Ecommerce Fraud Prevention: Stop Fraud Before You Ship

Fraud prevention isn't about catching every fraudster. It's about deciding, order by order, how much proof you need before you ship, and asking for it only when the risk calls for it. Here are the fraud types to plan for, the signals that give them away, and the checks that stop them, from the first visit to the last refund. For supplement and skincare brands: fraud and 3D Secure for supplement brands and fraud and 3D Secure for skincare brands.

This guide is about stopping fraudulent orders and payments. Disputes from real customers, chargeback alerts and Compelling Evidence 3.0 are covered in our guide to preventing chargebacks.

Types of ecommerce fraud

A payment is fraudulent when the cardholder didn't authorize it, and most fraudulent online payments use stolen cards or card numbers.3Stripe Docs, Common types of online fraud The rest of the list is about who uses those cards and how.

Two schemes catch merchants who think they're being helpful. In overpayment fraud, the buyer pays extra with a stolen card and asks you to pay their "freight company" with the difference; the shipper doesn't exist, and the cardholder's dispute takes the whole amount back. In the alternative refund scam, the buyer overpays, then asks for the excess by check or wire because the card is "closed". Stripe's rule: never refund with a different method than the one used to pay.3Stripe Docs, Common types of online fraud

Warning signs of a fraudulent order

No single signal proves fraud. Several at once, on the same order, usually do.2Stripe Docs, Identifying potential fraud

Stripe adds a few that are easy to miss: requests to split a large order across cards with different billing details, requests to process a card manually so it runs from your IP, and shipping to a freight forwarder.2Stripe Docs, Identifying potential fraud Shopify's fraud analysis shows the same kind of indicators on each order (AVS and CVV results, whether the customer's location matches the card, unusual device or network activity, more than one card tried) and rolls them into a low, medium or high recommendation. Shopify warns that the indicators alone don't give the order's overall risk.13Shopify Help Center, Fraud analysis

The layers of a fraud prevention stack

Each check sees a different moment of the order. Stack them so that what one misses, the next one catches.

The payment layer does most of the work, but it depends on what you send it. Stripe's card testing models and Radar improve with every field your checkout passes along: device data from its fraud detection script, IP address, email, name and billing address.4Stripe Docs, Protect yourself from card testing A billing postal code isn't always needed to take a card payment, but without it the issuer can't verify it, and a dispute is harder to win.1Stripe Docs, Best practices for preventing fraud

How risk scoring works

A risk score turns hundreds of signals into one number your rules can act on. In Stripe Radar, the model looks at hundreds of risk factors on each payment, plus data from across Stripe's network, and learns from the payments you mark as fraudulent.5Stripe Docs, Transaction risk prevention (Radar risk evaluation)

The thresholds are Stripe's defaults; other tools use their own scales. Shopify, for example, gives a low, medium or high recommendation instead of a number.13Shopify Help Center, Fraud analysis

Rules on top of the score

Rules let you encode what you know about your business: a product fraudsters target, a country you don't ship to, a card type that keeps getting disputed. Radar runs them in a fixed order: requests for 3-D Secure first, then allow, then block, then review. The first match wins, so an allow rule overrides every block rule and the default model.7Stripe Docs, Radar rules reference

Two details matter for subscription brands. Radar's models score only the first payment of a Stripe Billing subscription, though your rules still run on every renewal.5Stripe Docs, Transaction risk prevention (Radar risk evaluation) And in the EU, the Geo-blocking Regulation limits blocking customers based in other member states, so check before you write country rules.6Stripe Docs, Fraud prevention rules

AVS, CVC and 3-D Secure: what each check proves

All three are run by the card issuer, not by you. They answer different questions.8Stripe Docs, Card verification checks

A payment can be approved even when the CVC or postal code check fails: the issuer weighs other factors.6Stripe Docs, Fraud prevention rules That's why Radar lets you block payments that fail those checks, unless its model rates them low risk, and leaves alone payments where the check couldn't be done.6Stripe Docs, Fraud prevention rules A strict "must pass" rule would also block wallet payments, which don't send a CVC.7Stripe Docs, Radar rules reference

3-D Secure and liability shift

EMV 3-D Secure exists to help issuers and merchants prevent card-not-present fraud. Most transactions go through without the customer doing anything; on higher-risk ones the issuer can ask for a one-time code, a question or biometrics.10EMVCo, EMV 3-D Secure In Europe, Strong Customer Authentication makes it mandatory unless an exemption applies, and Stripe triggers it automatically.9Stripe Docs, Authenticate with 3D Secure (disputes and liability shift)

Three limits to plan around, from the same page:9Stripe Docs, Authenticate with 3D Secure (disputes and liability shift)

• Early fraud warnings still arrive on authenticated payments, and they count in card network monitoring programs.
• Only fraud is covered. A "product not received" dispute follows the normal process.
• The shift can be lost. A merchant enrolled in a fraud monitoring program can lose it, and an unanswered inquiry on a 3-D Secure payment can turn into a chargeback that voids it.

Asking for 3-D Secure on every payment costs conversion, so ask where the risk is: a new card, an elevated score, a high amount. Stripe's own example rule requests it when the risk level isn't normal and the amount is above 25 USD.6Stripe Docs, Fraud prevention rules More on liability shift in our glossary.

Card testing and velocity rules

Card testing is someone checking which stolen card numbers still work. Scripts run large batches of card saves or small payments through your checkout and keep the cards that pass, to use elsewhere or resell.4Stripe Docs, Protect yourself from card testing Nothing ships, but you still pay for it.

The card networks watch it too. Visa's VAMP places a merchant in enumeration monitoring when it reaches both thresholds in a month: 300,000 enumerated transactions, approved and declined, and an enumeration ratio of 20% of authorization attempts.11Visa, Visa Acquirer Monitoring Program fact sheet, 2025 Stripe notes that Visa doesn't fine merchants for enumeration, but the monitoring itself puts your account under watch.

How to stop card testing

Stripe is blunt about it: a filter on a single signal, like IP addresses, is usually not enough, because testers use many techniques at once.4Stripe Docs, Protect yourself from card testing

Velocity rules count earlier attempts over a window. In Radar they're attributes like total_charges_per_customer_hourly or total_charges_per_email_daily, with windows from hourly to all-time; the count excludes the payment being checked.7Stripe Docs, Radar rules reference Keep your secret API key private as well: testers who get it can create payments directly.4Stripe Docs, Protect yourself from card testing

Inside Tagada

See every payment's route, processor by processor

Set the order your processors are tried in, per store, per country or per product.

See how routing works

Manual review: what to check before you ship

Review is for the gray zone: orders your score and rules flag but don't block. In Stripe, a payment in review is still charged unless you capture separately, so the review has to happen before fulfillment.1Stripe Docs, Best practices for preventing fraud

Two tools buy you time for this. Authorize now and capture later: at Stripe you can capture up to 7 days after authorization, and an uncaptured authorization can't be disputed. See our guide to pre-authorization holds. And hold physical shipments 24 to 48 hours on doubtful orders: the cardholder may report the fraud first, and you keep the goods.1Stripe Docs, Best practices for preventing fraud

Account takeover and refund abuse

Some fraud doesn't need a stolen card. It uses a real account, or your own refund process.

When fraud gets through: refund, report, respond

Some fraud will get past every layer. What you do next decides whether it also becomes a dispute.

An early fraud warning is the card issuer telling you a payment was reported as fraud. Stripe found that about 40% of Visa and Mastercard warnings turn into disputes when you don't refund, and that refunding pays off on charges up to about the dispute fee.12Stripe Docs, How disputes work (early fraud warnings) If you're sure an order is fraud, refund it: a full refund can't be disputed, while a partial one can, for the full amount.1Stripe Docs, Best practices for preventing fraud The exception is a payment covered by 3-D Secure, where the issuer usually takes the loss.

When you're not sure, Stripe suggests refunding more readily when the order hasn't shipped yet, your dispute rate is already high, you're in a monitoring program, or you process fewer than about 100 payments a month, where one dispute moves your rate a lot.1Stripe Docs, Best practices for preventing fraud When a dispute does arrive, see chargeback vs refund for what you can still do, and our rebuttal letter template to answer it.

Fraud thresholds that put your account at risk

Fraud doesn't need to become a chargeback to count. Visa's monitoring ratio adds fraud reports (TC40) to disputes (TC15), divided by settled card-absent transactions.11Visa, Visa Acquirer Monitoring Program fact sheet, 2025

That's why a store with few chargebacks can still get flagged: fraud you refunded after an early fraud warning was still reported. Fraud reports covered by Compelling Evidence 3.0 and disputes resolved through pre-dispute services are left out.11Visa, Visa Acquirer Monitoring Program fact sheet, 2025 If your business already sits on a high-risk MCC, you have less room before a processor reacts.

How to measure your fraud prevention

Fraud loss is only half the score. Every good order you block is revenue lost too, and it doesn't show up in your dispute reports.

Stripe's own rule guidance follows the same logic: if blocks go up and fraud doesn't go down, the rule is blocking good customers; if a review rule mostly ends in refunds or disputes, make it a block.6Stripe Docs, Fraud prevention rules Radar also estimates the false positive rate of your block rules.6Stripe Docs, Fraud prevention rules

Fraud prevention with more than one processor

Many merchants route payments across several processors. Each processor's fraud model only sees the payments you send it, so the history that makes a risk score useful gets split.

Two practical effects. Block lists don't travel: a card you blocked on one processor can still pay on another. And evidence tied to one processor's history stays there: for Visa Compelling Evidence 3.0, Stripe can't check eligibility or submit evidence for payments processed elsewhere.1Stripe Docs, Best practices for preventing fraud Keep your own record of every attempt, device and refund at the checkout level, apply your velocity limits and block lists there, and use each processor's tools on top. Some tools also separate the checks: Stripe, for example, can run 3-D Secure on a payment that another provider processes.9Stripe Docs, Authenticate with 3D Secure (disputes and liability shift) For how routing works, see what payment orchestration is.