Payments · Fitness7 min readUpdated November 2, 2026

Fraud Prevention and 3D Secure for Fitness Brands

The 2026 fraud limits, what fraud looks like on gym equipment and sports nutrition, what 3D Secure covers, and when to review before capture.

Nick Bonnassies, CMO at Tagada · checked against 8 sources

Article summary

TL;DR

Fraud in a fitness store follows resale value: stolen cards buy racks, treadmills and bundles to resell, while cheap accessories attract card testing. 3D Secure shifts liability for fraud disputes, but not for "not received" or "not as described". Use it on risky first orders, review big baskets before capture, and keep repeat-buyer data for refills.

Visa's VAMP flags US merchants at 1.5% fraud reports plus disputes and 1,500 cases a month (Stripe Docs, read November 2, 2026).
Mastercard's Excessive Fraud Merchant program applies above $50,000 and 0.50% fraud chargebacks when 3DS covers 10% or less of payments in non-regulated countries.
Stripe: if a customer disputes for any reason other than fraud, such as "product not received", "the standard dispute process applies" on 3DS payments.
An authorization you reverse before capture isn't reported as fraud; a captured payment is, even if refunded.
Visa can charge the acquirer $25,000 per merchant per month for changing merchant data to get around VAMP (Visa rules, October 24, 2026).

Want to go further? Ask

On this page

This guide is part of our hub on fitness payment processing. The general guide, for any business: fraud prevention and 3D Secure.

The fraud limits in 2026

Card networks count your fraud, not just your chargebacks. A fraud report counts even if no dispute follows and even if you refunded1.

Program	What it counts	Merchant threshold
Visa VAMP	Fraud reports plus disputes, over captured payments, same month1	1.5% and 1,500 cases (US)1
Visa Secure Excessive Fraud (US)	Fraud reports on domestic 3DS-authenticated payments1	$75,000 and 0.9%; you lose the liability shift until you exit1
Mastercard EFM	Fraud chargebacks over last month's ecommerce payments1	1,000 payments, over $50,000, over 0.50%, 3DS on 10% or less1
Visa VAMP enumeration	Card testing attempts, approved or declined1	300,000 attempts and 20% of authorizations1

Mastercard's EFM fines start at $500 in month two and climb to $100,000 a month from month 191. The dispute side of the same programs: chargebacks for fitness brands.

1.5%

Visa VAMP, fraud reports plus disputes (US)

0.9%

Visa Secure Excessive Fraud, with $75,000 in fraud (US)

0.50%

Mastercard EFM fraud chargeback ratio

$100,000

Mastercard EFM monthly fine from month 19

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

What fraud looks like in a fitness store

Each product family draws a different kind of fraud. Set your rules by family, not one rule for the whole catalog.

What you sell	Fraud pattern	Warning signs	Main control
Home gym equipment	Stolen cards buying resalable machines	New customer, basket far above average, rush shipping, billing and shipping in different places	3DS, manual review before capture
Fitness accessories	Card testing: many small attempts	Bursts of low-value orders, many cards on one device or IP	Velocity limits, block rules, CAPTCHA
Sports nutrition refills	Friendly fraud: the customer disputes a real order	Repeat buyer, same device, "I didn't order this"	Order data for CE 3.03
Workout programs	Account sharing, refund abuse	Many logins, dispute after full access	Access logs, terms at checkout

Vendor guides for fitness stores also describe refund abuse: equipment used for weeks, then claimed "damaged in shipping". That's not card fraud, and 3DS won't touch it. It's handled with return policies and delivery records, covered on the chargebacks page.

Fig. 1Four product families, four fraud patterns

Home gym equipment
Stolen cards buying resalable machines. Signs: basket far above average, rush shipping. Control: 3DS, manual review before capture.
Fitness accessories
Card testing. Signs: bursts of low-value orders, many cards on one device or IP. Control: velocity limits, block rules, CAPTCHA.
Sports nutrition refills
Friendly fraud. Signs: repeat buyer, same device, "I didn't order this". Control: order data for CE 3.0.
Workout programs
Account sharing, refund abuse. Signs: many logins, dispute after full access. Control: access logs, terms at checkout.

Set the rule by family, not one rule for the whole catalog.

From the table above. CE 3.0: Stripe Docs, How dispute prevention works.

What 3D Secure covers, and what it doesn't

3DS shifts liability for fraud disputes to the issuer, in most cases. Stripe is careful: it "can be expected" for eligible fraud disputes but "isn't guaranteed for any specific payment or dispute"2.

What it doesn't cover matters more for equipment:

Non-fraud disputes. For "product not received" and other non-fraud reasons, "the standard dispute process applies"2. Your delivery proof decides those, with the full address Visa requires6.
Inquiries left unanswered. If you ignore an inquiry on a 3DS payment, the bank can file a "no-reply" chargeback that "could invalidate the liability shift"2.
Off-session renewals. Subscription refills charged without the customer present don't support 3DS2. Only the first payment can be authenticated.
Merchants in a fraud program. Authenticated payments can lose the shift when your fraud is excessive2.

What 3DS does

Shifts liability for eligible fraud disputes to the issuer, in most cases
Lets you retry a soft decline that asks for authentication

What it leaves to you

"Not received" and other non-fraud disputes
Inquiries left unanswered
Off-session refills
Merchants in a fraud program

Watch out

3DS doesn't make an order safe to ship. Shopify stopped classifying 3DS-authenticated orders as low risk automatically5. A fraudster with the cardholder's phone passes the challenge too.

When to ask for 3D Secure

Ask for it where the risk is, not everywhere. Too little 3DS and Mastercard's EFM can catch you1; on every order, real buyers drop out at the challenge.

Signals that justify a challenge on a fitness order:

A first order well above your average basket, such as a full rack setup or a treadmill.
Card country, IP and shipping address that don't match.
Rush or freight-forwarder shipping to an address never used before.
Several cards tried on one device in a short time.
A soft decline asking for authentication: run 3DS, then retry2.

Skip it for returning customers with a clean history buying their usual refill.

Review big orders before you capture

For high-ticket equipment, the best fraud control is a pause. Stripe explains that issuers must report possible fraud on a captured payment, even if refunded, but not on an authorization you reverse before capture1.

Authorize at checkout, don't capture yet.
Flag orders above a threshold you set, or with mismatched signals.
Check them: call or email the customer, compare billing and shipping, look at the device and IP.
Capture and ship the good ones.
Cancel the authorization on the bad ones: no fraud report, no ratio impact1.

Fig. 2A big equipment order, held before capture

AuthorizeAt checkout, no capture yet
FlagAbove your threshold or mismatched
CheckCustomer, addresses, device and IP
Capture and shipThe good ones
CancelThe bad ones: no ratio impact

A reversed authorization brings no fraud report.

Stripe Docs, Dispute and fraud card monitoring programs.

Authorizations expire, so keep the review short and ship only after capture.

Friendly fraud on refills

A customer who has bought protein five times and disputes the sixth as fraud is rarely a fraudster. Visa's Compelling Evidence 3.0 handles that case: with at least two earlier orders sharing the IP address and an email or delivery address, the issuer must block a 10.4 fraud dispute3.

It only works if every payment carries the IP address, email and product description3. Alerts and Order Insight in detail: chargeback alerts for fitness brands.

Watch out

Never fix a fraud ratio by spreading sales across accounts or changing your descriptor. Visa can charge the acquirer $25,000 per merchant per month for altering merchant data "to circumvent" VAMP4. Lower the fraud instead.

How Tagada helps

3DS2 and block rules on the orders that need them

TagadaPay builds fraud control into the checkout, with "enhanced review for regulated verticals"8.

"Native 3DS2, device intelligence, and rules engine: approve real customers, block the rest."8
Block rules by IP, email, BIN, card number, customer or payment, temporary or permanent7: stop a card-testing burst or a known reseller.
Security: PCI DSS Level 1, SOC 2, ISO 27001, GDPR8.
24/7 human support on Slack Connect when an attack starts at night8.

Apply today · Go live in under 24 hours

Apply for processing

3DS2 and block rules on the orders that need them

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Does 3D Secure protect fitness equipment sellers from chargebacks?

Only from fraud chargebacks, and not always. Stripe says liability shift can be expected for eligible fraud disputes but isn't guaranteed. For "not received" or "not as described", the standard dispute process applies, so delivery proof and return records still decide equipment cases.

Should I use 3D Secure on every order?

Usually not, outside Europe. Ask for it on risky first orders: big baskets, mismatched countries, several cards on one device. Keep enough to stay out of Mastercard's EFM, which applies when 3DS covers 10% or less of payments in non-regulated countries.

How do I stop card testing on a fitness accessories store?

Limit attempts per device, IP and card, block repeat offenders, and add a CAPTCHA before payment. Visa monitors card testing separately: 300,000 attempts and 20% of authorizations put an account in "Excessive" enumeration monitoring. Test attempts count whether approved or declined.

Do refunded fraud orders still count against me?

Yes, once the payment is captured: the issuer reports the fraud even after a refund, and Visa counts it. What doesn't count is an authorization you cancel before capture, or a fraud report covered by Compelling Evidence 3.0. That's why reviewing big orders before capture pays off.

Can I use 3D Secure on subscription refills?

Only on the first payment. Off-session payments, charged without the customer present, don't support 3DS. Authenticate the sign-up, then keep the order data that lets Visa's CE 3.0 rules block friendly fraud disputes on later refills.

Sources

Checked November 2, 2026

TagadaPay

Stop equipment fraud without blocking real buyers

Tell us what you sell and how you sell it. Each application is underwritten, and approval is not guaranteed.

Apply for processing See pricing

01Tell us what you sell and how
02Underwriting reviews your business
03Process through TagadaPay alongside your other processors