Payments · Info Products8 min readUpdated November 2, 2026

Fraud Prevention and 3D Secure for Info Product Businesses

The card fraud course and coaching sellers see, why low-price offers attract card testing, the 2026 network limits, and where 3D Secure helps.

Nick Bonnassies, CMO at Tagada · checked against 11 sources

Article summary

TL;DR

Course and coaching sellers see three kinds of card fraud: card testing on low-price offers, stolen cards on expensive programs, and buyers who use the course and then claim fraud. Protect cheap offers with CAPTCHA and rate limits, ask for 3D Secure on risky high-ticket orders, and log every access: dated logins and IP addresses answer a fraud claim best.

Stripe: card testers create "small amount payments, which cardholders are less likely to notice and report as fraudulent" (read November 2, 2026).
Visa's VAMP counts fraud reports plus disputes; the US "Excessive" level is 1.5% and 1,500 cases since April 1, 2026.
Mastercard's EFM applies above 0.50% fraud chargebacks when 3D Secure covers 10% or less of payments.
3DS liability shift "isn't guaranteed", and off-session renewals don't support 3DS.
For digital goods, Visa accepts proof such as IP address, device ID and access to your site on or after the purchase date (rules of October 24, 2026).

Want to go further? Ask

On this page

This guide is part of our hub on info product payment processing. The general guide, for any business: fraud prevention and 3D Secure for high-risk merchants.

Fraud an info product business sees

A course has no warehouse and no shipping delay. The buyer gets access in seconds, so fraud has to be stopped at the payment, or proven afterward with access data.

Type	What it looks like	First defense
Card testing	Bursts of small payments on your cheapest offer, nonsense names and emails2	CAPTCHA, rate limits, block rules
Stolen card on a high-ticket program	New buyer, high-ticket order, card country and IP don't match	3D Secure, manual review before access
Access resale	One account used from many devices and countries	Device limits, login alerts
Friendly fraud	The buyer finishes the course, then reports the charge as fraud	Access logs, Order Insight with CE 3.07
Someone else's card	A partner or parent pays, the cardholder disputes	Billing name on receipts, clear descriptor

Fig. 1Where each fraud type shows up in a buyer's journey

Cheapest offerCard testing: CAPTCHA, rate limits, block rules
High-ticket checkoutStolen card: 3D Secure, review before access
Instant accessAccess resale: device limits, login alerts
LessonsFriendly fraud later: access logs, Order Insight
StatementSomeone else's card: billing name, clear descriptor

Access is instant, so the defense sits at the payment or in the logs.

Stripe Docs, card testing and Compelling Evidence 3.0.

Card testing on low-price offers

A low-price ebook or tripwire is the perfect target: a small charge that cardholders rarely notice2. Stripe lists the consequences: disputes and Early Fraud Warnings, higher decline rates for your real buyers, extra fees, and possible card monitoring programs2.

Signs to watch, per Stripe2:

A spike in failed or blocked payments.
A spike in generic declines.
Many low-amount payments with "nonsensical customer names and emails".

Defenses Stripe recommends2:

CAPTCHA
On every request that can validate a card or make a payment.
Rate limits
Such as a cap on new customers per IP address per day.
Limits on cards per account
And purchases of the same product.
Refund suspicious payments
That get through, to avoid disputes.
Stop retrying
Cards saved by fraudulent customers after an attack.

Watch out

Opt-in pages and free trials that save a card are also targets. Stripe says card setup is the method "preferred by fraudulent actors" because validations don't usually show on statements2.

The fraud limits that apply

Program	What it counts	Threshold, 2026	What follows
Visa VAMP	Fraud reports plus disputes on card-absent payments1	1.5% and 1,500 cases (US)1 4	Fees at "Excessive"
Visa VAMP, enumeration	Card testing attempts, approved or declined1	300,000 attempts and a 20% ratio1	Program entry
Visa Secure Excessive Fraud (US)	Fraud on domestic 3DS-authenticated payments1	$75,000 and 0.9%1	NoLiability shift on those payments until you exit1
Mastercard EFM	Fraud chargebacks over ecommerce payments1	1,000 payments, over $50,000, over 0.50%, 3DS on 10% or less1	Fines from month 2, up to $100,000 a month1

1.5%

Visa VAMP ratio for US merchants, with 1,500 cases

300,000

Card testing attempts for Visa's enumeration level, with a 20% ratio

0.9%

Visa Secure Excessive Fraud ratio, with $75,000

0.50%

Mastercard EFM fraud ratio, with 3DS on 10% or less

A fraud report counts even if you refund: issuers must report possible fraud on a captured payment, refunded or not1. What isn't reported is a suspicious authorization you reverse before capture1.

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

What 3D Secure does, and doesn't

3DS...	Does	Doesn't
Authenticates the cardholder	Typically moves eligible fraud liability to the issuer3	Guarantee the shift on a given payment3
Runs at checkout	Covers the first payment or the card you save	Run on off-session renewals or installments3
Uses device and transaction data	Often passes without a challenge3	Stop "not as described" disputes3
Helps your fraud ratio	Keeps Mastercard's EFM away if enough payments use it1	Protect you inside Visa Secure Excessive Fraud1

European buyers. Strong Customer Authentication is "a European regulatory requirement", and payments that don't follow it "may be declined by your customers' banks", as Kajabi tells its creators8. If you sell to the EU or UK, 3DS is part of the checkout, not an option.

Fig. 2A payment plan: 3DS covers the first payment, not the next ones

First payment, at checkout

CheckoutBuyer present
runs3D SecureCardholder authenticatedApproved

Eligible fraud liability typically moves to the issuer

Later installment

InstallmentOff-session
chargesSaved cardCharged without the buyer, no 3DS

No 3DS: your terms and logs are the protection

Later installments run without the buyer, so ask for 3DS when the card is saved.

Stripe Docs, Authenticate with 3D Secure, read October 26, 2026.

Where to ask for 3D Secure

High-ticket programs and coaching, where one stolen card costs you the whole price.
First payment of a payment plan, since later installments run without the buyer.
Card country, IP and billing country that don't match.
Several cards tried from one device or one email.
Soft declines where the issuer asks for authentication.
Not returning buyers with a clean history: a challenge on a small upsell costs you sales.

Legitimate buyers who still get declined: reducing payment declines for info product businesses.

Instant access: when to deliver

Most info products deliver on payment. For the expensive ones, a short pause is worth more than speed.

Authorize the card at checkout for high-ticket orders flagged by your rules.
Review the order: name, email domain, IP country, card country, past purchases.
Capture and grant access if it checks out.
Void the authorization if it doesn't. Fraud found before capture isn't reported1.
Stay inside the window: an online authorization started by the customer lasts 7 days on Visa and Mastercard, per Stripe5.

Fraud found before capture isn't reported; the authorization lasts 7 days.

Kajabi's advice after an Early Fraud Warning applies too: "we recommend revoking access to the content that was purchased"9.

Friendly fraud: access is your proof

A buyer who watched every lesson and then says "I didn't make this purchase" is the most common fraud claim a course seller can win. Visa's evidence rule for digital goods asks for a description, the date the service was provided, and two or more items such as6:

IP address and device ID.
The buyer's name and email linked to their account with you.
Proof the buyer's profile was accessed and verified before the purchase.
Proof your site was accessed by the cardholder on or after the purchase date.
The same device and card used in an earlier undisputed payment.

With Order Insight, CE 3.0 can block the dispute before it's filed when two earlier payments match on IP address and email7. That's why every payment, renewal and installment should carry the buyer's IP and email. More: chargeback alerts for info product businesses.

How Tagada helps

3DS2 and block rules on the course orders that need them

TagadaPay builds fraud control into the checkout, with "enhanced review for regulated verticals"11. "If you sell something real, we will get you paid." "Live in 24h. You own your vault."11

"Native 3DS2, device intelligence, and rules engine: approve real customers, block the rest."11
Block rules by IP, email, BIN, card number, customer or payment, temporary or permanent10: stop a card-testing burst on your tripwire or a known chargeback abuser.
Security: PCI DSS Level 1, SOC 2, ISO 27001, GDPR11.
24/7 human support on Slack Connect when an attack starts at night11.

Apply today · Go live in under 24 hours

Apply for processing

3DS2 and block rules on the course orders that need them

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Does 3D Secure stop chargebacks on online courses?

Partly. It typically moves liability for eligible fraud disputes to the issuer, but Stripe says that isn't guaranteed. It doesn't cover "not as described" disputes, which are common on courses, and it never runs on off-session renewals or installments.

Why am I getting many small failed payments on my course checkout?

That's the classic sign of card testing: scripts testing stolen cards with small charges, often on your cheapest offer. Add CAPTCHA, rate limits per IP and cards per account, refund any that succeeded, and don't retry those cards.

Should I require 3D Secure on every course purchase?

Usually not. Ask for it on high-ticket orders, first payment-plan installments and mismatched countries. Keep enough 3DS volume to stay clear of Mastercard's EFM, which applies when 3DS covers 10% or less of payments. EU and UK buyers need it anyway.

Does a refund remove a fraud report?

No. Issuers must report possible fraud on a captured payment even if you refund it, and Visa counts it in VAMP. What isn't reported is a suspicious authorization you void before capture. That's why reviewing big orders before granting access works.

How do I prove a buyer used my course?

Keep dated logs: logins, lessons opened, downloads, IP address and device. Visa's evidence rules for digital goods accept items such as IP, device ID and access to your site on or after the purchase date. Without logs, you have nothing to send.