Payments · Telehealth8 min readUpdated November 2, 2026

Fraud Prevention and 3D Secure for Telehealth Companies

The card fraud a telehealth brand sees, the 2026 network limits, how authorize-then-capture keeps fraud off your ratio, and where 3D Secure helps.

Nick Bonnassies, CMO at Tagada · checked against 10 sources

Article summary

TL;DR

Telehealth fraud is mostly card testing, stolen cards on first orders and patients disputing renewals they forgot. Authorize at checkout and capture only after the clinician approves: a suspicious authorization you reverse before capture isn't reported as fraud. Ask for 3D Secure on risky first orders, not everyone, and remember it never covers renewals.

Stripe: if you "reverse a fraudulent or suspicious payment authorization before it's captured, it isn't reported" (read November 2, 2026).
An online card authorization started by the customer stays valid 7 days on Visa and Mastercard, per Stripe.
Visa's VAMP counts fraud reports plus disputes; the US "Excessive" level is 1.5% and 1,500 cases since April 1, 2026.
Mastercard's EFM applies above 0.50% fraud chargebacks when 3D Secure covers 10% or less of payments.
3DS liability shift "isn't guaranteed", and off-session renewals don't support 3DS.

Want to go further? Ask

On this page

This guide is part of our hub on telehealth payment processing. The general guide, for any business: fraud prevention and 3D Secure for high-risk merchants.

Fraud a telehealth brand sees

Card fraud in telehealth looks like ecommerce fraud with one twist: the order goes through a clinician before anything ships.

Type	What it looks like	First defense
Card testing	Many small attempts on the cheapest offer, often a consultation fee	Velocity limits, bot protection, block rules
Stolen card on a first order	New patient, high first basket, mismatched card country and IP	3D Secure, review before capture
Someone else's card	A relative or partner pays, then the cardholder disputes	Clear billing name, receipts to the payer
Friendly fraud on renewals	A real patient reports a renewal as "not authorized"	Visible terms, reminders, easy cancellation
Account takeover	Login to the patient portal from a new device, change of address	Code-based login, alerts on address changes

Card testing has its own Visa monitoring: VAMP flags enumeration above 300,000 attempts and a 20% ratio, approved or declined1. Long before that, a burst of test charges can push your processor to act.

Fig. 1Where each kind of fraud shows up in a patient's journey

CheckoutCard testing, stolen card: velocity limits, 3D Secure
Clinician reviewVoid what doesn't pass, before capture
Patient portalAccount takeover: code login, address alerts
StatementSomeone else's card: clear billing name
RenewalFriendly fraud: terms, reminders, cancellation

The clinician's review is a window most merchants don't have.

Stripe Docs, Dispute and fraud card monitoring programs and Authenticate with 3D Secure.

The fraud limits that apply

Three programs count fraud, each in its own way. Watch the lowest bar that applies to you.

Program	What it counts	Threshold, 2026	What follows
Visa VAMP	Fraud reports plus disputes over captured card-absent payments1	1.5% and 1,500 cases (US, Canada, EU, Asia Pacific, Latin America)1 4	Fees at "Excessive"
Visa Secure Excessive Fraud (US)	Fraud on domestic 3DS-authenticated payments, in dollars1	$75,000 and 0.9%1	NoFine, but no liability shift on domestic 3DS payments until you exit1
Mastercard EFM	Fraud chargebacks over last month's ecommerce payments1	1,000 payments, over $50,000, over 0.50%, 3DS on 10% or less1	Fines from month 2, up to $100,000 a month1

1.5%

Visa VAMP, with at least 1,500 fraud reports and disputes

0.9%

Visa Secure Excessive Fraud (US), with $75,000 in fraud

0.50%

Mastercard EFM fraud chargeback ratio

300,000

Enumeration attempts before VAMP flags card testing

A fraud report counts even if you refund the order: issuers must report possible fraud on a captured payment, refunded or not1. Refunding doesn't clean the ratio. Stopping the next order does.

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Use the authorization window

The clinician's review gives you a window most merchants don't have. Authorize the card at checkout, capture only when the case is approved, and void the rest.

Fraud found before capture isn't reported
Stripe: issuers "aren't required to report it for a payment authorization"1.
The window is short
A customer-initiated online authorization lasts 7 days on Visa and Mastercard; an uncaptured one is released and canceled2.
Patients see the hold
Some card statements don't separate an authorization from a charge, "which can sometimes confuse customers"2. Say on the checkout page that the card is held, not charged.

Watch out

A card hold is a payment step, not a clinical decision. Your checkout copy must not suggest the patient is approved because the card went through.

How to build this flow, step by step: prescription-gated checkout.

What 3D Secure does, and doesn't

3DS...	Does	Doesn't
Authenticates the cardholder	Typically moves eligible fraud liability to the issuer3	Guarantee the shift on a given payment3
Runs at checkout	Covers the first order or the card you save	Run on off-session renewals3
Uses device and transaction data	Often passes without a challenge3	Stop non-fraud disputes, such as "service not as described"3
Protects your fraud ratio	Keeps Mastercard's EFM away if enough payments use it1	Protect you inside Visa Secure Excessive Fraud, where the shift is removed1

Watch out

If an issuer sends an inquiry on a 3DS-authenticated charge, answer it. An unanswered inquiry can become a chargeback that loses the liability shift3.

Where to ask for 3D Secure

First orders well above your average consultation or plan price.
Card country, IP and state of residence that don't match.
Several cards tried on one device or one email.
A new card added to an existing patient account.
Soft declines where the issuer asks for authentication.
Not returning patients with a clean card history: a challenge costs you a refill.

Legitimate patients who still get declined: reducing payment declines for telehealth companies.

Patient identity is a different check

3D Secure proves the person holds the card. It doesn't prove who the patient is, or how old they are.

Check	What it proves	Who asks for it
3D Secure	The cardholder approved the payment	Issuer, your fraud rules
Photo ID before prescription	The patient is who they say	Your clinical protocol, per offer
Age 18 and over	Eligibility for some ads and offers	Meta, for prescription drug ads9; your protocol
State of residence	The clinician is licensed where the patient is	Medical licensing rules

Keep both checks. A stolen card with a real patient ID, or a real card with a fake ID, each slips past one of them. State rules and blocking at checkout: telehealth across state lines.

Renewals and friendly fraud

Renewals run off-session, without the patient, so 3DS can't help3. The defense is the consent you capture at sign-up and what you send before each charge.

Fig. 2First order and renewal: two different protections

First order

CheckoutPatient is on-session
asks for3D SecureCardholder authenticatedApproved

Eligible fraud liability typically shifts

Renewal

RenewalCharged off-session
can't run3D SecureCan't run off-sessionDeclined

No 3DS: consent, reminders and cancellation decide

3DS guards the first order; your terms guard every renewal.

Stripe Docs, Authenticate with 3D Secure; Visa Core Rules, April 18, 2026.

Prevention	Rule or source
Trial or intro price: reminder at least 7 days before it ends	Visa5
Billing reminder 2 to 3 days before a monthly renewal, 7 days before a yearly one	Stripe best practice1
A button to accept billing terms; online cancellation	Stripe best practice1
Keep IP, device and order history for repeat patients	Supports Visa's Compelling Evidence 3.01

When fraud claims slip through anyway, alerts catch them first: chargeback alerts for telehealth. Renewals that fail for good reasons belong in recovery: failed payment recovery for telehealth companies.

How Tagada helps

Fraud checks before the charge

TagadaPay brings "native 3DS2, device intelligence, and rules engine: approve real customers, block the rest"10, with "enhanced review for regulated verticals".

Native 3DS2, device intelligence and a rules engine, plus block rules by IP, email, BIN, customer or payment8.
Your vault, portable: "Switch processors without re-onboarding customers".
Routing across TagadaPay and processors such as Stripe, NMI and Airwallex, with one logic, and a cascade to another processor when one is down or times out.
24/7 human support on Slack Connect.

Building the whole telehealth brand? With Tagada Rx, "Approve captures the hold. Decline voids it. Money never leaves the card if the clinician does not prescribe"6, and patients upload a photo ID from the portal when the offer requires it7. US patients only, by selection.

Apply for processing

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Does 3D Secure stop chargebacks for telehealth?

Partly. It typically moves liability for eligible fraud disputes to the issuer, but Stripe says it isn't guaranteed. It doesn't cover non-fraud disputes, such as a patient unhappy with a consultation, and it never runs on off-session renewals.

Should a telehealth brand use 3D Secure on every order?

Usually not. Ask for it on risky first orders: high amounts, mismatched countries or states, several cards on one device. Keep enough 3DS volume to stay clear of Mastercard's EFM, which applies when 3DS covers 10% or less of payments.

Does a refund remove a fraud report?

No. Issuers must report possible fraud on a captured payment even if you refund it, and Visa counts it in VAMP. What isn't reported is a suspicious authorization you reverse before capture. That's why reviewing before capture works.

How long can I hold a card before the clinician approves?

About 7 days for an online payment the customer started, on Visa and Mastercard, per Stripe. If you don't capture in time, the authorization is released. Plan your clinical review inside that window, or authorize again.

Is 3D Secure the same as verifying a patient's identity?

No. 3DS confirms the cardholder approved the payment. Patient identity, age and state of residence are separate checks your clinical protocol sets, such as a photo ID before prescription. A strong setup runs both.