Payments · Online Pharmacy6 min readUpdated November 2, 2026

Fraud Prevention and 3D Secure for Online Pharmacies

The fraud an online pharmacy sees, when to ask for 3D Secure, how authorize-then-capture keeps fraud out of Visa's ratio, and acquirer limits.

Nick Bonnassies, CMO at Tagada · checked against 8 sources

Article summary

TL;DR

Ask for 3D Secure on risky first orders, not on every patient. Then use the time between authorization and capture: while the prescription is reviewed, cancel any order that looks fraudulent before capturing it. Stripe notes that issuers don't have to report fraud on an authorization reversed before capture, so it stays out of Visa's fraud count.

Issuers "aren't required to report" possible fraud on an authorization; on a captured payment they are, even if refunded (Stripe).
An online card authorization is valid 7 days for customer-initiated Visa and Mastercard payments.
Liability shift "can be expected" on authenticated payments with eligible fraud disputes, "but it isn't guaranteed".
Visa's VAMP ratio counts fraud reports and disputes together: 1.5% and 1,500 cases is "Excessive" in the US.
Visa Secure Excessive Fraud starts at $75,000 and 0.9% fraud on US 3DS payments; you lose liability shift until you exit.

Want to go further? Ask

On this page

This guide is part of our hub on online pharmacy payment processing. The general guide, for any business: fraud prevention and 3D Secure. Brands that want the prescription side run for them can apply to Tagada Rx, a stack with storefront, doctors, pharmacy and payments.

The fraud an online pharmacy sees

Most of it is ordinary card fraud, with one twist: the goods are prescription-only and resell well.

Type	Signals	First defense
Card testing	Many small attempts, often on consult fees or the cheapest item	Velocity limits, bot protection, block rules on IP and BIN
Stolen cards	New patient, high basket, rush shipping, card and IP countries differ	3DS on the first order, address checks
Account takeover	Login from a new device, address or card changed, then a refill ordered	Re-authenticate on changes, 3DS on the new card
Shipping to an unlicensed state	Delivery address outside your licensed states	Block at checkout: a pharmacy must hold the license of each state it ships to under federal law for controlled substances, and states require it in practice4
Friendly fraud	A real patient disputes a real order or refill	Clear terms, notice before refills, easy cancellation

Visa monitors card testing separately: VAMP's enumeration program flags accounts above 300,000 enumerated attempts and a 20% ratio2.

Use the review window: authorize, then capture

A prescription order already waits for a review before it ships. Hold the card during that review and capture only once the order is approved.

Authorize the payment at checkout, with 3DS if the order is risky.
Review the prescription and the fraud signals at the same time.
Void the authorization if the order is declined or looks fraudulent.
Capture once the order is approved and before the authorization expires.

The card is held during the review, not charged.

Card brand	Customer-initiated (checkout)	Merchant-initiated
Visa	7 days	5 days (4 days 18 hours exactly)
Mastercard	7 days	7 days
American Express, Discover	7 days	7 days

Card-not-present authorization windows published by Stripe3. Extended authorizations exist for some cases.

Watch out

"If you identify and reverse a fraudulent or suspicious payment authorization before it's captured, it isn't reported"2. Once captured, a fraud report counts in Visa's VAMP ratio even if you refund it2.

The checkout design behind this: prescription-gated checkout.

Fig. 1A held order, from checkout to capture

Day 0: authorizeHold the card, 3DS if risky
ReviewPrescription and fraud signals together
Void if suspiciousReversed before capture: not reported
Capture by day 7Approved orders only (Visa, checkout)
After captureA fraud report counts in VAMP, even if refunded

Reverse a fraud before capture and Visa never counts it.

Stripe Docs, Place a hold on a payment method and Dispute and fraud card monitoring programs.

Where to ask for 3D Secure

First orders
From new patients, above your average basket.
Mismatch
Between card country, IP and shipping address.
A new card
Added to an existing account, or a changed shipping address.
Several cards tried
On the same device or account.
Soft declines
Where the issuer requests authentication.
Not on returning patients
With clean history: each challenge costs completions.

Fewer declines on legitimate patients: reducing payment declines for online pharmacies.

What 3D Secure doesn't cover

3DS...	Covers	Doesn't cover
Liability	Eligible fraud disputes on authenticated payments, typically1	A guaranteed shift on any given payment1
Payments	The first, customer-present order	Off-session refills, which don't support 3DS1
Disputes	Stolen-card fraud	"Not received", "cancelled recurring", "not as described"1
Inquiries	Nothing if you stay silent	A no-reply inquiry can become a chargeback that voids the shift1

Refills need other protection: consent at sign-up, a notice before each charge, and cancellation online. See how to sell prescription medications on subscription.

The fraud limits your acquirer watches

Online pharmacies (MCC 5122 and 5912) are high-integrity risk merchants for Visa; your acquirer monitors your activity daily from day 315. On top of that, the general programs apply.

Program	What it counts	Threshold
Visa VAMP	Fraud reports plus disputes, over captured payments	1.5% and 1,500 cases (US) (Stripe)2
Visa VAMP enumeration	Card testing attempts reaching the processor	300,000 and 20% (Stripe)2
Visa Secure Excessive Fraud (US)	Fraud on domestic 3DS payments	$75,000 and 0.9% (Stripe)2
Mastercard EFM	Fraud chargebacks, when 3DS covers 10% or less of payments	1,000 payments, over $50,000, over 0.50% (Stripe)2

1.5%

Visa VAMP: fraud reports plus disputes, with 1,500 cases (US)

300,000

Enumerated attempts before Visa's card-testing program applies, with a 20% ratio

0.9%

Visa Secure Excessive Fraud threshold on domestic 3DS payments (US), with $75,000

0.50%

Mastercard EFM fraud chargeback ratio, above 1,000 payments and $50,000

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Disputes that get past these defenses: chargebacks for online pharmacies and chargeback alerts. The checkout itself, with 3DS and wallets: checkout optimization for online pharmacies.

How Tagada helps

3DS on risky orders, capture only on approval

Tagada Rx, a stack with storefront, doctors, pharmacy and payments, builds the review window into the checkout7:

Hold, capture on approval: "Approve captures the hold. Decline voids it." Money never leaves the card if the clinician doesn't prescribe8.
Native 3DS2, device intelligence and a rules engine, so you ask for authentication on risky orders only.
Block rules on IP addresses, emails, BIN or card number patterns, customers or payment IDs6.
US patients only, with pharmacy routing to a licensed US pharmacy7.

Tagada Rx is open by application to a selected group of brands. How it works and how to apply: Tagada Rx.

Apply to Tagada Rx

3DS on risky orders, capture only on approval

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Should an online pharmacy use 3D Secure on every order?

Usually not. Ask for it on risky first orders, new cards, mismatched countries and soft declines that request it. Returning patients with clean history rarely need a challenge, and each challenge costs completed orders. Renewals can't use 3DS anyway.

Does 3D Secure stop chargebacks on prescription orders?

It typically shifts liability for eligible fraud disputes to the issuer, but Stripe says it isn't guaranteed. It doesn't cover "not received" or cancelled-refill disputes, or off-session refills.

Why authorize first and capture after the prescription review?

Because a declined or suspicious order can be voided instead of refunded. Issuers aren't required to report fraud on an authorization reversed before capture, so it stays out of Visa's fraud count. Capture within the authorization window, usually 7 days.

How do I stop card testing on my pharmacy checkout?

Limit attempts per device, IP and card, add bot protection, and block patterns of BINs or emails. Visa watches card testing in its own VAMP enumeration program. Small consult or shipping fees are a frequent target.

Does 3D Secure work on refills?

No. Refills are off-session payments, which don't support 3DS. Authenticate the card at the first order, then rely on clear consent, a notice before each refill charge and easy cancellation.

Sources

Checked November 2, 2026

Tagada Rx

Stop pharmacy fraud before you capture

Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.

Apply to Tagada Rx

01Tell us about your brand
02We review every application
03Go live under your brand after review