E-Commerce Fraud Prevention: Protect Your Revenue

Ecommerce fraud prevention has an uncomfortable property: the tools that block the most fraud also block the most legitimate customers, and for most stores the second cost is larger than the first. Businesses routinely decline more good revenue than they lose to actual fraud, and unlike fraud losses, declined good orders never appear in a report.

Getting this right means treating it as an optimisation problem with two costs, not a security problem with one.

The three things people call fraud

They need different defences and conflating them is the most common mistake.

True fraud. Stolen card details used without the cardholder's knowledge. The real cardholder disputes, and you lose the goods and the money.

Friendly fraud. A genuine customer disputes a charge they did make. Sometimes deliberate abuse, frequently a customer who did not recognise the billing descriptor or forgot a subscription. This is a large and growing share of disputes.

Policy abuse. Not technically fraud but real losses: serial returners, promotion stacking, refund abuse and reseller behaviour that breaks your terms.

Only the first is prevented by fraud screening. The second is prevented by clarity, and the third by policy.

Friendly fraud is mostly a communication failure

Worth addressing first because the fixes are cheap and nearly frictionless.

• The billing descriptor. A large share of disputes are customers who did not recognise a charge from a legal entity name they had never seen. Set it to your trading name, ideally with a contact string.


• Immediate order confirmation with what was bought, from an address that accepts replies.


• Renewal notices before subscription charges, particularly annual ones.


• Easy, visible refunds. A customer who can get a refund from you will not go to their bank. Every refund granted is a chargeback avoided, and a chargeback costs the revenue plus a fee plus a mark against your ratio.


• Responsive support. Most people dispute because they could not reach anyone.

None of these decline a single legitimate order, which is why they should be exhausted before any screening rule is tightened.

Signals that actually predict true fraud

The useful signals are behavioural rather than demographic.

Strong signals:

• Mismatch between billing address, shipping address and card country


• Multiple cards attempted on one account in a short window


• Order velocity far outside your normal distribution


• Shipping to a known freight forwarder address


• Email address created minutes before the order


• Device fingerprint that has been associated with prior chargebacks

Weak signals frequently over-weighted:

• Country alone. Blocking countries blocks legitimate customers wholesale and is the single most common over-correction.


• Large order value alone. Your best customers place large orders.


• Use of a VPN. Increasingly ordinary and a poor predictor on its own.

The distinction matters because rules built on weak signals produce false positives at a rate that costs far more than the fraud they catch.

The tools

3D Secure and strong customer authentication. The most consequential single control, because it shifts liability for fraudulent transactions to the issuer. Required for many consumer transactions in the EU and UK. It adds a step and some customers abandon at it, but the liability shift is substantial. Exemptions exist for low-value and low-risk transactions and are worth configuring properly.

Address verification and card security codes. Basic, widely supported, and useful mainly as inputs to a broader decision rather than as pass or fail gates. Address verification is unreliable outside the US.

Machine-learning screening. Most major processors include a risk engine that scores transactions on hundreds of signals. Generally better than hand-written rules because it learns from a much larger dataset than yours. Tune the threshold rather than replacing it.

Manual review. Appropriate for a small band of genuinely ambiguous high-value orders. Expensive per order and does not scale, so the queue should be small by design.

Setting the threshold, which is the actual decision

Every screening system exposes a sensitivity setting, and choosing it is an economic decision rather than a security one.

Work out these numbers for your business:

• Cost of an accepted fraudulent order: goods, shipping, the disputed amount, and the dispute fee.


• Cost of a declined legitimate order: the margin lost, plus the lifetime value of a customer who was refused and will probably not return.

For most businesses the second is larger than people assume, because a rejected legitimate customer is usually lost permanently and often tells others.

That arithmetic implies a threshold looser than instinct suggests, combined with heavy investment in the friendly-fraud measures above, which cost nothing in false positives.

Category-specific exposure

Risk varies enormously by what you sell:

• Digital goods delivered instantly are high risk, because there is nothing to recover and no shipping delay to catch the fraud.


• High-value portable goods such as electronics are high risk with organised fraud attention.


• Subscriptions are lower risk per transaction but exposed to accumulated friendly fraud.


• Custom and personalised goods are lower risk, because they have little resale value.

Match the control intensity to the category rather than applying one policy across a mixed catalogue.

Contesting a chargeback

You will lose most contested chargebacks. Understanding when it is worth trying:

Worth contesting: you have delivery confirmation to the billing address, the customer used the product after the disputed date, you have written communication showing they acknowledged the purchase, or the dispute reason does not match the facts.

Not worth contesting: true fraud where the cardholder genuinely did not order, or any case where you lack documentary evidence. The staff time exceeds the recovery.

What to keep, from the beginning:

• Timestamped order and delivery records


• The IP and device used at purchase


• Authentication results


• All customer communication


• Your terms as they were on the purchase date

That last item matters and is routinely lost. Version your terms.

Watch the ratio, not only the losses

Card networks monitor your chargeback ratio. Exceeding thresholds puts you into a monitoring program with fines, higher processing costs and, ultimately, loss of card acceptance.

This is why friendly fraud deserves the attention it gets. A business can be profitable while running a chargeback ratio that eventually ends its ability to take payments, and the warning signs are visible in the ratio long before the consequences arrive.

If you run an affiliate program too

Fraud in the affiliate channel is a different problem with different signals, and the controls that catch stolen cards will not catch attribution theft. Affiliate fraud prevention covers cookie stuffing, click fraud and the detection approach that works there.

For the underlying mechanics of authorisation, disputes and liability shift, how online payments work covers the sequence, and payment processing for creators covers what refunds and disputes actually cost.