Guides
Payment fraud prevention for online merchants: fraud types, tools and metrics
Payment fraud prevention for online merchants means stopping card testing, stolen-card purchases, account takeover and friendly fraud without declining good customers. It works in layers: account and velocity checks, device fingerprinting and a risk score before payment, 3D Secure for risky orders, CVV and address checks at authorisation, and chargeback evidence afterwards. Track fraud rate, dispute ratio and false declines together.
At a glance
| Payment fraud in the EEA, 2024 | €4.2 billion, up from €3.5 billion in 2023 (EBA and ECB, December 2025) |
|---|---|
| Card fraud outside the EEA | 17 times higher when the payee is outside the EEA, where SCA is often not applied |
| Visa VAMP merchant threshold, Europe | Fraud reports plus disputes at 1.5% of settled card-not-present transactions since April 2026, from 1,500 events a month |
| Mastercard Excessive Chargeback Merchant | Chargeback ratio of 1.5% and at least 100 chargebacks in a month |
| PSD2 TRA reference fraud rates | 0.13% up to €100, 0.06% up to €250 and 0.01% up to €500 for remote card payments |
| UK APP fraud reimbursement | Mandatory refund of up to £85,000 per claim since 7 October 2024 |
What types of payment fraud hit online merchants?
Online fraud follows the money and the weakest control. The EBA and the ECB counted €4.2 billion of payment fraud in the EEA in 2024, with card fraud concentrated in card-not-present payments and in payments to merchants outside the EEA. Merchants carry the cost of most card fraud through chargebacks, fees and lost goods.
Each type below leaves different signals and needs a different defence, which is why a single rule set or a single tool rarely covers all of them.
| Fraud type | How it works | Typical signal | Main defence |
|---|---|---|---|
| Card testing | Bots try stolen card numbers with small payments | Many low-value attempts, high decline rate | Velocity limits, bot detection, CAPTCHA |
| Stolen card (CNP) fraud | A fraudster buys with real card details | New device, mismatched country or address | Risk scoring, 3D Secure |
| Account takeover | Stolen logins used to order or change payout details | New device, password reset, changed address | Login risk checks, step-up authentication |
| Friendly fraud | The real cardholder disputes a purchase they made | Repeat customer, delivered order, later dispute | Clear descriptors, delivery proof, evidence |
| Triangulation fraud | A fake shop resells your goods paid with stolen cards | Shipping address differs from card owner, reseller patterns | Address and device linking, review |
| MOTO fraud | Stolen cards used in phone or mail orders | Rush delivery, high value, no SCA | Call-back checks, CVV and address checks |
| APP and refund scams | Customers or staff tricked into sending money | Changed bank details, urgent requests | Payee verification, payout controls |
What is friendly fraud, and is chargeback fraud illegal?
Friendly fraud, also called chargeback fraud or first-party fraud, happens when the cardholder who made a purchase disputes it with their bank as unauthorised or not received. Some cases are honest confusion about an unfamiliar descriptor or a family member's purchase; others are deliberate. Knowingly filing a false chargeback to keep goods and money is a form of fraud and can be prosecuted, but in practice merchants fight it through the dispute process.
3D Secure does not stop friendly fraud, because the real cardholder can authenticate. What helps is a statement descriptor shoppers recognise, order confirmation emails, delivery proof and an easy refund route. For Visa disputes, Compelling Evidence 3.0 lets merchants answer a fraud claim with two earlier undisputed transactions from 120 to 365 days before, made with the same card and matching device or IP data.
Which fraud prevention tools should an online merchant use?
No single tool covers every fraud type, and each one adds cost or friction. The useful question is what each tool sees and when it acts: before the order, before authorisation, during authentication or after the sale.
Machine learning scores combine many weak signals, while rules encode what you already know about your business. Most merchants need both: rules for hard limits and explainable blocks, scoring for the grey zone in between.
- Rules: block or review by country, amount, product, shipping method or blocklisted email, card and device
- Velocity checks: limit attempts per card, device, IP address, email and account within minutes and days
- Device fingerprinting: recognise returning devices, emulators, proxies and many accounts on one device
- Machine learning risk scoring: a score per payment from behaviour, history and network data
- 3D Secure 2: authentication by the issuer, with the fraud liability shift for authenticated payments
- CVV and address verification (AVS): issuer checks at authorisation; AVS is mainly available for UK, US and Canadian cards
- Manual review and fulfilment holds: for high-value or ambiguous orders before goods leave the warehouse
Which fraud metrics should you track?
Fraud rate on its own rewards declining everyone. Track it next to the dispute ratio that the card schemes monitor and the false declines you cause, because a good customer you turn away costs the full margin and often the customer's next orders as well.
Visa's Acquirer Monitoring Program counts fraud reports and disputes together, and its merchant threshold in Europe was lowered to 1.5% in April 2026. Crossing scheme thresholds leads to fines, higher acquirer fees and in the end to losing card acceptance.
| Metric | How to calculate | Reference value |
|---|---|---|
| Fraud rate by value | Fraudulent volume divided by total card volume | PSD2 TRA bands 0.13%, 0.06% and 0.01% for PSPs |
| Visa VAMP ratio | Fraud reports plus disputes divided by settled CNP transactions | 1.5% merchant threshold in Europe since April 2026 |
| Mastercard chargeback ratio | Chargebacks divided by previous month's transactions | 1.5% and 100 chargebacks for Excessive Chargeback Merchant |
| False decline rate | Good orders declined or cancelled divided by all good orders | Set your own baseline; review samples monthly |
| 3DS challenge rate | Challenged authentications divided by all authentications | Compare per issuer country and amount band |
| Manual review rate | Orders sent to review divided by all orders | Keep low enough to review within your shipping cut-off |
What does a layered fraud prevention approach look like?
Layers catch what the previous one missed and let you keep friction for the orders that need it. Low-risk payments pass through quickly, medium-risk payments get authentication, and high-risk payments are blocked or reviewed.
Place every control as early as possible: blocking a card-testing bot at sign-up is cheaper than paying authorisation fees for thousands of declined attempts.
| Layer | When it acts | Controls | Shopper friction |
|---|---|---|---|
| 1. Account | Sign-up and login | Bot detection, login risk, step-up on new devices | None for most users |
| 2. Checkout | Before payment | Velocity limits, device fingerprint, blocklists | None |
| 3. Risk score | Before authorisation | Rules plus machine learning score | None |
| 4. Authentication | Medium and high risk | 3D Secure 2 challenge or exemption | Challenge for a share of orders |
| 5. Authorisation | At the issuer | CVV, AVS, issuer risk models | Decline only |
| 6. After the sale | Fulfilment and disputes | Holds, delivery proof, evidence, refunds | Delay on reviewed orders |
How does risk scoring connect to payment routing?
A risk score is most useful when it changes what happens to the payment: low scores pass with minimal friction, medium scores go through 3D Secure, and high scores are blocked or held for review. Retry rules should check the decline reason and the risk score before a payment is resubmitted to another provider. Our transaction risk scoring glossary entry explains signals, thresholds and how scores feed routing.
How can you add fraud controls through OrsunPay?
OrsunPay is a technical service provider on top of the merchant's own PSP accounts, so the fraud tools and liability rules of each PSP contract keep applying. Reporting brings payment results from connected providers together, and the RiskCogs anti-fraud module adds a risk score and signals to each transaction that feed into routing and cascading rules.
How to set up layered payment fraud prevention
- Measure your baseline Export three months of payments, disputes and declines, and calculate fraud rate, dispute ratio and approval rate per country, method and amount band.
- Stop automated attacks first Add bot detection and velocity limits per card, device, IP address and email to block card testing before it reaches authorisation.
- Score every payment Use your PSP's risk engine or a separate scoring tool, and write rules for the hard limits you already know.
- Map scores to actions Define bands for pass with exemption, authenticate with 3D Secure, review and block, and test the thresholds on past orders.
- Prepare for disputes Fix your statement descriptor, store delivery proof and device data, and refund obvious mistakes before they become chargebacks.
- Review monthly Check fraud, disputes and false declines together and adjust rules, since fraud patterns shift after every change you make.
Frequently asked questions
What is friendly fraud?
Friendly fraud is a chargeback filed by the genuine cardholder for a purchase they made or authorised, claiming it was unauthorised or not received. It accounts for a large share of fraud disputes because 3D Secure and fraud scores cannot stop the real cardholder.
Is chargeback fraud illegal?
Knowingly disputing a legitimate purchase to get money back while keeping the goods is fraud and can be prosecuted. Merchants usually respond through the scheme dispute process with evidence, and may refuse future orders from that customer.
What is MOTO fraud?
MOTO fraud uses stolen card details in mail order or telephone order payments. These payments are outside strong customer authentication, so merchants rely on call-back checks, CVV and address verification and careful review of rush or high-value orders.
How can I stop ecommerce fraud without losing good customers?
Use risk-based friction: let low-risk payments through, authenticate medium-risk ones with 3D Secure and block or review only high-risk orders. Measure false declines next to fraud, so tightening rules does not quietly cost more revenue than the fraud it stops.
What is a good fraud rate for an online shop?
Keep fraud and dispute ratios well below the 1.5% scheme thresholds of Visa and Mastercard. Merchants that want acquirers to request TRA exemptions need a portfolio far lower, as PSD2 sets reference rates between 0.01% and 0.13% for PSPs.
What is card testing?
Card testing is when fraudsters use bots to check stolen card numbers with small payments on a website. It causes authorisation fees, raised decline rates and later fraud disputes, and is stopped with velocity limits, bot detection and CAPTCHA at checkout.