Ecommerce fraud prevention: a layered plan for online stores

Ecommerce fraud prevention is the set of checks that stop stolen cards and bots before an order ships, without turning away so many real customers that the cure costs more than the fraud. No single tool does it. Address checks miss fraudsters who know the billing address. Security code checks miss stolen card details that include the code. 3-D Secure adds a step some buyers won't finish. So you stack them, each one catching what the last one missed, and you set each one to fit what you sell and how much fraud you actually see.

The stakes are real for online sellers. In the Federal Reserve's report on 2023 debit card transactions at issuers with $10 billion or more in assets, card-not-present fraud made up 54.3% of fraud losses, and merchants absorbed 65.1% of those card-not-present losses (Federal Reserve). Those are debit figures from large banks, not the whole market, but the direction is clear: when an online sale turns out to be fraud, the merchant usually pays.

What types of ecommerce fraud should you plan for?

Three kinds cause most of the trouble for a small online store, and each needs a different defense.

Card testing is the one owners underestimate. Visa describes enumeration as a rapid, brute-force card testing attack at scale and says it leads to $1.1 billion in fraud losses a year (Visa). The testers often don't buy anything from you. They use your checkout to check cards they'll spend somewhere else. You still feel it: every attempt is an authorization request, your provider may charge for each one, and a sudden wave of declines is the kind of pattern that gets an acquirer's attention.

Friendly fraud is a different problem. Visa calls it first-party misuse and lists confusion over the billing descriptor among its causes (Visa). Fraud filters can't stop it, because the buyer is the real cardholder. We cover it in depth in friendly fraud, and our guide to preventing chargebacks covers the fixes: clear descriptors, detailed receipts, and the evidence rules that help you win.

Who pays when an online order turns out to be fraud?

By default, you do. The US chip liability shift that took effect October 1, 2015 was built for counterfeit card-present transactions (Visa), so it offers nothing online. When a cardholder says they didn't make an online purchase, the issuer files a fraud dispute and your acquirer takes the money back from your account.

The real loss is bigger than the sale. Here's a made-up example. A shop in Las Vegas ships $300 headphones that cost it $180, with $12 in shipping, to a buyer using a stolen card. The chargeback reverses the $300, the headphones are gone, and say the provider charges a $20 chargeback fee. The shop is out $212, plus whatever processing fees it doesn't get back. Each good headphone sale earns $120 in gross profit, so the shop needs nearly two more good sales just to cover one fraudulent one.

If you want that liability moved, 3-D Secure is the main way to do it. Under Visa Secure, a successfully authenticated transaction protects you from fraud-related disputes, and so does an attempted authentication where the issuer or cardholder doesn't participate (Visa). Mastercard's Identity Check guide says merchants receive the liability shift only for transactions submitted for authentication that get a valid authentication value back (Mastercard). For the full liability picture, see our guide to card-not-present transactions.

How do the layers of ecommerce fraud prevention work?

Think of each check as a filter with a dial. Turn it too far one way and fraud gets through; too far the other and you decline real customers who never come back. Here's what each layer does and where we'd set the dial for a typical small store.

Address verification (AVS)

AVS compares the billing address the customer types with the address the card issuer has on file. A "Y" response means the street address and postal code both match (Visa). Other responses cover partial matches, no match, and "U", meaning the issuer couldn't check or doesn't support it.

AVS checks the billing address only. It says nothing about where the order is going. These starting rules are our suggestions, not network requirements:

Don't auto-decline partial matches. Apartment numbers, abbreviations, and recent moves trip AVS all the time, and those are real customers.

Card security code

A security code check verifies the three- or four-digit number printed on the card. Run it on every order. It proves the buyer has the code, which rules out some stolen data, but not data skimmed along with the code. Two rules come with it. Under Visa's dispute rules, if the code check came back "N" for no match and the issuer approved the sale anyway, your acquirer can use that in responding to a fraud dispute (Visa). And never keep the code: PCI DSS prohibits storing card verification codes after authorization, even encrypted (PCI SSC).

Velocity rules

Velocity rules cap how many attempts can come from one card, address, device, or email in a set window. They're the main defense against card testing. Visa's guidance for merchants on enumeration notes that attack transactions are often under $10 and recommends velocity checks on low-amount and authorization-only transactions. It also suggests watching velocity across IP address, device, and email, limiting how many cards can be added per account and per session, using CAPTCHA to tell people from bots, and running a web application firewall (Visa).

Reasonable starting points for a small store, which you should adjust once you see your own traffic:

• No more than three declined attempts on one card in an hour.
• No more than three different cards tried from one device or IP address in a day.
• An alert on any burst of authorizations under $5.
• A minimum amount on donation or pay-what-you-want forms.

3-D Secure

3-D Secure brings the card issuer into the check. EMVCo describes two paths: a frictionless flow, where the issuer approves after a real-time risk assessment without asking the cardholder to do anything, and a challenge flow, where a transaction the issuer sees as high risk needs extra input from the cardholder (EMVCo). EMVCo built EMV 3-D Secure to help prevent card-not-present fraud (EMVCo).

The trade-off is the challenge screen. Some buyers abandon it. Mastercard's Identity Check guide recommends risk-based authentication, where extra checks are saved for riskier transactions, and that's the version to ask for. Use it on high-value orders, first-time buyers of resellable goods, or whenever your fraud rate is climbing.

Manual review

Rules are blunt. Manual review handles the orders that look odd but might be fine. Signs worth a second look:

• A shipping address that doesn't match the billing address, combined with rush shipping.
• Several cards tried on one order or one account.
• A first-time customer ordering several of the same resellable item.
• An email address that has nothing to do with the cardholder's name.

Contact the customer using the details on the order, and if something doesn't add up, refund before you ship. A refund costs you the sale. A chargeback costs you the goods as well.

Fulfillment and evidence

The last layer happens after approval. For card-absent sales, Visa's advice is not to deposit the transaction until you've shipped the merchandise. Use signature confirmation on high-value orders, and save the login ID, IP address, device ID, and delivery address for every order. Under Visa's Compelling Evidence 3.0 rules, matching data from earlier undisputed purchases can defeat a later fraud claim from the same customer (Visa).

How strict should your fraud rules be?

Strict enough that the fraud you stop is worth more than the good orders you turn away. That sounds obvious, but declined good customers never show up in a report. They just leave.

Here's a made-up example of the math. An online auto parts store in Detroit takes 3,000 orders a month at an $80 average, with a 40% gross margin, so each good order earns $32 and the parts cost $48. It's considering a rule that declines every order with no AVS match. Looking back at last quarter, that rule would have caught about 60 orders a month: 15 fraudulent and 45 from real customers.

• Fraud stopped: each fraud order would have cost $48 in parts, $8 in shipping, and a made-up $20 chargeback fee, or $76. Fifteen of them is $1,140.
• Good orders lost: 45 × $32 = $1,440 in gross profit.

The rule costs $300 more than it saves. Now send those 60 orders to manual review instead. At five minutes each, that's five hours of staff time, about $100 at $20 an hour. The store keeps the $1,440 from good customers and still avoids the $1,140 in fraud. Review wins easily. Run the same math with your own numbers before you switch on any automatic decline.

What fraud and dispute levels get you in trouble?

The card networks watch merchants whose fraud or disputes run high, and your acquirer may set tighter limits of its own. Visa's monitoring program divides fraud reports plus disputes by settled card-not-present transactions; in the US, a merchant is flagged as excessive at 1.5% or more since April 1, 2026, if it also has at least 1,500 fraud reports and disputes that month (Visa). Mastercard's security rules require acquirers to act on merchants whose card-not-present fraud passes 100 gross basis points, and for e-commerce that means capturing the CVC 2 code or enabling Identity Check (Mastercard).

Small stores rarely hit Visa's count minimum, but acquirers don't wait for it. Work out your own ratio every month: fraud reports plus disputes, divided by settled online orders.

Ecommerce fraud prevention checklist

1. Turn on AVS and security code checks, and write down which results you approve, review, and decline.
2. Set velocity limits per card, device, IP address, and email.
3. Add a bot challenge to checkout and account creation, and a minimum on open-amount forms.
4. Decide when 3-D Secure applies: by order value, product type, or customer history.
5. Create a manual review queue with a same-day time limit.
6. Ship only after approval, and get a signature on high-value orders.
7. Save login ID, IP address, device ID, and delivery address on every order.
8. Use a billing descriptor customers will recognize.
9. Check fraud and dispute ratios monthly.
10. After 30 days, review the good orders your rules declined as well as the fraud that got through.

Clearo's online payments include fraud screening with AVS, CVV checks, and velocity rules, plus chargeback management tools for the disputes that still arrive.

When is more fraud tooling not worth it?

If you sell low-priced items, mostly to repeat customers, and almost never see fraud, heavy screening will cost you more in lost sales than it saves. Paid fraud-scoring services usually charge per transaction, so run them through the same math as any rule. Do the free things first: AVS, security codes, velocity limits, saved order data, and shipping only after approval. Add 3-D Secure and paid scoring when your own numbers say you need them, not because a sales pitch says everyone does.

If most of your sales are online, our page on ecommerce businesses covers the rest of the setup.

Your next step

If fraud or chargeback fees are showing up on your statement, send us a recent one for a free statement review. We'll show you what disputes and declined attempts are costing you. If you're tuning fraud rules for a new store, contact us and we'll help you set the AVS, CVV, and velocity settings described above.