Fraud Prevention for Online Payments

Fraud prevention is not about blocking as much as possible. It is about minimizing two costs at once.

The first cost is fraud itself: lost goods or service, chargeback fees, time spent on disputes and the risk of landing in a card network monitoring program. The second cost is false declines. Signifyd warns that fear of fraud can lead merchants to over-protect and cancel legitimate transactions, which creates a bad customer experience and destroys relationships with good customers.

A false decline is invisible in your fraud report. The customer simply leaves. So measure both sides:

• Fraud rate: fraud disputes divided by successful payments.
• Dispute rate: all disputes divided by successful payments.
• Decline rate: declined attempts divided by all attempts, split by your own blocks and issuer declines.
• Manual review rate and outcome: how many orders you hold, and how many of those turn out to be good.

If your fraud rate is very low and your block rate is high, you are probably turning away good customers. If disputes are rising, tighten controls where the disputes come from, not everywhere.

No single check catches everything. Each layer adds a signal, and a risk system combines them. Signifyd describes fraud scoring as assigning each transaction a score from factors such as billing address, IP address, device fingerprint and transaction history.

The common layers, from cheapest to most involved:

1. Card verification code and address checks. The Address Verification System lets merchants cross-check the billing address entered at checkout against the record at the card's issuing bank. A mismatch is a signal, not proof: people move and mistype.
2. Device and network signals. Tipalti explains that device fingerprinting collects identifying data points for each computer, phone or tablet, such as operating system, browser version and screen resolution. Many accounts from one device, or a device in one country paying with a card from another, deserve a closer look.
3. Velocity checks. Count attempts per card, per device, per IP address and per account over short windows. Bursts are the signature of automation.
4. Risk scoring and machine learning. Payment providers score transactions using patterns across many merchants. Signifyd notes that machine learning can automatically decline orders that are highly likely to be fraudulent while learning as tactics change.
5. Your own rules. Add rules that reflect your business, such as blocking prepaid cards on high-value plans or requiring email verification before a trial starts.
6. Manual review. Hold only the uncertain middle band for a person to check. Reviewing everything is slow and teaches you nothing about which signals matter.

Start with your payment provider's built-in tools. They see far more traffic than you do. Add your own rules only where your data shows a gap.

Card testing deserves its own section because it can hit even a tiny business overnight and the damage outlasts the attack. Stripe lists the consequences: disputes from the charges that succeed, higher decline rates that make all of your transactions appear riskier even after the attack ends, extra fees, infrastructure strain and polluted business data.

Testers like two entry points. Stripe notes that card setup is preferred because validation during card setup does not typically show up on cardholder statements, and that payments are kept small so cardholders are less likely to notice. Any endpoint that saves or charges a card is a target, including "add payment method" pages and free-trial signups that verify a card.

Warning signs include a sudden spike in card errors, many attempts from a few IP addresses, many new customers with similar emails and a wave of tiny charges. Stripe's documented responses are:

• CAPTCHA on all requests that enable card validations or payments, validated on the server side.
• Rate limits at the network level and in the checkout flow, tailored to the pattern you are seeing.
• Velocity rules that block repeated attempts from the same card, device or address.
• A combination, for example letting the first attempt from an IP address through and challenging the next ones.

Stripe adds a warning that applies to subscription businesses: excessive retries of payments can look like card testing if they come in spikes with a low success rate. Keep your dunning retries spread out and stop retrying cards attached to customers you have identified as fraudulent.

3D Secure (3DS) adds a cardholder authentication step before authorization. Visa explains that it lets merchants and issuers exchange data before a transaction is authorized, using hundreds of data points such as device type, location and historical spending to help issuers recognize legitimate customers. In many cases the check is "frictionless" and the customer sees nothing. When the issuer is unsure, it asks the customer to confirm, for example in their banking app.

The commercial reason to use 3DS is the liability shift. Stripe's support documentation explains that when 3DS is attempted, the customer authenticates and the result reaches the issuer, the bank is liable for any fraudulent-type disputes filed.

Know the limits before relying on it:

• It covers fraud disputes only. Stripe states that disputes for reasons other than fraudulent are not covered. "Product not received" or "subscription canceled" disputes remain yours.
• Exemptions are not guaranteed. If you request an exemption, the bank can deny it and require the customer to complete 3DS.
• Some regions require strong customer authentication for many online payments, so 3DS may be mandatory rather than optional depending on where your customers are.

A practical approach: let your payment provider request 3DS dynamically on risky transactions and wherever regulation requires it, rather than on every payment. That captures most of the liability benefit while keeping friction low for trusted customers.

Friendly fraud is often confusion rather than malice. Visa names two everyday causes: household misuse, when a family member uses a saved card, and descriptor confusion, when a customer does not recognize the merchant's name on a statement.

Prevention is mostly about clarity:

• Use a billing descriptor that matches the brand customers know.
• Send receipts for every charge and reminders before renewals and trial conversions.
• Make cancellation and refunds easy to find. A refund costs less than a chargeback.
• For digital products, log usage. Visa recommends tracking usage data to demonstrate fulfillment and revoking access quickly after a confirmed chargeback.

When a dispute arrives, the process has fixed steps. Chargeback Gurus summarizes them: after receiving a chargeback, the merchant must either accept liability or submit representment by the applicable deadline. Representment is your formal response with evidence. Mastercard's guide, read on 2026-10-17, says the deadline is typically 20 to 45 days after the merchant is notified, and that missing it means losing the dispute by default.

Mastercard also explains that your evidence should directly address the chargeback reason code. If the customer claims they did not receive the service, send login and usage records. If they claim the charge was unauthorized, send the authentication result, IP address and account history. Chargeback Gurus adds that even a won dispute has limits: the original chargeback fee may remain and the dispute may still affect your chargeback ratio. Prevention stays cheaper than winning.

Use this list to set up or audit your defenses.

1. Use your provider's risk tools. Turn on built-in scoring and review its default rules.
2. Protect every card endpoint. CAPTCHA and rate limits on checkout, card setup and trial signup.
3. Add velocity rules. Limits per card, device, IP address and account.
4. Request 3DS where it helps. On risky transactions and wherever regulation requires it.
5. Make billing recognizable. Clear descriptor, receipts and renewal reminders.
6. Make refunds easy. Customers who can get a refund rarely file a dispute.
7. Log fulfillment. Logins, usage, downloads and support conversations, kept with each customer record.
8. Answer every dispute on time. One owner, a calendar of deadlines and evidence templates by reason code.
9. Watch the numbers weekly. Fraud rate, dispute rate, decline rate and review outcomes.
10. Have an attack plan. Know who tightens rules, who talks to your provider and how you pause trials if card testing starts.

Fraud adapts, so treat these controls as a system you tune every month rather than a project you finish once.