Ecommerce Fraud Prevention: A Practical Playbook

Ecommerce fraud prevention is the work of stopping bad orders before they ship and limiting what a bad order costs when one gets through. For most online stores, the exposure is not a single stolen card. It is a pattern: fast orders on new accounts, shipping addresses that do not match billing, and chargebacks that arrive weeks later with the revenue already spent on fulfillment.

This playbook covers what can go wrong, how to check an order, which rules apply in the US and EU, and which safeguards hold up under volume.

Where ecommerce fraud actually costs you

The chargeback is the visible loss. The hidden losses sit around it. A fraudulent order that ships costs the goods, the shipping, the payment processing fee, and then the chargeback amount plus a dispute fee. Card networks also track dispute ratios, and a merchant that exceeds program thresholds can be placed in monitoring or lose card acceptance.

Then there is the friction cost. Fraud prevention for online stores often fails in the other direction: a ruleset so strict that legitimate customers abandon checkout or get declined for no clear reason. False declines are revenue you never see and cannot easily measure.

The main fraud types to plan for

Stolen card details. A real card used by someone other than the cardholder, often shipped to a reshipper or a drop address.
Card testing. Small trial charges or rapid low-value orders used to check whether stolen numbers work. These burn authorization attempts and can trigger processor penalties.
Friendly fraud. The cardholder makes the purchase and later disputes it as unauthorized or "item not received." This is a large share of disputes for many stores and the hardest to screen upfront.
Account takeover. Stored payment methods or loyalty balances accessed with credentials from a breach elsewhere.
Refund and return abuse. Repeated returns, empty-box claims, or refund requests routed to a different destination.

Each type needs a different control. A velocity rule catches card testing and does nothing against friendly fraud. Delivery confirmation and clear billing descriptors reduce friendly fraud but will not stop a stolen card.

How to check an order before it ships

Manual review does not scale, but a short checklist applied to flagged orders catches most problems. Route orders into review using risk signals from your payment processor and your own order data, then apply the same checks each time.

Compare addresses. A billing and shipping mismatch is a signal, not a verdict. First-time international orders with a mismatch and expedited shipping deserve a second look.
Check email and phone quality. Disposable domains, mismatched area codes, and phone numbers that fail a basic reverse lookup are worth flagging.
Look at order composition. Multiple units of the same high-resale item, orders placed minutes apart, or a cart that ignores size and color choices often signals a reseller or fraud ring.
Review device and session data. Your processor and fraud tools can surface IP country, device fingerprints, and whether the same device has opened many accounts.
Verify high-value orders directly. Call the number on file, or ask for a callback. Do not rely on a number supplied in the order notes.
Document the decision. Record what you checked, who approved the order, and when. That record matters in a dispute and in pattern analysis later.

Speed matters. A review queue that holds orders for two days trains customers to cancel. Set a service level, such as same-day review for orders above a threshold, and measure how often it slips.

Signals worth weighting

Signal	What it suggests	Practical response
Billing and shipping mismatch	Stolen card or gift purchase	Review if combined with other signals; do not auto-decline
Multiple orders in minutes	Card testing or a coordinated ring	Velocity limit per card, email, and IP
Expedited shipping on a new account	Buyer wants goods before detection	Hold for verification above a value threshold
Email from a disposable domain	Low accountability for friendly fraud	Weight it as one factor, not a block
Repeated disputes from one customer	Abuse pattern	Flag the account and review future orders manually

Thresholds and weights depend on your average order value, category, and return rate. Set them from your own dispute history rather than copying another store's rules.

Rules that apply: chargebacks, verification, and data

Rules differ by jurisdiction and card network, and they change. Verify current requirements with your acquirer and the official card network and regulator sources before relying on them.

United States

Chargeback rights and time limits are set by card network rules, not federal statute. Under the Fair Credit Billing Act, consumers generally have 60 days from the statement date to dispute a billing error, and card network chargeback windows can run longer for some dispute reason codes. Your acquirer sets the response deadline for each chargeback, and missing it usually means an automatic loss.

On data, the FTC Act's prohibition on unfair or deceptive practices covers weak security that causes consumer harm, and state breach notification laws apply if card data is exposed. If you store card data, PCI DSS applies through your acquirer contract. Using a processor's hosted fields keeps most card data out of your systems and shrinks the scope of that obligation.

Strong Customer Authentication does not apply in the US. The counterpart is 3-D Secure, which shifts liability for eligible fraud chargebacks to the issuer when authentication succeeds, subject to network rules.

European Union and UK

Under the EU Payment Services Directive (PSD2), Strong Customer Authentication is required for most card-not-present transactions initiated in the EEA. Exemptions exist, including low-value transactions and low-risk transaction risk analysis, and national regulators set thresholds. The UK applies equivalent SCA rules through its own regulator. In both markets, authentication can shift liability for certain fraud chargebacks, which makes it a cost decision as much as a security one.

The GDPR governs personal data used in fraud screening. You need a lawful basis, usually legitimate interests for fraud prevention, and you should keep screening data only as long as needed. The Ecommerce Directive and national consumer laws add disclosure duties, including clear pre-contract information and a visible billing descriptor.

Safeguards that hold up at volume

Controls work best in layers, so that no single failure opens the store. Start with the controls your processor provides, then add rules specific to your products and customers.

Authentication and checkout controls

Enable 3-D Secure or SCA where it is available and where the liability shift outweighs the conversion cost. Test conversion impact by segment before rolling it out everywhere.
Require CVV verification and address verification (AVV) for card-not-present orders, and set clear rules for when a mismatch triggers review.
Use your processor's hosted payment fields so card data never touches your servers.
Apply rate limits and CAPTCHA on checkout, account login, and password reset to blunt card testing and credential stuffing.

Account and order rules

Set velocity limits by card, email, device, IP, and shipping address. A cap of several orders per hour per card is an illustrative example, not a recommendation; set yours from normal traffic.
Require re-authentication before a stored card or shipping address is changed.
Hold high-value orders for manual review, and set the threshold from your dispute data.
Screen first orders from new international markets more closely than repeat domestic customers.

Evidence and dispute process

Most friendly fraud disputes are won or lost on evidence you collected at checkout. Capture IP address, device data, delivery tracking, proof of delivery, and a record of customer communications. Write a dispute response template that maps to the reason code, with a checklist for each one. Track win rates by reason code, because that tells you which evidence you are missing.

Also set a refund policy that is easy to follow. A clear policy and a visible support path give honest customers a reason to contact you before filing a chargeback, which is the cheapest resolution available.

Metrics to watch monthly

Chargeback ratio, calculated against transaction count and value the way your acquirer defines it.
Fraud rate by payment method, country, and product line.
False decline rate, measured through customer complaints and recovery attempts.
Manual review volume, average hold time, and the share of reviewed orders that turn out to be fraud.
Dispute win rate by reason code.

A practical starting sequence

If you are building this from scratch, sequence the work by cost and speed. First, turn on the controls your processor already offers, including address and CVV checks, hosted payment fields, and basic velocity rules. Second, define a review queue with an owner, a threshold, and a documented checklist. Third, capture checkout and delivery evidence in a form you can attach to a dispute. Fourth, measure chargebacks and false declines monthly and adjust thresholds from that data. Fifth, review jurisdiction-specific rules such as SCA and dispute deadlines with your acquirer each year, since network rules and regulator guidance change.

Ecommerce fraud prevention is a set of trade-offs, not a switch. Every control that blocks fraud also blocks some real customers, and the right balance depends on your margins, your category, and your evidence quality. Review the numbers each month and change one variable at a time.

This is general information, not financial, legal, or tax advice.