Payment fraud is any unauthorized or deceptive use of a payment method to obtain goods, services or money, in which the payment is later disputed, reversed or proven illegitimate. In payment security within e-commerce, it covers both third-party fraud, where criminals use stolen card or account data, and first-party fraud, where genuine customers falsely dispute purchases they actually made.
Online stores carry a particular burden because most of their transactions are card-not-present payments. Without a physical card and a chip check, the merchant usually bears the financial loss unless strong customer authentication has shifted liability to the card issuer.
How payment fraud happens in online stores
Most e-commerce fraud starts with compromised credentials: card numbers obtained through data breaches, phishing or malicious scripts on checkout pages, and login details reused from other leaked services. Criminals then monetize the data by buying easily resold goods such as electronics, gift cards and luxury items, often shipped to intermediaries.
The fraud types below differ in who commits them, how they appear in transaction data and how they are best prevented. Treating them as one problem leads to poor rules, because a filter that stops stolen cards does little against a genuine customer who later disputes a delivery.
| Fraud type | Who commits it | How it works |
|---|---|---|
| Stolen card fraud | Third-party criminal | Uses stolen card data to buy goods |
| Account takeover | Third-party criminal | Logs into a real customer account with saved payment methods |
| Card testing | Automated bots | Runs many small payments to find valid card numbers |
| Friendly fraud | Genuine cardholder | Disputes a legitimate purchase as unauthorized or not received |
| Triangulation fraud | Criminal reseller | Sells goods on a marketplace and fulfills them with stolen cards |
| Refund and promotion abuse | Customer or organized group | Exploits return policies, coupons or new-customer offers |
Signals used to detect fraudulent payments
Fraud detection combines many weak signals into a risk score. No single signal proves fraud; a mismatched billing address may simply mean a gift order. The strength comes from combining signals and comparing them with normal customer behavior.
| Signal | What is checked | Why it matters |
|---|---|---|
| CVV and address verification | Security code and billing address match | Weak evidence that the buyer has the card details |
| Velocity | Number of attempts per card, device or IP | Reveals card testing and automated attacks |
| Device fingerprint | Browser and device characteristics | Links many orders to one device |
| Geolocation consistency | IP location versus billing and shipping country | Highlights proxies and distant shipping |
| Email and phone history | Age and reputation of contact details | New, disposable contacts carry higher risk |
| Behavioral patterns | Typing speed, navigation and session timing | Distinguishes humans from scripts |
Modern fraud screening tools apply machine learning models trained on network-wide data, then let the merchant add rules for its own business. Each order ends in one of three decisions: approve, decline, or send to manual review.
Payment fraud compared with related security concepts
Payment fraud is the threat, while neighboring concepts in payment security describe the controls and consequences around it. Keeping them apart helps assign responsibilities inside a company.
| Concept | What it is | Relationship to payment fraud |
|---|---|---|
| Fraud screening | Process of scoring and filtering orders | Main preventive control before fulfillment |
| Chargeback | Forced reversal initiated by the card issuer | Most common financial outcome of fraud |
| PCI DSS | Security standard for handling card data | Reduces the theft of card data that enables fraud |
| 3D Secure | Cardholder authentication during checkout | Shifts fraud liability to the issuer when successful |
| Tokenization | Replacing card numbers with surrogate values | Makes stolen merchant data useless to criminals |
In the European Economic Area, strong customer authentication required under PSD2 has made 3D Secure a standard step for many online card payments, which has reduced some third-party fraud and moved attackers toward account takeover and social engineering.
Measuring and managing fraud losses
Fraud management is a balance between losses and lost sales. Blocking too little causes chargebacks and fees; blocking too much rejects good customers, a cost that is harder to see but often larger. Merchants therefore track several metrics together.
| Metric | Definition | Interpretation |
|---|---|---|
| Fraud rate | Fraudulent sales as a share of total sales | Often expressed in basis points |
| Chargeback ratio | Disputes divided by transactions in a month | Card networks monitor merchants above set thresholds |
| False decline rate | Legitimate orders rejected as risky | Hidden revenue loss and customer frustration |
| Manual review rate | Share of orders checked by staff | Drives operational cost and shipping delays |
| Approval rate | Share of attempted payments approved | Combined effect of issuer and merchant decisions |
Card networks run monitoring programs for merchants with excessive disputes or fraud, and exceeding their thresholds, commonly around 1% of transactions, can lead to fines or loss of card acceptance. The exact limits depend on the network and change over time.
Prevention practices and common mistakes
Effective prevention is layered: no single tool stops every attack, and each layer covers weaknesses of the others.
- Protect checkout pages against malicious scripts and keep the platform patched.
- Use 3D Secure selectively or by default where regulation requires it, accepting a little friction for liability protection.
- Rate-limit payment attempts to stop card testing bots.
- Keep delivery evidence and clear descriptors on statements to defend against friendly fraud.
- Avoid rigid country blocks that reject large groups of legitimate customers.
- Review rules regularly, because fraud patterns shift quickly once attackers learn a filter.
Understanding it simply
Payment fraud happens when someone pays with money that is not really theirs, or falsely claims later that they never made a purchase. In an online shop, the seller cannot see the buyer or touch the card. That makes it easier for a criminal to pretend to be someone else.
When the real cardholder complains, the bank usually takes the money back from the shop. The shop then loses both the goods and the payment, so stores use checks to spot suspicious orders before they ship.
Applied in practice
A consumer electronics store notices hundreds of small payment attempts of one or two euros within an hour, most of them declined. This is a classic card-testing attack: bots are using the checkout to find which stolen card numbers still work.
The store adds rate limits per device and IP address, a bot challenge on the payment form and a rule that flags orders where the shipping address differs from the billing country for high-value items. It also enables 3D Secure for all orders above a set amount.
Card testing stops within a day. Over the next months, chargebacks fall well below the network monitoring threshold, while the false decline rate stays low because ordinary orders pass without additional checks.