes; transactions are edges; the model asks whether those edges make sense together and against history. Because Stripe has previously seen 92% of cards appearing at a merchant for the first time, many decisions require few hops, though novel tail traffic demands wider traversal.
3. Reusable embeddings make Stripe’s existing models compound
V1 used BERT-style masked modeling followed by explicit similarity fine-tuning, clustering neighboring payment sequences while separating “oddballs.” The load-bearing design choice was learning short histories over minutes or the last K transactions rather than modeling an isolated payment.
V1.5 moves toward encoder-decoder setups and compressed sequence memory: a few vectors “distill the full story” without averaging across noise. Lightweight task-specific heads can then operate on the charge path, where decisions must complete within tens of milliseconds.
Labenz asked how large the foundation model is, but Sands did not disclose a parameter count; she emphasized that downstream heads are small and inference mainly places new charges in an existing embedding space. The single-pass setup also avoids the latency of generating a sequence.
Stripe stores the embeddings in Shepherd, its feature-engineering platform, so modelers can first add them to existing systems and measure incremental signal. This does not uplift every mature model automatically, but it can immediately improve lower-priority V1 systems and reveal whether payment, customer, or merchant representations merit deeper investment.
4. Card testing validated both the model and a hybrid deployment path
Card testers send hundreds of tiny, 30- or 50-cent authorizations across stolen or enumerated cards, burying them among hundreds of thousands of legitimate charges. Classical models struggled with these “needles in the haystack” because no individual request necessarily looked decisive.
In sequence space, 200 similar requests—perhaps sharing a low-entropy user agent, rotating proxies, and arriving every 40 seconds—“light up as an island.” Applying the foundation-model approach raised card-testing detection at large merchants from 59% to 97%.
Sands then disclosed an earlier internal step: the foundation model first generated card-testing labels, expert humans validated them, and those labels trained Stripe’s traditional production classifier. The immediate gain came from a better source of truth before Stripe deployed the new architecture directly.
5. Fraud defense works best as an adaptive policy, not a binary score
Attackers iterate, so Stripe’s objective is to shorten the interval between a new tactic and an adapted defense. Sands contrasted industry e-commerce fraud, up about 15% year over year, with a 17% decline in dispute rates for businesses running on Stripe.
Dynamic risk thresholds watch for elevated-score clusters within slices such as geography, card BIN, cart size, or IP behavior. When a slice resembles an attack, Radar lowers the blocking threshold specifically there, preserving normal revenue flow rather than globally tightening every merchant transaction.
Adaptive 3DS supplies a “soft block”: instead of approving or rejecting a marginal payment, Stripe requests bank or issuer authentication. Legitimate buyers tend to complete it while attackers do not; ElevenLabs and Character AI adopted the feature, and U.S. checkout users experienced an average 30% reduction in fraud without an effect on conversion.
“Rules are good, but they’re also blunt,” Sands argued. Stripe therefore intersects risk scores with issuer feedback: a risky transaction plus a wrong CVC is blocked, while a familiar buyer’s likely typo may pass, with Stripe sharing its risk score so the issuer can understand why.
6. Faster iteration depends on creative labels and layered defenses
Labenz’s pushback—worth keeping—was that AI remains vulnerable to adversarial optimization: attackers can repeatedly test payments, infer gaps, and exploit them before definitive disputes arrive. He compared the risk to superhuman Go systems defeated by attacks that no competent human would accept.
Sands narrowed the comparison: Stripe exposes products and APIs, not raw weights, reducing the available attack surface. More importantly, “the relevant alternative isn’t perfectly airtight”; it is a conventional system whose seven-day counter may simply teach an attacker to strike on day eight.
Stripe’s answer is a layered system of models, rules, 3DS challenges, merchant controls, signup defenses, and other system-level protections. Fraudsters are therefore not fighting one classifier but “a whole system” whose interactions remain opaque even when individual transactions can be probed.
Ground truth may take days or months, while some abuse never becomes a dispute. Stripe uses proxy labels, real-time issuer signals, human review, and LLM judges; Sands’s broader product lesson was, “Don’t constrain yourself to being a modeler”—ask selectively for inexpensive additional information when it can resolve uncertainty.
7. LLM judges fill gaps where no authoritative fraud label exists
Sands highlighted “friendly fraud”—free-trial, reseller, and refund abuse—as especially damaging to AI companies because inference creates real marginal cost. She cited 47% of businesses as saying it hurts more than traditional stolen-card fraud, despite the misleadingly benign name.
The foundation model flags suspicious payments and generates explanations such as enumerated emails, cycling IP addresses, or concentrated devices. An LLM judge then evaluates each transaction-label pair against its cluster and tag definition, passing sufficiently trustworthy explanations to customers while withholding noisy ones for improvement.
This is output-level interpretability rather than neuron-level mechanistic interpretability. Sands said Stripe is not dissecting individual neurons; it needs actionable explanations that let an analyst—or a follow-on agent—decide why an account or payment was marked suspicious.
8. Merchant intelligence turns repeated web research into shared infrastructure
Stripe’s Merchant Intelligence service searches the web, generates merchant embeddings, and supplies features to merchant-risk models. It supports questions spanning network eligibility, fraud, account takeover, creditworthiness, Stripe Capital, and go-to-market prioritization.
Model owners can ask the service for custom intelligence—whether a merchant offers a payment method or appears to sell counterfeit goods—without each team rolling its own LLM workflow. Sands presented centralization itself as a major source of leverage.
New modalities are treated as tools invoked by a router rather than reasons to redesign the entire stack. Sands is interested in a financial-time-series encoder but had nothing ready to share; images and merchant-site content are already showing promise at the merchant layer.
Two agents remained in shadow testing: one relentlessly crawled sites for fraud, while another found counterfeit products “literal orders of magnitude better” than trained reviewers. The latter isolated a Spider-Gwen sticker with no sign of official licensing yet recognized that a tagged, secondhand Canada Goose item was fair game.
9. Reliable talk-to-data starts with clean schemas and visible reasoning
Sigma Assistant benefits from Stripe’s transaction data being useful, well structured, and well documented. Sands argued many natural-language analytics failures are really “garbage in, garbage out” failures whose broken schemas or underlying data are mistaken for text-to-SQL problems.
When confidence is reasonable, Sigma returns the answer alongside a plain-language account of its interpretation: the Black Friday dates selected, the UTC timestamps used, the comparison years, and the growth calculation. This lets a non-analyst inspect assumptions instead of blindly trusting generated SQL.
Sands’s diagnostic question was, “Is your data interesting to talk to?” If it is, organizations should improve structure and documentation before adding a language interface; visible reasoning then allows them to answer a wider range of questions without pretending uncertainty has disappeared.
Repeated questions also become product signals. Stripe can turn common usage-based-billing metrics into dashboard views and benchmark a company against peers, using Merchant Intelligence to identify comparable websites with similar customers and stages of development.
10. Stripe wants to be the financial database of record for startups
Sands’s recommendation was categorical: startups can treat Stripe as their system of record. Its APIs operate at six nines of uptime, while usage-based billing processes 100,000 events per second with monitoring, alerts, and invoicing already built in.
Mirroring every Stripe event requires synchronization, reconciliation, and parallel monitoring without creating differentiated value. Sigma and Stripe Data Pipeline preserve reporting access, while metadata lets customers attach internal order or shipment IDs; Sands retained a caveat for large enterprises with extensive off-Stripe systems.
Lovable reached $100 million ARR in eight months after using Stripe Atlas, the Optimized Checkout Suite, Billing, Link, Radar, and Sigma; the Optimized Checkout Suite localized it across more than 100 countries with roughly 150 payment methods. Sands’s framing was that Stripe handled the plumbing while a small team concentrated on product and growth.
Sands said she thought Retell AI had over $10 million in ARR in its first year; Link powered 38% of its payments, smart retries recovered about 60% of failed charges, and Stripe Tax supported compliance across 100 countries. “Nerds love to buy from nerds,” Sands quipped about Link’s unusually high concentration among AI buyers.
11. Agentic commerce reinforces the moat without changing Stripe’s scope
Agentic commerce is “definitely still early,” but Sands cited meaningful activity: Perplexity can book hotels, Hipcamp agents use virtual cards to reserve difficult campsites, and developers can buy Vercel services inside Cursor. Stripe’s agent toolkit, launched last November, still receives thousands of downloads weekly.
Labenz distinguished these embedded transactions from delegated discretion: the user already has an intent, and the agent supplies connective tissue. Sands could not name customers pursuing deeper autonomy but described a prospective “business in a box” that selects and procures an entire startup stack; she said it would not arrive tomorrow, though inefficient SaaS procurement leaves “a there there.”
A closing question asked whether Stripe’s scale makes its position effectively unassailable. Sands answered that financial services remains broad, but agreed the intelligence loop compounds: data improves models, models improve merchant value, merchants grow, and more transactions return to Stripe; multiprocessor Radar, Billing, and the Optimized Checkout Suite extend that network beyond Stripe-processed payments. Stripe says volumes are growing 38% year over year.
Stripe’s four stated AI bets are serving AI companies—already two-thirds of the Forbes AI 50—enabling agent commerce, embedding Stripe inside tools such as Vercel, Replit, Cursor, and Mistral’s Le Chat, and expanding its own foundation-model intelligence. Sands would not rule out a fifth, but the current mission is “economic infrastructure for AI,” not being an AI model shop directly.