# Fraud
Source: https://paymentsandrisk.com/docs/fraud

Last updated 27 October 2026.

TL;DR

-   Fraud hurts twice. You lose money on bad orders, then you lose more when you panic and block good customers
-   There's no single fraud strategy. You run a series of bets and keep the ones that improve your loss-adjusted margin
-   Pick your mode below: Operator for what to do this week, Analyst for what to measure, Reference for the lookup tables
-   Before you buy anything, find out which [fraud type](https://paymentsandrisk.com/docs/fraud/types/) you actually have. Most SMBs guess wrong
-   Seen a different definition of first- or third-party fraud elsewhere? [The industry does not agree](https://paymentsandrisk.com/docs/reference/fraud-classification/)

20 min read

The same customer keeps disputing? [Match the payment before reviewing future orders](https://paymentsandrisk.com/docs/fraud/types/friendly-fraud/#same-charge-again).

Where to go next

-   [I don't know which kind of fraud I've got](https://paymentsandrisk.com/docs/fraud/types/)
-   [Which fraud tool should I buy first?](https://paymentsandrisk.com/docs/fraud/vendors/)
-   [I want rules I can switch on today](https://paymentsandrisk.com/docs/fraud/detection/building-fraud-rules/)

* * *

Bots keep trying cards? Start with the [attack playbook](https://paymentsandrisk.com/docs/playbooks/survive-fraud-attack/#bots-keep-trying-cards). Need to identify the records first? Use the [card-testing explanation](https://paymentsandrisk.com/docs/fraud/types/card-testing/).

Payouts going to a bank account that isn't yours? Someone may have changed it from your processor login. [Lock the account and report it](https://paymentsandrisk.com/docs/fraud/types/business-banking-ato/#processor-payout-changed).

Someone says they're your processor and wants a login, code or payment? [Check the request first](https://paymentsandrisk.com/docs/fraud/types/bec-phishing/#is-this-really-my-provider).

## Pick Your Mode

[🔧 Operator Actions for this week. Configure processor rules, set up AVS/CVV, tune velocity limits. Start: Processor Rules Config](https://paymentsandrisk.com/docs/fraud/processor-rules-configuration)

[📊 Analyst Metrics and measurement. Fraud rates, false positives, rules vs ML analysis. Start: Fraud Metrics](https://paymentsandrisk.com/docs/fraud/metrics)

[📚 Reference Codes and patterns. Fraud types, card-present vs CNP, liability rules. Start: Fraud Types](https://paymentsandrisk.com/docs/fraud/types)

Popular

[✓ AVS & CVV Start Here The basics everyone should use](https://paymentsandrisk.com/docs/fraud/prevention/avs-cvv)

[🔐 3D Secure Popular Liability shift for online transactions](https://paymentsandrisk.com/docs/fraud/prevention/3ds)

[⚡ Velocity Rules Quick wins for fraud detection](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules)

[⚙️ Processor Rules Configuration Free tools first](https://paymentsandrisk.com/docs/fraud/processor-rules-configuration)

[🎭 Fraud Types Know what you're fighting](https://paymentsandrisk.com/docs/fraud/types)

* * *

## Before You Do Anything Else

Most merchants buy fraud tools before doing the basics. Do these first:

1.  **Configure your processor's built-in fraud tools.** Stripe Radar, Braintree rules, Adyen RevenueProtect. These are free or cheap and catch obvious stuff. → [Processor Rules Configuration](https://paymentsandrisk.com/docs/fraud/processor-rules-configuration/)
2.  **Use AVS and CVV.** The billing-address check and the card's security code. Turn them on. Decline on full mismatch. → [AVS & CVV](https://paymentsandrisk.com/docs/fraud/prevention/avs-cvv/)
3.  **Prefer chip/tap for in-person.** If you're still swiping, stop. EMV shifts liability. → [Card-Present Fraud](https://paymentsandrisk.com/docs/fraud/card-present-fraud/)
4.  **Secure your terminals (card-present).** Check for skimmers, isolate from your network, use P2PE if possible. → [Terminal Security](https://paymentsandrisk.com/docs/fraud/terminal-security/)
5.  **Fix your descriptor and communication.** The descriptor is the name on your customer's statement. "I don't recognize this charge" is the most preventable dispute type. → [Descriptors and Comms](https://paymentsandrisk.com/docs/chargebacks/prevention/descriptors-and-comms/)
6.  **Make refunds easy.** Before a chargeback is filed, compare the sale you're refunding, fees you don't get back and any fulfillment loss with the cost of a dispute. → [Refund Strategy](https://paymentsandrisk.com/docs/chargebacks/refund-strategy/)
7.  **Be cautious with real-time bank payments.** RTP and FedNow are irrevocable. → [FX and Settlement](https://paymentsandrisk.com/docs/payments/reference/fx-and-settlement/)

If You Only Have 2 Hours This Week

1.  Pull your last 20 chargebacks and classify them: actual fraud vs. friendly fraud (a customer claiming they didn't make a purchase they made) vs. merchant error
2.  Call 2 customers who disputed. Ask what actually happened.
3.  Check if your chargeback ratio is trending up or down

That's it. Everything else can wait.

Scale Matters

Start with the problem your own records show. These are suggested planning bands, not spending rules:

**Under $100K/month:** Start with your processor's built-in tools. Classify your disputes before deciding whether you need [chargeback help](https://paymentsandrisk.com/docs/chargebacks/) or fraud screening.

**$100K-$1M/month:** Configure your [processor's rules](https://paymentsandrisk.com/docs/fraud/processor-rules-configuration/) and test changes on a matched segment. Check good orders blocked as well as fraud caught.

**Over $1M/month:** If losses persist after tuning, evaluate dedicated tooling. Run a pilot on one segment before going all-in. Read the [Selection Guide](https://paymentsandrisk.com/docs/fraud/vendors/selection-guide/).

**Over $10M/month:** Check whether review workload and missed fraud justify dedicated staff. Volume alone won't tell you.

### Fraud Prevention Setup Path

Build your fraud defenses in this order. Each step builds on the previous.

```mermaid
flowchart LR
    subgraph BASICS["1. Basics (Week 1)"]
        A1[AVS + CVV] --> A2[Processor Rules]
        A2 --> A3[Clear Descriptors]
    end

    subgraph INTERMEDIATE["2. Intermediate (Month 1)"]
        B1[Velocity Limits] --> B2[3DS for High-Risk]
        B2 --> B3[Address Verification]
    end

    subgraph ADVANCED["3. Advanced (Quarter 1)"]
        C1[Device Fingerprinting] --> C2[ML Scoring]
        C2 --> C3[Custom Rules Engine]
    end

    BASICS --> INTERMEDIATE
    INTERMEDIATE --> ADVANCED

    style A1 fill:#1f6f4a,color:#fff
    style A2 fill:#1f6f4a,color:#fff
    style A3 fill:#1f6f4a,color:#fff
    style B1 fill:#3d5a80,color:#fff
    style B2 fill:#3d5a80,color:#fff
    style B3 fill:#3d5a80,color:#fff
    style C1 fill:#5e4b8b,color:#fff
    style C2 fill:#5e4b8b,color:#fff
    style C3 fill:#5e4b8b,color:#fff
```

These are suggested stages to test, not volume cutoffs or published budgets. Get quotes and compare them with your losses.

| Phase | When | Investment | Expected Impact |
| --- | --- | --- | --- |
| **Basics** | Day 1 | Check included tools and their plan terms | Check which fraud your existing rules catch and which good orders they block |
| **Intermediate** | A measured gap in the basics | Quote the control that addresses it | Test one control on a matched segment; compare fraud losses and completed sales |
| **Advanced** | Gaps persist or review workload grows | Include tools, integration and staff | Keep changes that improve loss-adjusted margin after tool and review costs |

**Don't skip ahead.** Most merchants who buy ML fraud tools without doing basics are wasting money.

* * *

**What's Actually Happening to You? (loss type diagnosis)**

Merchants often misdiagnose their fraud problem. Different loss types require different responses.

### Loss Types (Merchant-Recognizable Buckets)

| Loss Type | What It Is | Primary Response |
| --- | --- | --- |
| **Unauthorized transaction fraud** | Stolen card used on your site/store | 3DS, device signals, velocity rules |
| **Friendly fraud / chargeback abuse** | Customer lies about receiving goods or authorizing charge | Clear comms, delivery proof, CE 3.0 |
| **Account takeover (ATO)** | Criminal gains access to customer account | Step-up auth, device fingerprinting |
| **Refund / return abuse** | Customers exploit return policies | Policy limits, abuse detection |
| **Promo / loyalty abuse** | Coupon stacking, fake referrals, trial cycling | Velocity rules, device linking |
| **[Affiliate / paid-promotion fraud](https://paymentsandrisk.com/docs/fraud/types/affiliate-fraud/)** | Partners faking the sales, leads or views you pay for | Commission terms, refunds and disputes tracked per partner |
| **Identity / signup abuse** | Fake accounts, synthetic identities | IDV, device fingerprinting |
| **Marketplace / seller fraud** | Bad actors on your platform | Platform-specific controls |
| **Bank payment fraud (ACH/RTP)** | Unauthorized or fraudulent bank transfers | Account verification, irrevocability awareness |

Quick Classification Exercise

Pull your last 30 losses. Classify each one:

-   Stolen card (third-party)
-   Customer lying (first-party)
-   Customer forgot or regrets (friendly fraud)
-   Your mistake (merchant error)

**Match controls to the cause and dollars at stake.** Billing confusion and service failures need operational fixes; confirmed fraud still needs its own response even when it's the smaller bucket.

* * *

**Who's Behind It (actor types and what works against each)**

Different actors require different responses:

| Type | Who | Your Exposure | What Works |
| --- | --- | --- | --- |
| [Third-Party](https://paymentsandrisk.com/docs/fraud/types/third-party/) | Criminal with stolen card | Full liability until you shift it | 3DS, device signals, velocity |
| [First-Party](https://paymentsandrisk.com/docs/fraud/types/first-party/) | Your customer, lying | Chargebacks you'll probably lose | Better policies, clear descriptors |
| [Friendly Fraud](https://paymentsandrisk.com/docs/fraud/types/friendly-fraud/) | Customer who forgot or regrets | Winnable chargebacks | Transaction enrichment, clear billing |
| [Synthetic Identity](https://paymentsandrisk.com/docs/fraud/types/synthetic-identity/) | Manufactured identity | Bust-out after credit built | Mostly an issuer problem |
| [Account Takeover](https://paymentsandrisk.com/docs/fraud/types/account-takeover/) | Criminal with stolen login | Depends on your auth flow | Device fingerprinting, step-up auth |

**Check before buying tools:** Your chargebacks can include real customers disputing purchases they made, as well as stolen cards. Review your own disputed orders to find the main cause.

* * *

* * *

**Liability Shift: What Actually Protects You (3DS, EMV, CE 3.0)**

Not everything that helps you detect fraud shifts liability. The distinction matters.

| Method | Shifts Liability? | When It Applies |
| --- | --- | --- |
| 3D Secure (3DS) | ✅ Yes | CNP transactions where cardholder authenticates |
| EMV Chip (contact) | ✅ Yes | CP transactions; counterfeit liability shifts to issuer |
| EMV Contactless/Tap | ✅ Yes | CP transactions; same as chip |
| Visa CE 3.0 | ✅ Yes | Visa 10.4 disputes where the card has two qualifying earlier purchases with matching data |
| AVS | ❌ No | Helps you decline; doesn't shift liability |
| CVV/CVC | ❌ No | Defense tool, not liability tool |
| Signature on delivery | ❌ No | Wins disputes; doesn't shift liability |
| Device fingerprinting | ❌ No | Detection tool only |

**The hierarchy: 3DS > Chip/Tap > Visa CE 3.0 > Everything else.** If you want liability off your plate, 3DS is the answer. Everything else just helps you make better decisions.

* * *

## Card-Present vs. Card-Not-Present

Different worlds, different fraud, different experiments.

**Card-present (retail, restaurants):** Your main risk is counterfeit cards, which EMV chip largely solved. If you're still swiping, stop. Chip/tap shifts counterfeit liability to the issuer. Remaining risk is mostly employee fraud and return abuse.

**Card-not-present (ecommerce, phone orders):** This is where the real fraud lives. No chip to verify, no signature that matters. You're relying on AVS, CVV, device signals, and 3DS. Default liability is on you unless you authenticate with 3DS.

Most of this site focuses on CNP fraud because that's where merchants have real decisions to make.

A customer waiting at the reader? Start with [the counter workflow](https://paymentsandrisk.com/docs/fraud/card-present-fraud/#card-failed-at-the-counter).

* * *

**Network Thresholds (Visa and Mastercard dispute monitoring programs)**

Visa and Mastercard monitor different measures. Mastercard ECM watches chargebacks. Visa VAMP combines fraud reports and disputes, with exclusions. Friendly fraud can count too. The reason for a dispute doesn't make it disappear from monitoring.

**Key thresholds:** Get your processor's own limit in writing. Network programs have separate ratio, count and regional conditions. Check [Network Programs](https://paymentsandrisk.com/docs/chargebacks/reference/network-programs/) for the full tests. If you're approaching your written limit, act now.

See [Network Programs Reference](https://paymentsandrisk.com/docs/chargebacks/reference/network-programs/) for all thresholds, fee schedules, and timelines. See [Reduce Chargebacks Fast](https://paymentsandrisk.com/docs/playbooks/reduce-chargebacks-fast/) for the emergency playbook.

* * *

Detection

**Start here:** [Rules vs. ML](https://paymentsandrisk.com/docs/fraud/detection/rules-vs-ml/). Start with your processor's controls, then test what they miss.

[⚡ Velocity Rules Quick wins that catch obvious fraud patterns.](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules)

[📱 Device Fingerprinting When it works, when it doesn't. Browser vs native considerations.](https://paymentsandrisk.com/docs/fraud/detection/device-fingerprinting)

[🔍 Evidence Framework Tier 1 vs Tier 2 indicators. What signals actually matter.](https://paymentsandrisk.com/docs/fraud/detection/evidence-framework)

[👁️ Manual Review Building a review queue that doesn't waste time.](https://paymentsandrisk.com/docs/fraud/detection/manual-review)

Prevention

[✓ AVS & CVV The basics everyone should use. Free and effective.](https://paymentsandrisk.com/docs/fraud/prevention/avs-cvv)

[🔐 3D Secure Liability shift and when it's worth the friction.](https://paymentsandrisk.com/docs/fraud/prevention/3ds)

[📈 Risk Scoring Building or buying a scoring system.](https://paymentsandrisk.com/docs/fraud/prevention/risk-scoring)

Vendors

**Start with what you've got:** Tune your processor's built-in tools. Buy more when a pilot shows the added benefit covers the cost.

**Want to outsource decisions?** Compare Signifyd, Riskified and Forter. Confirm the guarantee scope in the quote. Test one segment before going all-in. If you want control, look at Kount or Sift. If account-level fraud (ATO, onboarding) is your problem, look at Sardine.

**Need more signals?** Consider device and behavioral tools when your existing controls miss those patterns.

[🗺️ Vendor Landscape Full breakdown of who does what in the fraud prevention market.](https://paymentsandrisk.com/docs/fraud/vendors/landscape)

[📋 Selection Guide How to evaluate and choose the right tools for your business.](https://paymentsandrisk.com/docs/fraud/vendors/selection-guide)

* * *

## Operations

Day-to-day fraud operations: managing your review queue, maintaining block lists, reviewing rule performance, and responding to fraud spikes.

[Running Fraud Operations](https://paymentsandrisk.com/docs/operations/running-fraud-operations/) covers the full daily/weekly/monthly operational checklist.

* * *

## Metrics

[Fraud Metrics](https://paymentsandrisk.com/docs/fraud/metrics/) covers what to measure: fraud rate, false positive rate and detection rate, with the denominator each one uses.

New to fraud prevention?

Start with **[The Guide, Pathway 3: Protecting from Fraud](https://paymentsandrisk.com/docs/learning-pathways/protecting-from-fraud/fraud-basics/)**, a beginner-friendly 20-minute walkthrough that covers what fraud looks like, how to set up free protections, and what to monitor. This page is the full deep dive.

Looking for a definition?

See the [Glossary](https://paymentsandrisk.com/docs/reference/glossary/) for quick definitions of payments and fraud terms.

## Do next

-   [Survive a Fraud Attack](https://paymentsandrisk.com/docs/playbooks/survive-fraud-attack/) - Stop the bleeding
-   [Velocity Rules](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules/) - Quick wins
-   [Manual Review](https://paymentsandrisk.com/docs/fraud/detection/manual-review/) - Triage suspicious orders

## Look up

-   [Benchmarks](https://paymentsandrisk.com/docs/reference/benchmarks/)

## Deeper

-   [Payments](https://paymentsandrisk.com/docs/payments/)
-   [Compliance](https://paymentsandrisk.com/docs/compliance/)
-   [Chargeback Metrics](https://paymentsandrisk.com/docs/chargebacks/metrics/) - Tracking dispute rates
-   [Chargeback Prevention](https://paymentsandrisk.com/docs/chargebacks/prevention/) - Stopping disputes
-   [Device Fingerprinting](https://paymentsandrisk.com/docs/fraud/detection/device-fingerprinting/) - Device intelligence
-   [Behavioral Analytics](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/) - User behavior patterns
-   [Identity Verification](https://paymentsandrisk.com/docs/fraud/detection/identity-verification/) - KYC and IDV
-   [Processor Management](https://paymentsandrisk.com/docs/operations/processor-management/) - Working with acquirers
-   [Money Held or Frozen](https://paymentsandrisk.com/docs/operations/holds-and-reserves/) - Program consequences

**New to fraud prevention?**

-   [Fraud Economics](https://paymentsandrisk.com/docs/fraud/fundamentals/economics/) - Understand the math