Fraud
- Fraud hurts twice. You lose money on bad orders, then you lose more when you panic and block good customers
- There's no single fraud strategy. You run a series of bets and keep the ones that improve your loss-adjusted margin
- Pick your mode below: Operator for what to do this week, Analyst for what to measure, Reference for the lookup tables
- Before you buy anything, find out which fraud type you actually have. Most SMBs guess wrong
- Seen a different definition of first- or third-party fraud elsewhere? The industry does not agree
The same customer keeps disputing? Match the payment before reviewing future orders.
Bots keep trying cards? Start with the attack playbook. Need to identify the records first? Use the card-testing explanation.
Payouts going to a bank account that isn't yours? Someone may have changed it from your processor login. Lock the account and report it.
Someone says they're your processor and wants a login, code or payment? Check the request first.
Pick Your Mode
Before You Do Anything Else
Most merchants buy fraud tools before doing the basics. Do these first:
- Configure your processor's built-in fraud tools. Stripe Radar, Braintree rules, Adyen RevenueProtect. These are free or cheap and catch obvious stuff. → Processor Rules Configuration
- Use AVS and CVV. The billing-address check and the card's security code. Turn them on. Decline on full mismatch. → AVS & CVV
- Prefer chip/tap for in-person. If you're still swiping, stop. EMV shifts liability. → Card-Present Fraud
- Secure your terminals (card-present). Check for skimmers, isolate from your network, use P2PE if possible. → Terminal Security
- Fix your descriptor and communication. The descriptor is the name on your customer's statement. "I don't recognize this charge" is the most preventable dispute type. → Descriptors and Comms
- Make refunds easy. Before a chargeback is filed, compare the sale you're refunding, fees you don't get back and any fulfillment loss with the cost of a dispute. → Refund Strategy
- Be cautious with real-time bank payments. RTP and FedNow are irrevocable. → FX and Settlement
- Pull your last 20 chargebacks and classify them: actual fraud vs. friendly fraud (a customer claiming they didn't make a purchase they made) vs. merchant error
- Call 2 customers who disputed. Ask what actually happened.
- Check if your chargeback ratio is trending up or down
That's it. Everything else can wait.
Start with the problem your own records show. These are suggested planning bands, not spending rules:
Under $100K/month: Start with your processor's built-in tools. Classify your disputes before deciding whether you need chargeback help or fraud screening.
$100K-$1M/month: Configure your processor's rules and test changes on a matched segment. Check good orders blocked as well as fraud caught.
Over $1M/month: If losses persist after tuning, evaluate dedicated tooling. Run a pilot on one segment before going all-in. Read the Selection Guide.
Over $10M/month: Check whether review workload and missed fraud justify dedicated staff. Volume alone won't tell you.
Fraud Prevention Setup Path
Build your fraud defenses in this order. Each step builds on the previous.
These are suggested stages to test, not volume cutoffs or published budgets. Get quotes and compare them with your losses.
| Phase | When | Investment | Expected Impact |
|---|---|---|---|
| Basics | Day 1 | Check included tools and their plan terms | Check which fraud your existing rules catch and which good orders they block |
| Intermediate | A measured gap in the basics | Quote the control that addresses it | Test one control on a matched segment; compare fraud losses and completed sales |
| Advanced | Gaps persist or review workload grows | Include tools, integration and staff | Keep changes that improve loss-adjusted margin after tool and review costs |
Don't skip ahead. Most merchants who buy ML fraud tools without doing basics are wasting money.
What's Actually Happening to You? (loss type diagnosis)
Merchants often misdiagnose their fraud problem. Different loss types require different responses.
Loss Types (Merchant-Recognizable Buckets)
| Loss Type | What It Is | Primary Response |
|---|---|---|
| Unauthorized transaction fraud | Stolen card used on your site/store | 3DS, device signals, velocity rules |
| Friendly fraud / chargeback abuse | Customer lies about receiving goods or authorizing charge | Clear comms, delivery proof, CE 3.0 |
| Account takeover (ATO) | Criminal gains access to customer account | Step-up auth, device fingerprinting |
| Refund / return abuse | Customers exploit return policies | Policy limits, abuse detection |
| Promo / loyalty abuse | Coupon stacking, fake referrals, trial cycling | Velocity rules, device linking |
| Affiliate / paid-promotion fraud | Partners faking the sales, leads or views you pay for | Commission terms, refunds and disputes tracked per partner |
| Identity / signup abuse | Fake accounts, synthetic identities | IDV, device fingerprinting |
| Marketplace / seller fraud | Bad actors on your platform | Platform-specific controls |
| Bank payment fraud (ACH/RTP) | Unauthorized or fraudulent bank transfers | Account verification, irrevocability awareness |
Pull your last 30 losses. Classify each one:
- Stolen card (third-party)
- Customer lying (first-party)
- Customer forgot or regrets (friendly fraud)
- Your mistake (merchant error)
Match controls to the cause and dollars at stake. Billing confusion and service failures need operational fixes; confirmed fraud still needs its own response even when it's the smaller bucket.
Who's Behind It (actor types and what works against each)
Different actors require different responses:
| Type | Who | Your Exposure | What Works |
|---|---|---|---|
| Third-Party | Criminal with stolen card | Full liability until you shift it | 3DS, device signals, velocity |
| First-Party | Your customer, lying | Chargebacks you'll probably lose | Better policies, clear descriptors |
| Friendly Fraud | Customer who forgot or regrets | Winnable chargebacks | Transaction enrichment, clear billing |
| Synthetic Identity | Manufactured identity | Bust-out after credit built | Mostly an issuer problem |
| Account Takeover | Criminal with stolen login | Depends on your auth flow | Device fingerprinting, step-up auth |
Check before buying tools: Your chargebacks can include real customers disputing purchases they made, as well as stolen cards. Review your own disputed orders to find the main cause.
Liability Shift: What Actually Protects You (3DS, EMV, CE 3.0)
Not everything that helps you detect fraud shifts liability. The distinction matters.
| Method | Shifts Liability? | When It Applies |
|---|---|---|
| 3D Secure (3DS) | ✅ Yes | CNP transactions where cardholder authenticates |
| EMV Chip (contact) | ✅ Yes | CP transactions; counterfeit liability shifts to issuer |
| EMV Contactless/Tap | ✅ Yes | CP transactions; same as chip |
| Visa CE 3.0 | ✅ Yes | Visa 10.4 disputes where the card has two qualifying earlier purchases with matching data |
| AVS | ❌ No | Helps you decline; doesn't shift liability |
| CVV/CVC | ❌ No | Defense tool, not liability tool |
| Signature on delivery | ❌ No | Wins disputes; doesn't shift liability |
| Device fingerprinting | ❌ No | Detection tool only |
The hierarchy: 3DS > Chip/Tap > Visa CE 3.0 > Everything else. If you want liability off your plate, 3DS is the answer. Everything else just helps you make better decisions.
Card-Present vs. Card-Not-Present
Different worlds, different fraud, different experiments.
Card-present (retail, restaurants): Your main risk is counterfeit cards, which EMV chip largely solved. If you're still swiping, stop. Chip/tap shifts counterfeit liability to the issuer. Remaining risk is mostly employee fraud and return abuse.
Card-not-present (ecommerce, phone orders): This is where the real fraud lives. No chip to verify, no signature that matters. You're relying on AVS, CVV, device signals, and 3DS. Default liability is on you unless you authenticate with 3DS.
Most of this site focuses on CNP fraud because that's where merchants have real decisions to make.
A customer waiting at the reader? Start with the counter workflow.
Network Thresholds (Visa and Mastercard dispute monitoring programs)
Visa and Mastercard monitor different measures. Mastercard ECM watches chargebacks. Visa VAMP combines fraud reports and disputes, with exclusions. Friendly fraud can count too. The reason for a dispute doesn't make it disappear from monitoring.
Key thresholds: Get your processor's own limit in writing. Network programs have separate ratio, count and regional conditions. Check Network Programs for the full tests. If you're approaching your written limit, act now.
See Network Programs Reference for all thresholds, fee schedules, and timelines. See Reduce Chargebacks Fast for the emergency playbook.
Start here: Rules vs. ML. Start with your processor's controls, then test what they miss.
Start with what you've got: Tune your processor's built-in tools. Buy more when a pilot shows the added benefit covers the cost.
Want to outsource decisions? Compare Signifyd, Riskified and Forter. Confirm the guarantee scope in the quote. Test one segment before going all-in. If you want control, look at Kount or Sift. If account-level fraud (ATO, onboarding) is your problem, look at Sardine.
Need more signals? Consider device and behavioral tools when your existing controls miss those patterns.
Operations
Day-to-day fraud operations: managing your review queue, maintaining block lists, reviewing rule performance, and responding to fraud spikes.
Running Fraud Operations covers the full daily/weekly/monthly operational checklist.
Metrics
Fraud Metrics covers what to measure: fraud rate, false positive rate and detection rate, with the denominator each one uses.
Start with The Guide, Pathway 3: Protecting from Fraud, a beginner-friendly 20-minute walkthrough that covers what fraud looks like, how to set up free protections, and what to monitor. This page is the full deep dive.
See the Glossary for quick definitions of payments and fraud terms.
Do next
- Survive a Fraud Attack - Stop the bleeding
- Velocity Rules - Quick wins
- Manual Review - Triage suspicious orders
Look up
Deeper
- Payments
- Compliance
- Chargeback Metrics - Tracking dispute rates
- Chargeback Prevention - Stopping disputes
- Device Fingerprinting - Device intelligence
- Behavioral Analytics - User behavior patterns
- Identity Verification - KYC and IDV
- Processor Management - Working with acquirers
- Money Held or Frozen - Program consequences
New to fraud prevention?
- Fraud Economics - Understand the math