# SMB Fraud Checklist
Source: https://paymentsandrisk.com/docs/fraud/fundamentals/smb-fraud-checklist

Last updated 22 October 2026.

TL;DR

-   Check for **descriptor problems**, **refund policy problems**, and **friendly fraud** before assuming stolen cards are your main problem
-   Fix operations first. Tools come later
-   Check the free fixes before buying tools. Measure which causes they actually address
-   Match fraud spending to a measured gap, avoided losses and blocked-good margin

Every other fraud page assumes you'll read 10 pages, learn the theory, and figure out what to do. This one doesn't. This is the "just tell me what to do" page for SMBs processing under $1M/month. Follow the checklist in order. Stop when your numbers are healthy.

## Do You Actually Have a Fraud Problem?

Before spending anything on fraud prevention, figure out what's actually happening. Pull your last 20 chargebacks and sort them into four buckets:

| Category | What It Looks Like | Example |
| --- | --- | --- |
| **True fraud** | Stolen card, cardholder never ordered | "I never made this purchase" from a new customer shipping to a different state |
| **Friendly fraud** | Customer lying or confused | Customer received product but claims they didn't |
| **Billing confusion** | Didn't recognize the charge | "What is STRP\*XYZCO on my statement?" |
| **Service issues** | Product problem, never arrived | "Item was broken" or "never delivered" |

**Here's the key insight:** A fraud score won't fix billing confusion or a fulfillment failure. Work out the dollars and causes in each bucket; a majority of non-fraud disputes doesn't make the remaining fraud harmless.

-   Billing confusion? [Fix your descriptor](https://paymentsandrisk.com/docs/chargebacks/prevention/descriptors-and-comms/).
-   Service issues? Fix your product or fulfillment.
-   Friendly fraud? [Tighten your evidence trail](https://paymentsandrisk.com/docs/fraud/types/friendly-fraud/).
-   True fraud? Keep reading.

## The Free Fixes (Do These First)

These cost nothing and take less than a day. Do all of them regardless of your fraud situation.

### 1\. Fix Your Billing Descriptor (10 minutes)

Your billing descriptor is what shows up on your customer's bank statement. If it says "SQ\*RANDOM123" instead of your brand name, customers dispute charges they actually made.

**Impact:** Can prevent recognition-related disputes. Compare those disputes before and after on the same payment channel; don't budget an assumed percentage reduction.

**How:** Go to your processor's dashboard and change your statement descriptor to your customer-facing brand name. Include your website or phone number if space allows. See [Descriptors and Communication](https://paymentsandrisk.com/docs/chargebacks/prevention/descriptors-and-comms/) for step-by-step instructions.

### 2\. Require CVV on All Transactions (5 minutes)

CVV (the 3-digit code on the back of the card) is already enabled on most processors. Verify it's required and that you're declining transactions without a CVV match.

**Impact:** Blocks the lowest-effort stolen card fraud.

**How:** Check your processor settings. Stripe, Square, and most modern processors require CVV by default.

### 3\. Make Refunds Easier to Find (30 minutes)

Customers dispute charges when they can't figure out how to get a refund. If your refund process requires three emails and a carrier pigeon, they'll call their bank instead.

**Impact:** Prevents customers from escalating billing questions to disputes.

**How:** Add a "billing question?" or "need a refund?" link to your receipt emails, website footer, and checkout page. Make the path obvious. See [Refund Policy](https://paymentsandrisk.com/docs/chargebacks/refund-policy/) for guidance on balancing accessibility with abuse risk.

### 4\. Send Confirmation and Shipping Emails (1 hour)

Order confirmation and shipping notification emails serve as proof of purchase and delivery. They also remind customers what they ordered and what the charge will look like.

**Impact:** Creates evidence trail for representment and reduces "I didn't order this" disputes.

**How:** Enable order confirmation and shipping notification emails through your e-commerce platform or payment processor. Include the billing descriptor in the confirmation so customers know what to expect on their statement.

### 5\. Make Subscription Cancellation Easy (30 minutes)

If customers can't cancel, they dispute. A cancellation costs you revenue. A dispute costs you revenue plus a fee plus ratio damage.

**Impact:** Gives customers a route to cancel before they dispute. Track cancellation-related disputes and support contacts on your own subscriptions.

**How:** Add a visible "cancel subscription" option in your account portal. Send renewal reminders 7-14 days before charging.

## By Revenue Tier

Use these revenue bands to plan the work, not to decide whether a tool pays. At every size, compare the gap in current controls with avoidable losses, tool fees, review time and lost good-order margin.

### Under $50K/month

**Do:** The free fixes above. That's it.

**Before buying:** Check whether the free fixes and current controls cover your actual losses. Buy only for a measured gap and a testable business case.

### $50K - $250K/month

**Add:**

-   [3D Secure](https://paymentsandrisk.com/docs/fraud/prevention/3ds/) on a tested high-loss segment, with the amount chosen from your own fraud history
-   [RDR/Ethoca alerts](https://paymentsandrisk.com/docs/chargebacks/prevention/alerts/) when they cover the disputes you're receiving and the avoided cost justifies fees and refunds

**Before buying a scoring platform:** Name the fraud pattern current tools miss and test the economics. Revenue alone doesn't rule it in or out.

### $250K - $500K/month

**Add:**

-   Tune your processor's built-in fraud rules (velocity limits, address mismatch blocking)
-   [Ethoca and/or RDR alerts](https://paymentsandrisk.com/docs/chargebacks/prevention/alerts/) if not already active
-   Monthly review of chargebacks by reason code to spot patterns

**Start tracking:** Fraud rate by channel, product category, and customer type.

### $500K - $1M/month

**Add:**

-   Evaluate dedicated fraud tools (a paid Stripe Radar tier, Signifyd, Kount - now part of Equifax) - see [Vendor Selection Guide](https://paymentsandrisk.com/docs/fraud/vendors/selection-guide/)
-   Manual review for flagged orders where expected benefit exceeds review time and delayed fulfillment cost
-   Weekly fraud review meeting (15 minutes, pull the numbers)

**Start tracking:** False positive rate, review queue volume, fraud-to-sales ratio by segment.

### Over $1M/month

Check whether case volume, review hours and missed fraud justify a dedicated person or managed vendor. The revenue line alone doesn't settle it. See the [Vendor Selection Guide](https://paymentsandrisk.com/docs/fraud/vendors/selection-guide/) and [Economics of Fraud](https://paymentsandrisk.com/docs/fraud/fundamentals/economics/) for the business case.

## The Math That Matters

Before buying any fraud tool, run this calculation:

```text
Monthly tool cost = Per-transaction price x Monthly transaction count

Example:
  Fraud tool at $0.07/txn x 10,000 txns/month = $700/month

Compare against:
  Actual monthly fraud losses = $____
```

**If the tool costs more than your losses, don't buy it.**

This sounds obvious, but vendors sell on fear. They'll show you industry averages and worst-case scenarios. What matters is YOUR numbers. Pull your actual fraud losses for the last 6 months, average them, and compare.

Also price false positives. For illustration, blocking 2% of 1,000 legitimate $100 orders at 40% margin loses 20 x $100 x 40% = $800 in margin if none return to buy. Use your order count, margin and repeat-purchase estimate. See [Economics of Fraud](https://paymentsandrisk.com/docs/fraud/fundamentals/economics/).

## What NOT to Do

**Don't buy on a revenue cutoff.** Start with free fixes and processor controls, then price a paid tool against a specific gap. A small merchant can have a costly attack; a larger one can have controls that already work.

**Don't block international orders.** Most international orders are legitimate. Blanking out entire countries because of a few bad transactions costs you far more in lost revenue than the fraud. Use 3DS for international orders instead - it shifts liability without blocking the sale.

**Don't ignore chargebacks.** Chargebacks compound. Network monitoring programs (VAMP, ECM) have thresholds. If you cross them, you face penalties, fines, and potential termination. Even a handful of unaddressed chargebacks per month can push a low-volume merchant over the threshold.

**Don't assume all fraud is stolen cards.** Check whether [friendly fraud](https://paymentsandrisk.com/docs/fraud/types/friendly-fraud/) is a main cause in your own disputed orders. A fraud scoring tool won't catch a real customer lying to their bank. Better evidence and clear policies will.

## Next Steps

**Your chargebacks are mostly billing confusion or service issues?**

1.  [Fix your descriptor](https://paymentsandrisk.com/docs/chargebacks/prevention/descriptors-and-comms/) - 10 minutes, biggest impact
2.  [Review your refund policy](https://paymentsandrisk.com/docs/chargebacks/refund-policy/) - Make it easier to refund than dispute
3.  [Read the SMB Prevention Priorities](https://paymentsandrisk.com/docs/chargebacks/prevention/smb-prevention-priorities/) - Ranked action list

**You have a real fraud problem (stolen cards, account takeover)?**

1.  [Enable 3D Secure](https://paymentsandrisk.com/docs/fraud/prevention/3ds/) - Liability shift on risky orders
2.  [Understand fraud economics](https://paymentsandrisk.com/docs/fraud/fundamentals/economics/) - Build the business case
3.  [Evaluate vendors](https://paymentsandrisk.com/docs/fraud/vendors/selection-guide/) - When you're ready for tools

**Your chargeback ratio is climbing fast?**

1.  [Set up alerts](https://paymentsandrisk.com/docs/chargebacks/prevention/alerts/) - Stop chargebacks from filing
2.  [SMB Prevention Priorities](https://paymentsandrisk.com/docs/chargebacks/prevention/smb-prevention-priorities/) - Do things in the right order
3.  [Understand friendly fraud](https://paymentsandrisk.com/docs/fraud/types/friendly-fraud/) - It's probably not what you think

* * *

## Related Pages

-   [Economics of Fraud](https://paymentsandrisk.com/docs/fraud/fundamentals/economics/) - Full cost breakdown and ROI math
-   [Fraud Prevention Overview](https://paymentsandrisk.com/docs/fraud/prevention/) - Prevention tools and techniques
-   [Vendor Selection Guide](https://paymentsandrisk.com/docs/fraud/vendors/selection-guide/) - Evaluating fraud platforms
-   [Descriptors and Communication](https://paymentsandrisk.com/docs/chargebacks/prevention/descriptors-and-comms/) - Fix your billing descriptor
-   [Chargeback Alerts](https://paymentsandrisk.com/docs/chargebacks/prevention/alerts/) - RDR, Ethoca, and CDRN
-   [3D Secure](https://paymentsandrisk.com/docs/fraud/prevention/3ds/) - Authentication and liability shift
-   [Friendly Fraud](https://paymentsandrisk.com/docs/fraud/types/friendly-fraud/) - First-party disputes
-   [Refund Policy](https://paymentsandrisk.com/docs/chargebacks/refund-policy/) - When to refund vs. fight
-   [SMB Prevention Priorities](https://paymentsandrisk.com/docs/chargebacks/prevention/smb-prevention-priorities/) - Ranked chargeback prevention actions