Fraud
20 min read
On this page
Fraud hurts twice. You lose money on bad orders, then you lose more when you panic and block good customers.
You don't pick a single fraud strategy. You run a series of bets and keep the ones that improve your loss-adjusted margin.
Pick Your Mode
Before You Do Anything Else
Most merchants buy fraud tools before doing the basics. Do these first:
- Configure your processor's built-in fraud tools. Stripe Radar, Braintree rules, Adyen RevenueProtect. These are free or cheap and catch obvious stuff. → Processor Rules Configuration
- Use AVS and CVV. Turn them on. Decline on full mismatch. → AVS & CVV
- Prefer chip/tap for in-person. If you're still swiping, stop. EMV shifts liability. → Card-Present Fraud
- Secure your terminals (card-present). Check for skimmers, isolate from your network, use P2PE if possible. → Terminal Security
- Fix your descriptor and communication. "I don't recognize this charge" is the most preventable dispute type. → Descriptors and Comms
- Make refunds easy. A refund costs 3%. A chargeback costs $50+. → Refund Strategy
- Be cautious with real-time bank payments. RTP and FedNow are irrevocable. → FX and Settlement
- Pull your last 20 chargebacks and classify them: actual fraud vs. friendly fraud vs. merchant error
- Call 2 customers who disputed. Ask what actually happened.
- Check if your chargeback ratio is trending up or down
That's it. Everything else can wait.
Under $100K/month: Your processor's built-in tools are enough. Your "fraud" is probably friendly fraud, so focus on chargebacks instead. Don't buy a fraud vendor yet.
$100K–$1M/month: Turn on AVS + CVV, configure your processor's rules, and watch your chargeback ratio. Test one rule change per month.
Over $1M/month: Time for dedicated fraud tooling. Evaluate vendors and run a pilot on one segment before going all-in. Read the Selection Guide.
Over $10M/month: You need a person, not just tools. Build the fraud function. Layer experiments across segments and instrument everything.
Fraud Prevention Setup Path
Build your fraud defenses in this order. Each step builds on the previous.
| Phase | When | Investment | Expected Impact |
|---|---|---|---|
| Basics | Day 1 | Free/included | Catch 60-70% of obvious fraud |
| Intermediate | $50k+/mo volume | $500-2k/mo | Reduce fraud 30-50% more |
| Advanced | $500k+/mo volume | $5k+/mo | Fine-tune last 10-20% |
Don't skip ahead. Most merchants who buy ML fraud tools without doing basics are wasting money.
What's Actually Happening to You? (loss type diagnosis)
Merchants often misdiagnose their fraud problem. Different loss types require different responses.
Loss Types (Merchant-Recognizable Buckets)
| Loss Type | What It Is | Primary Response |
|---|---|---|
| Unauthorized transaction fraud | Stolen card used on your site/store | 3DS, device signals, velocity rules |
| Friendly fraud / chargeback abuse | Customer lies about receiving goods or authorizing charge | Clear comms, delivery proof, CE 3.0 |
| Account takeover (ATO) | Criminal gains access to customer account | Step-up auth, device fingerprinting |
| Refund / return abuse | Customers exploit return policies | Policy limits, abuse detection |
| Promo / loyalty abuse | Coupon stacking, fake referrals, trial cycling | Velocity rules, device linking |
| Identity / signup abuse | Fake accounts, synthetic identities | IDV, device fingerprinting |
| Marketplace / seller fraud | Bad actors on your platform | Platform-specific controls |
| Bank payment fraud (ACH/RTP) | Unauthorized or fraudulent bank transfers | Account verification, irrevocability awareness |
Pull your last 30 losses. Classify each one:
- Stolen card (third-party)
- Customer lying (first-party)
- Customer forgot or regrets (friendly fraud)
- Your mistake (merchant error)
If more than half are friendly fraud, you don't have a fraud problem. You have a customer experience problem.
Who's Behind It (actor types and what works against each)
Different actors require different responses:
| Type | Who | Your Exposure | What Works |
|---|---|---|---|
| Third-Party | Criminal with stolen card | Full liability until you shift it | 3DS, device signals, velocity |
| First-Party | Your customer, lying | Chargebacks you'll probably lose | Better policies, clear descriptors |
| Friendly Fraud | Customer who forgot or regrets | Winnable chargebacks | Transaction enrichment, clear billing |
| Synthetic Identity | Manufactured identity | Bust-out after credit built | Mostly an issuer problem |
| Account Takeover | Criminal with stolen login | Depends on your auth flow | Device fingerprinting, step-up auth |
The uncomfortable truth: Most small merchant "fraud" is first-party or friendly fraud. Stolen cards are dramatic but less common than customers claiming they didn't authorize a charge they definitely made.
Liability Shift: What Actually Protects You (3DS, EMV, CE 3.0)
Not everything that helps you detect fraud shifts liability. The distinction matters.
| Method | Shifts Liability? | When It Applies |
|---|---|---|
| 3D Secure (3DS) | ✅ Yes | CNP transactions where cardholder authenticates |
| EMV Chip (contact) | ✅ Yes | CP transactions; counterfeit liability shifts to issuer |
| EMV Contactless/Tap | ✅ Yes | CP transactions; same as chip |
| Visa CE 3.0 | ✅ Yes | Repeat CNP customers with prior undisputed transactions |
| AVS | ❌ No | Helps you decline; doesn't shift liability |
| CVV/CVC | ❌ No | Defense tool, not liability tool |
| Signature on delivery | ❌ No | Wins disputes; doesn't shift liability |
| Device fingerprinting | ❌ No | Detection tool only |
The hierarchy: 3DS > Chip/Tap > Visa CE 3.0 > Everything else. If you want liability off your plate, 3DS is the answer. Everything else just helps you make better decisions.
Card-Present vs. Card-Not-Present
Different worlds, different fraud, different experiments.
Card-present (retail, restaurants): Your main risk is counterfeit cards, which EMV chip largely solved. If you're still swiping, stop. Chip/tap shifts counterfeit liability to the issuer. Remaining risk is mostly employee fraud and return abuse.
Card-not-present (ecommerce, phone orders): This is where the real fraud lives. No chip to verify, no signature that matters. You're relying on AVS, CVV, device signals, and 3DS. Default liability is on you unless you authenticate with 3DS.
Most of this site focuses on CNP fraud because that's where merchants have real decisions to make.
Network Thresholds (Visa and Mastercard dispute monitoring programs)
Visa and Mastercard will put you in monitoring programs (and eventually shut you down) if your dispute rate gets too high. These are dispute ratios, not fraud ratios. Friendly fraud counts. The networks don't care why you're getting disputes.
Key thresholds: Processors typically flag you around 0.9% (the old VDMP threshold). Visa's VAMP merchant excessive is 2.2% (tightening to 1.5% in 2026) with 1,500+ disputes. Mastercard ECM starts at 1.5% + 100/month. If you're above 0.5%, start worrying. If you're above 0.75%, act now.
See Network Programs Reference for all thresholds, fee schedules, and timelines. See Reduce Chargebacks Fast for the emergency playbook.
Start here: Rules vs. ML. Most teams under $10M should start with rules.
Under $1M: Use your processor's built-in tools. Stripe Radar is fine. Don't buy anything else yet.
$1M-$10M: If you want to outsource the decision, look at Signifyd or Riskified (chargeback guarantees) or Forter (decisions only, no guarantee by default). Test a guarantee model on a segment before going all-in. If you want control, look at Kount or Sift. If account-level fraud (ATO, onboarding) is your problem, look at Sardine.
Over $10M: Layer tools. Consider Sardine for device/behavior alongside a transaction scoring tool.
Operations
Day-to-day fraud operations: managing your review queue, maintaining block lists, reviewing rule performance, and responding to fraud spikes.
Running Fraud Operations covers the full daily/weekly/monthly operational checklist.
Metrics
Fraud Metrics covers what to measure: fraud rate, false positive rate, detection rate, and benchmarks by vertical.
Next Steps
- Fraud Economics - Understand the math
- AVS & CVV - The basics everyone should use
- Processor Rules - Free tools first
- Survive a Fraud Attack - Stop the bleeding
- Velocity Rules - Quick wins
- Manual Review - Triage suspicious orders
- Rules vs ML - Choose your approach
- Vendor Selection - When to buy tools
- Fraud Metrics - What to measure
Start with The Guide, Pathway 3: Protecting from Fraud, a beginner-friendly 20-minute walkthrough that covers what fraud looks like, how to set up free protections, and what to monitor. This page is the full deep dive.
See the Glossary for quick definitions of payments and fraud terms.
See Also
- Chargeback Metrics - Tracking dispute rates
- Chargeback Prevention - Stopping disputes
- Device Fingerprinting - Device intelligence
- Behavioral Analytics - User behavior patterns
- Identity Verification - KYC and IDV
- Processor Management - Working with acquirers
- Holds and Reserves - Program consequences