Skip to main content

Fraud Prevention

Last updated . Copy page as text

TL;DR
  • Prevention works in layers: authentication, verification, then monitoring
  • 3D Secure is the only layer that shifts fraud liability to the issuer. Everything else just informs your own decision
  • AVS and CVV are free and worth switching on. Neither shifts liability, and neither should hard-decline on its own
  • Use what your processor already gives you before you buy anything

You're trying to stop fraud without blocking real customers. It's layers. Authenticate, verify, then watch. Nothing here works on its own.

Key Prevention Methods​

Authentication​

MethodProtection LevelUse Case
3D Secure 2.0StrongAll CNP transactions
Multi-Factor AuthStrongAccount access
BiometricsStrongMobile/app transactions

Verification​

MethodProtection LevelUse Case
AVSMediumAddress verification
CVV/CVCMediumCard presence
Email verificationMediumAccount validity
Phone verificationMediumIdentity confirmation

Monitoring​

MethodProtection LevelUse Case
Machine learningHighPattern detection
Rules-basedMediumKnown patterns
Velocity checksMediumUnusual activity
Manual reviewVariableHigh-risk orders

Authentication Deep Dive​

3D Secure Implementation​

It's the strongest CNP tool you've got:

  • Visa Secure - Visa's 3DS brand
  • Mastercard Identity Check - Mastercard's 3DS brand
  • American Express SafeKey - Amex's 3DS brand
  • Discover ProtectBuy - Discover's 3DS brand

Key benefits:

  • Liability shift to issuer on fraud
  • Reduced fraud chargebacks
  • Better customer authentication

Prevention by Fraud Type​

Third-Party Fraud​

PreventionEffectiveness
3DS authenticationHigh
Device fingerprintingHigh
Velocity rulesMedium
AVS/CVV matchingMedium

Friendly Fraud​

PreventionEffectiveness
3DS liability shiftHighest (details)
CE 3.0 evidence collectionHigh
Clear descriptorsHigh
Order confirmationsHigh
Delivery confirmationHigh
Pre-billing alertsHigh

The full strategy's in defending against fraud losses.

Account Takeover​

PreventionEffectiveness
MFA on loginHigh
Device recognitionHigh
Behavioral analyticsHigh
Session managementMedium

Layered Defense Strategy​

Key Metrics​

Use the Fraud Metrics definitions. These measures need limits chosen for your business, not one percentage for every merchant.

MetricDefinitionHow to judge it
Fraud rateConfirmed fraud count / Transaction countLoss budget and applicable written processor limits
False positive rateConfirmed legitimate fraud blocks / All fraud blocksLost good-order margin against fraud prevented; show unknowns
3DS frictionless rateFrictionless completions / Total 3DS attemptsCompare the same issuer and customer mix
Review rateTransactions sent to review / Total attemptsQueue hours and fulfillment deadlines

Vendor Landscape​

Third-party tools are in fraud vendors.

Next Steps​

Just starting fraud prevention?

  1. Enable 3D Secure - Biggest impact, liability shift
  2. Implement AVS/CVV - Basic verification layer
  3. Set up velocity rules - Catch obvious patterns

Optimizing existing prevention?

  1. Review fraud metrics - Know your rates
  2. Tune risk scoring - Balance fraud vs. friction
  3. Evaluate vendors - Consider specialized tools

Experiencing a fraud attack?

  1. Follow the playbook - Emergency response
  2. Increase friction temporarily - Slow down attackers
  3. Enable 3DS challenge mode - Maximum authentication

Something wrong on this page? Email matt at paymentsandrisk.com and say what needs fixing.