Fraud
Fraud hurts twice. You lose money on bad orders, then you lose more when you panic and block good customers.
You don't pick a single fraud strategy. You run a series of bets and keep the ones that improve your loss-adjusted margin.
Pick Your Mode
Before You Do Anything Else
Most merchants buy fraud tools before doing the basics. Do these first:
- Configure your processor's built-in fraud tools. Stripe Radar, Braintree rules, Adyen RevenueProtect. These are free or cheap and catch obvious stuff. → Processor Rules Configuration
- Use AVS and CVV. Turn them on. Decline on full mismatch. → AVS & CVV
- Prefer chip/tap for in-person. If you're still swiping, stop. EMV shifts liability. → Card-Present Fraud
- Fix your descriptor and communication. "I don't recognize this charge" is the most preventable dispute type. → Descriptors and Comms
- Make refunds easy. A refund costs 3%. A chargeback costs $50+. → Refund Strategy
- Be cautious with real-time bank payments. RTP and FedNow are irrevocable. → FX and Settlement
- Pull your last 20 chargebacks and classify them: actual fraud vs. friendly fraud vs. merchant error
- Call 2 customers who disputed. Ask what actually happened.
- Check if your chargeback ratio is trending up or down
That's it. Everything else can wait.
What's Actually Happening to You?
Merchants often misdiagnose their fraud problem. Different loss types require different responses.
Loss Types (Merchant-Recognizable Buckets)
| Loss Type | What It Is | Primary Response |
|---|---|---|
| Unauthorized transaction fraud | Stolen card used on your site/store | 3DS, device signals, velocity rules |
| Friendly fraud / chargeback abuse | Customer lies about receiving goods or authorizing charge | Clear comms, delivery proof, CE 3.0 |
| Account takeover (ATO) | Criminal gains access to customer account | Step-up auth, device fingerprinting |
| Refund / return abuse | Customers exploit return policies | Policy limits, abuse detection |
| Promo / loyalty abuse | Coupon stacking, fake referrals, trial cycling | Velocity rules, device linking |
| Identity / signup abuse | Fake accounts, synthetic identities | IDV, device fingerprinting |
| Marketplace / seller fraud | Bad actors on your platform | Platform-specific controls |
| Bank payment fraud (ACH/RTP) | Unauthorized or fraudulent bank transfers | Account verification, irrevocability awareness |
Pull your last 30 losses. Classify each one:
- Stolen card (third-party)
- Customer lying (first-party)
- Family member used card (second-party)
- Customer forgot or regrets (friendly)
- Your mistake (merchant error)
If more than half are friendly fraud, you don't have a fraud problem. You have a customer experience problem.
Who's Behind It
Different actors require different responses:
| Type | Who | Your Exposure | What Works |
|---|---|---|---|
| Third-Party | Criminal with stolen card | Full liability until you shift it | 3DS, device signals, velocity |
| First-Party | Your customer, lying | Chargebacks you'll probably lose | Better policies, clear descriptors |
| Second-Party | Customer's friend/family | Chargebacks, "unauthorized" claims | 3DS, delivery confirmation |
| Friendly Fraud | Customer who forgot or regrets | Winnable chargebacks | Transaction enrichment, clear billing |
| Synthetic Identity | Manufactured identity | Bust-out after credit built | Mostly an issuer problem |
| Account Takeover | Criminal with stolen login | Depends on your auth flow | Device fingerprinting, step-up auth |
The uncomfortable truth: Most small merchant "fraud" is first-party or friendly fraud. Stolen cards are dramatic but less common than customers claiming they didn't authorize a charge they definitely made.
Action Plan by Volume
Liability Shift: What Actually Protects You
Not everything that helps you detect fraud shifts liability. The distinction matters.
| Method | Shifts Liability? | When It Applies |
|---|---|---|
| 3D Secure (3DS) | ✅ Yes | CNP transactions where cardholder authenticates |
| EMV Chip (contact) | ✅ Yes | CP transactions; counterfeit liability shifts to issuer |
| EMV Contactless/Tap | ✅ Yes | CP transactions; same as chip |
| Visa CE 3.0 | ✅ Yes | Repeat CNP customers with prior undisputed transactions |
| AVS | ❌ No | Helps you decline; doesn't shift liability |
| CVV/CVC | ❌ No | Defense tool, not liability tool |
| Signature on delivery | ❌ No | Wins disputes; doesn't shift liability |
| Device fingerprinting | ❌ No | Detection tool only |
The hierarchy: 3DS > Chip/Tap > Visa CE 3.0 > Everything else. If you want liability off your plate, 3DS is the answer. Everything else just helps you make better decisions.
Card-Present vs. Card-Not-Present
Different worlds, different fraud, different experiments.
Card-present (retail, restaurants): Your main risk is counterfeit cards, which EMV chip largely solved. If you're still swiping, stop. Chip/tap shifts counterfeit liability to the issuer. Remaining risk is mostly employee fraud and return abuse.
Card-not-present (ecommerce, phone orders): This is where the real fraud lives. No chip to verify, no signature that matters. You're relying on AVS, CVV, device signals, and 3DS. Default liability is on you unless you authenticate with 3DS.
Most of this site focuses on CNP fraud because that's where merchants have real decisions to make.
Network Thresholds You Need to Know
Visa and Mastercard will put you in monitoring programs (and eventually shut you down) if your dispute rate gets too high:
Visa:
- 0.65% + 75 disputes/month: Early warning (VDMP)
- 0.9% + 100 disputes/month: Standard program, fines begin
- 1.8% + 1,000 disputes/month: Excessive program
Mastercard:
- 1.0% + 100 disputes/month: ECM
- 1.5% + 100 disputes/month: HECM
These are dispute ratios, not fraud ratios. Friendly fraud counts. "Fraud" chargebacks from angry customers count. The networks don't care why you're getting disputes.
If you're above 0.5%, start worrying. If you're above 0.75%, act now. See Reduce Chargebacks Fast.
Start here: Rules vs. ML. Most teams under $10M should start with rules.
Under $1M: Use your processor's built-in tools. Stripe Radar is fine. Don't buy anything else yet.
$1M-$10M: If you want to outsource the decision, look at Signifyd, Forter, or Riskified (chargeback guarantees). Test their guarantee model on a segment before going all-in. If you want control, look at Kount or Sift. If account-level fraud (ATO, onboarding) is your problem, look at Sardine.
Over $10M: Layer tools. Consider Sardine for device/behavior alongside a transaction scoring tool.
Metrics
Fraud Metrics covers what to measure: fraud rate, false positive rate, detection rate, and benchmarks by vertical.
For Issuers
If you're on the issuing side (banks, fintechs issuing cards), the fraud picture looks different. We see things merchants can't: the authorization request, the cardholder's history, the TC40/SAFE reports.
Next Steps
- Fraud Economics - Understand the math
- AVS & CVV - The basics everyone should use
- Processor Rules - Free tools first
- Survive a Fraud Attack - Stop the bleeding
- Velocity Rules - Quick wins
- Manual Review - Triage suspicious orders
- Rules vs ML - Choose your approach
- Vendor Selection - When to buy tools
- Fraud Metrics - What to measure
See Also
- Chargeback Metrics - Tracking dispute rates
- Chargeback Prevention - Stopping disputes
- Device Fingerprinting - Device intelligence
- Behavioral Analytics - User behavior patterns
- Identity Verification - KYC and IDV
- Processor Management - Working with acquirers
- Holds and Reserves - Program consequences