Setting Up Fraud Protection
- Turn on AVS and CVV, the billing-address and security-code checks. Free, catches obvious fraud
- Set up velocity limits, caps on attempts from one card, IP address or device within a set time. Blocks card testing attacks
- Fix your billing descriptor, the name on your customer's statement. It'll stop friendly fraud before it starts
- Consider 3D Secure for high-risk transactions. It'll shift fraud liability to the issuer
You know what fraud looks like. Now turn on your defenses. Most of the effective ones are free. They're already sitting in your processor dashboard.
For Shopify Payments, follow the Shopify-specific guidance below for AVS/CVV, order workflows and 3D Secure. The generic checklist, velocity thresholds and selective-3DS rollout aren't Shopify setup steps.
Step 1: Enable AVS and CVV (Free)
AVS checks the billing address against the issuer's records. That's Address Verification Service. CVV checks the 3-4 digit code on the card. Both are free.
What to do:
- Log into your processor dashboard
- Find fraud rules or risk settings
- Enable CVV requirement for all transactions
- Enable AVS checking
Where to find it by processor:
- Stripe: Dashboard > Radar > Rules (AVS/CVV are on by default)
- Square: Dashboard > Account & Settings > Risk Manager
- Shopify Payments: Review AVS/CVV filters under Settings > Payments > Shopify Payments > Manage > Fraud prevention > Reduce credit and debit card fraud. Keep Use automated settings active for Shopify's recommended settings.
- Braintree: Control Panel > Fraud Management
How to use the results:
| Signal | What to Do |
|---|---|
| CVV doesn't match | Decline. The card isn't present. This is almost always fraud. |
| AVS full match (address + zip) | Good signal. Process normally. |
| AVS partial match (zip only) | Moderate risk. Fine for most orders. |
| AVS no match | Higher risk. Review the order manually if it's large. |
| AVS unavailable (international cards) | Don't auto-decline. Availability varies by issuer and country. Use other signals. |
Legitimate customers can fail AVS checks. They've moved recently. They typed the address differently. Their bank's records are stale. Review mismatches alongside other signals. Compare fraud losses and blocked good orders on the same customer segment.
Step 2: Set Up Velocity Limits (Free)
Velocity limits cap transactions from one card, IP or device. You set the window. They're your best defense against card testing.
Example settings to test before blocking:
| Rule | Starting setting | What to check |
|---|---|---|
| Transactions per card per hour | Flag over 3 | Repeat purchases and split orders |
| Transactions per IP per hour | Flag over 5 | Shared networks and busy checkout periods |
| Failed authorizations per card (10 min) | Flag over 3 | Legitimate retries and checkout errors |
| Unique cards per device per day | Flag over 5 | Shared devices and business purchasers |
Choose the window and cutoff from your own successful orders and confirmed attacks. These numbers aren't industry limits. Follow the test below and use Fraud Metrics to define block and false-positive measures.
Where to set these:
- Stripe: Dashboard > Radar > Rules > Add rule. Check supported attributes and time windows before translating a tested setting into a live rule
- Square: Dashboard > Account & Settings > Risk Manager > Velocity rules
- Shopify Payments: Use Shopify Flow for order workflows. For risk-based actions, start with Order risk analyzed. This runs after analysis, not before checkout.
- Braintree: Control Panel > Fraud Management > Advanced Fraud Tools
Run rules in "shadow mode" first, if your processor supports it. Flag transactions without blocking them. Choose a review date from transaction counts and how long fraud labels take to arrive. Compare caught fraud with the good orders you would have blocked on the same segment. Keep the rule only if saved losses cover lost margin and operating costs.
Step 3: Fix Your Billing Descriptor (Free)
It's the highest-impact change on this list. Your billing descriptor is what shows on the customer's statement.
Bad descriptors that cause disputes:
PAY*ACME LLCSP * JOHN DOESTRIPE 8472910
Good descriptors that prevent disputes:
ACME WIDGETS(your recognizable business name)PETSTORE.COM(your website URL)ACME 800-555-0199(name + phone number)
How to fix it:
- Stripe: Dashboard > Settings > Public details > Statement descriptor
- Square: Dashboard > Account & Settings > Business information > Statement descriptor
- Shopify Payments: Settings > Payments > Statement descriptor
- PayPal: Settings > Payment preferences > Statement descriptor
Set it to your recognizable business name or website URL. If your processor allows it, add your phone number.
Test it: check your descriptor in the provider's supported test environment. After a genuine customer purchase posts, ask what appeared on the statement. Don't use real-card live-mode tests where your provider prohibits them; Stripe does.
Step 4: Send Purchase Confirmations (Free)
Email or SMS confirmations immediately after purchase do two things:
- Remind the customer what they bought (prevents "I don't recognize this" disputes)
- Give them a way to contact you instead of their bank
Your confirmation should include:
- Your business name (matching the billing descriptor)
- What they bought (specific items, not just "Order #12345")
- The amount charged
- Your contact information for questions
- How to request a refund
Step 5: Consider 3D Secure for High-Risk Orders
3D Secure is the prompt you sometimes get at checkout. "Visa Secure" or "Mastercard Identity Check." The older names were "Verified by Visa" and "Mastercard SecureCode." It's powerful because it shifts fraud liability to the card issuer. A fraud chargeback on a 3DS-authenticated transaction? The issuer eats it, not you.
The tradeoff: 3DS can add friction to checkout. Test it on one eligible segment. Compare completed payments, auth rates and fraud losses before and after on the same issuer-country and customer mix.
When 3DS is worth it:
- Your fraud losses on the eligible segment may justify the lost margin and cost of added authentication
- You sell digital goods (no shipping address to verify)
- You're approaching chargeback warning thresholds. Your processor's own limit can be stricter; check VAMP's regional ratio, count and acquirer conditions
- Individual orders are high value
When to skip 3DS:
- Your fraud rate is low
- You sell low-value items where chargebacks are cheaper than lost sales
- Your customers are mostly repeat buyers, so they're low risk
How to enable it:
- Stripe: Dashboard > Settings > Payments > 3D Secure rules (or use Radar rules to trigger selectively)
- Square: Not available for most SMB accounts
- Shopify Payments: Turn 3D Secure on in your Shopify Payments settings under Fraud prevention. Shopify Payments only uses 3DS when the card-issuing bank requires it, and stores in a PSD2 region automatically use a 3DS checkout flow. See Shopify's 3D Secure guidance.
- Braintree: Control Panel > Processing > 3D Secure
How to roll it out (processors with selective 3DS rules):
- Start with your highest-risk segment only. New customers, plus orders above your average fraud amount
- Run for 2-4 weeks. Measure the impact on auth rate and fraud
- Compare lost margin from fewer completed payments with fraud losses avoided and any liability shift. Scale it back if the trade costs you money
Your Protection Setup Checklist
Do these in order, this week:
□ Enable CVV requirement (5 minutes)
□ Enable AVS checking (5 minutes)
□ Set velocity limits on your processor (15 minutes)
□ Fix your billing descriptor (10 minutes)
□ Set up purchase confirmation emails (30 minutes)
□ Make a test purchase and check your own statement (2 days to verify)
□ Review if 3DS makes sense for your risk level (15 minutes)