The Scale of Payment Fraud
Payment fraud costs merchants over $30 billion annually worldwide — and that number grows every year. For merchants, the impact goes far beyond the stolen transaction amount. You lose the product or service delivered, pay chargeback fees, absorb operational costs fighting disputes, and risk your merchant account if fraud-related chargebacks push your ratio above thresholds.
Understanding the types of fraud you face and building a layered prevention strategy is essential to protecting your revenue and your ability to process payments.
Types of Payment Fraud
Card-Not-Present (CNP) Fraud
The most common fraud type for online merchants. A fraudster uses stolen card credentials to make purchases remotely — through your website, over the phone, or via a mobile app. Because the physical card isn't present, verification relies entirely on data matching (name, address, CVV), which stolen data often satisfies.
CNP fraud accounts for over 70% of all card fraud. If you sell online, this is your primary threat.
Friendly Fraud
The customer is real, the purchase is legitimate, but the cardholder disputes the charge anyway. Reasons range from buyer's remorse and billing confusion to deliberate abuse. The customer contacts their bank claiming the charge was unauthorized rather than requesting a refund from you.
Friendly fraud accounts for 60-80% of all chargebacks and is extremely difficult to prevent because the "fraudster" is your actual customer.
Account Takeover (ATO)
Fraudsters gain access to a legitimate customer's account using stolen credentials, phishing, or credential stuffing. They change the shipping address, add a new payment method, or use stored payment information to make purchases. Because the account is real, basic fraud filters often miss it.
Card Testing
Fraudsters test stolen card numbers by making small transactions ($0.50–$5.00) to verify the card is active before making larger fraudulent purchases elsewhere. High card-testing volume generates chargebacks, processor alerts, and can trigger account review.
Chargeback Fraud
A deliberate scheme where the buyer intends to keep the product and the money. They make a legitimate purchase, receive the goods, then file a chargeback claiming the transaction was unauthorized. This overlaps with friendly fraud but is distinguished by intent — chargeback fraud is premeditated.
Refund Fraud
The fraudster requests a refund to a different payment method than the original, or manipulates return processes to receive a refund without returning the product. Commonly seen in retail and eCommerce with lenient return policies.
Fraud Prevention Tools
No single tool stops all fraud. Effective prevention requires layering multiple tools so that what one misses, another catches.
Address Verification Service (AVS)
Compares the billing address provided by the customer with the address on file at the card-issuing bank. AVS returns match codes — full match, partial match, or no match. Decline transactions with no AVS match, and flag partial matches for manual review.
Effectiveness: Catches basic stolen-card fraud where the fraudster doesn't know the cardholder's billing address. Ineffective when full cardholder data is compromised.
CVV/CVC Verification
Requires the 3- or 4-digit security code on the physical card. Since CVV codes are not stored by merchants (PCI DSS prohibits it), a valid CVV suggests the buyer has the physical card.
Effectiveness: Blocks fraudsters who only have card numbers without CVVs. Less effective when full card data is stolen from breaches that capture CVV.
3D Secure (3DS2)
Adds an authentication layer where the card-issuing bank verifies the cardholder's identity during checkout — typically via a one-time password, biometric, or app notification. The critical benefit: liability for fraud shifts from the merchant to the issuing bank on 3DS-authenticated transactions.
Effectiveness: The strongest single fraud prevention tool for CNP transactions. Reduces fraud and shifts liability. Modern 3DS2 implementations add minimal checkout friction.
Velocity Checks
Monitor transaction frequency from the same card, IP address, email, or device within a time window. Legitimate customers rarely make 10 purchases in 5 minutes — fraudsters testing stolen cards do.
Effectiveness: Excellent at catching card testing and automated fraud attacks. Set thresholds that match your normal transaction patterns.
Device Fingerprinting
Creates a unique identifier for the device used in each transaction based on browser settings, operating system, screen resolution, installed plugins, and other attributes. Flags transactions from devices associated with previous fraud.
Effectiveness: Catches repeat offenders and device-sharing fraud rings. Valuable for linking seemingly unrelated fraudulent transactions.
IP Geolocation
Compares the transaction's IP address location with the billing address and shipping address. A card with a U.S. billing address used from an IP in Eastern Europe is a red flag.
Effectiveness: Catches international fraud using stolen domestic cards. Less effective with VPNs and proxies, but still a useful signal in a layered approach.
Machine Learning Fraud Scoring
Advanced fraud platforms analyze hundreds of transaction attributes in real time and assign a fraud risk score. These models learn from historical fraud patterns and adapt to new attack vectors.
Effectiveness: The most sophisticated approach, but requires sufficient transaction volume to train models effectively. Best suited for merchants processing high volumes through a payment gateway.
Chargeback Fraud vs Legitimate Chargebacks
Not every chargeback is fraud. Understanding the difference is critical for building an effective response:
Legitimate Chargebacks
- Product never arrived and merchant is unresponsive
- Product was significantly different from description
- Merchant charged the wrong amount or double-charged
- Subscription cancellation was ignored
Response: Fix the root cause. Improve shipping, descriptions, billing accuracy, and cancellation processes.
Fraudulent Chargebacks
- Customer received the product but claims they didn't
- Customer claims "unauthorized" but evidence shows they made the purchase
- Customer disputes after consuming a service (hotel stay, digital download)
- Serial disputer with a pattern of chargebacks across merchants
Response: Fight with representment evidence. Document delivery, capture signatures, save correspondence, and use chargeback protection services that intercept disputes before they become chargebacks.
Understanding your chargeback composition helps you allocate resources correctly — process improvements for legitimate disputes, evidence gathering and prevention tools for fraudulent ones.
Building a Fraud Prevention Stack
Tier 1: Baseline (Every Merchant)
- AVS verification on all card-not-present transactions
- CVV required for all online and phone orders
- Clear billing descriptors that customers recognize on their statements
- Confirmation emails with purchase details and your contact information
- Easy refund process so customers contact you instead of their bank
Tier 2: Intermediate (eCommerce and Growing Businesses)
- 3D Secure enabled on your payment gateway
- Velocity checks to catch card testing and rapid-fire fraud
- IP geolocation matching against billing/shipping addresses
- Chargeback alerts through services like Verifi and Ethoca to resolve disputes before they become chargebacks
- [Chargeback protection](/services/chargeback-protection) for automated dispute management
Tier 3: Advanced (High-Volume and High-Risk Merchants)
- Device fingerprinting to track and block fraud-associated devices
- Machine learning fraud scoring with customized rules
- Manual review queues for flagged high-value orders
- Negative lists of known fraudulent emails, addresses, and payment methods
- Behavioral analytics tracking user session patterns pre-purchase
Industry-Specific Fraud Considerations
High-Risk Merchants
High-risk merchant accounts face elevated fraud exposure by definition. Industries like nutraceuticals, supplements, and CBD attract more friendly fraud due to recurring billing models, buyer's remorse on health products, and higher average order values.
For peptide and supplement merchants specifically, see the peptide fraud prevention stack for a tailored approach to fraud prevention in that vertical.
eCommerce
Every transaction is CNP, so 3D Secure and fraud scoring are essential, not optional. Shipping to addresses that don't match billing is the top fraud signal — flag these for review rather than auto-declining (legitimate gift purchases exist).
Subscription and Recurring Billing
Trial abuse and "subscription I forgot about" disputes are the primary fraud vectors. Send pre-billing reminders, make cancellation easy and obvious, and maintain clear records of opt-in consent.
Restaurants and Retail
Card-present fraud is lower risk, but card skimming and employee theft still occur. Use EMV chip readers and P2PE terminals to prevent skimming. Implement daily reconciliation to catch discrepancies.
Measuring Your Fraud Prevention Effectiveness
Track these metrics monthly:
- Fraud rate — Fraudulent transactions as a percentage of total transactions
- Chargeback ratio — Total chargebacks divided by total transactions (keep below 0.9% for Visa, 1.5% for Mastercard). Understand how your chargeback ratio is calculated and monitored.
- False positive rate — Legitimate transactions declined by fraud filters. Over-aggressive fraud rules cost you sales.
- Manual review rate — Percentage of transactions flagged for human review. Should be under 5% for efficiency.
- Representment win rate — Percentage of disputed chargebacks you successfully reverse. A low win rate suggests you need better evidence collection.
Balance is critical. Too little fraud prevention and you lose money to fraud. Too much and you lose money to declined legitimate customers. The goal is the lowest combined cost of fraud losses plus prevention overhead.
How Unison Protects Merchants
Unison Payment Solutions provides layered fraud protection built into your payment processing:
- [Chargeback protection](/services/chargeback-protection) — Alert services and dispute management that intercept chargebacks before they hit your ratio
- Secure [payment gateway](/payment-gateway) — 3D Secure, AVS, CVV verification, and velocity checks built in
- P2PE terminals — Point-to-point encrypted hardware that eliminates card skimming risk at the point of sale
- [High-risk expertise](/high-risk-merchant-account) — Specialized fraud monitoring and prevention strategies for industries with elevated fraud exposure
- Real-time monitoring — Transaction alerts and pattern detection that flag suspicious activity before it escalates