> ## Documentation Index
> Fetch the complete documentation index at: https://rain-sandbox-trial.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Ledgering Best Practices

> Follow these best practices to spot and prevent common refund fraud when you ledger transactions yourself.

<Check>
  **Partner-managed program only:**

  This page applies to Partner-managed Authorizations Programs. Take note of this information if you're part of this Card Program. Please contact [platform@rain.xyz](mailto:platform@rain.xyz) for inquiries.
</Check>

If you're doing your own ledgering, it's essential to be aware of different fraud vectors. This document lists a few best practices that you should follow to help mitigate some of these risks.

## Regulatory requirement

Given that this is a credit card program, Partner-managed authorization clients can only move funds from their ledgers 24 hours after settlement. In the transaction lifecycle, this means at the time you have received the `transaction.completed` webhook from Rain.

## Do not credit pending refunds

Usually, pending transactions should affect the user's balance. However, if the pending transaction is a credit or a refund, you should wait to credit the user until the refund is completed. This helps avoid potential schemes where users work with merchants to send pending refunds to their cards. While these refunds never settle, crediting the user could allow them to spend more credit than expected.

## Flag first-transaction refunds

As an extension of the above, you should flag a user if their very first transaction is a refund. While possible, it is highly improbable that this user is legitimate. Generally, you should see at least a handful of spending transactions before seeing a refund.

## Block high-refund merchants

As part of the same scheme, some merchant acquirers can be compromised and used to send a large number of pending refunds. If you see a high volume of refunds from the same merchant, it is improbable that they are legitimate. Consider rejecting authorizations from this merchant or [reach out to us](mailto:support@rain.xyz) – we can help investigate.