Fraud Detection: Methods Merchants Use to Spot Bad Transactions

Fraud detection is how an online store decides, before it ships, whether an order is real. Getting it wrong runs both ways: a bad order that ships becomes a chargeback you usually lose, and a good order you decline is revenue you never see again. The methods below are the ones that separate the two, with the checks and trade-offs spelled out.

What Goes Wrong When a Fraudulent Order Ships

The damage is larger than the order value. When a cardholder disputes a charge as fraudulent, the issuer reverses the payment and the acquirer passes on a chargeback fee. You lose the goods if they have already gone out, and you may never recover them. Add the fee to the product cost and the shipping, and a single fraud loss can wipe out the margin on several legitimate orders.

There is a second cost that rarely appears on a report: the account itself. Card networks monitor merchants for excessive fraud and dispute levels, and a store that keeps shipping bad orders can face fines, reserves, or losing its ability to accept cards. That outcome is harder to reverse than a single chargeback, which is why the checks below matter more than the dispute paperwork.

Order Checks That Flag Risk Before Shipping

Merchants combine several checks on each order, and a single signal rarely justifies blocking a transaction on its own. No rule catches everything, so stores tune these checks against their own dispute data and accept a trade-off: strict thresholds stop more fraud but also decline legitimate customers, particularly new ones with no history. The workable setup layers automated scoring with targeted manual review and revisits the results monthly.

• Address Verification System (AVS) and card verification value (CVV) checks: the billing address and the three- or four-digit code are compared against the issuer's records, and a mismatch raises the risk score even when the payment is otherwise approved.
• Velocity rules: the system counts how many orders, cards or failed attempts come from one customer, device, IP address or shipping address within a set window, then flags anything that breaks the merchant's normal pattern.
• Geolocation and IP mismatch: the buyer's IP location is compared with the billing country and the delivery address, and orders placed from a country the card has never been used in get reviewed.
• Device fingerprinting: browser, operating system, screen size and installed fonts are hashed into an identifier, so a merchant can see when one device is used across many accounts or when a returning customer suddenly appears on unfamiliar hardware.
• Order pattern analysis: unusually large quantities, high-value items bought in a first order, rushed next-day shipping on goods that are easy to resell, or several orders shipped to different addresses from one account all raise the score.
• Chargeback and blocklist history: previous disputes, refunds and confirmed fraud reports are stored against emails, card numbers, phone numbers and addresses, and repeat offenders are declined or sent to manual review.
• 3-D Secure and issuer authentication: the customer is pushed through the bank's own verification step, which shifts liability for approved transactions to the issuer under most card network rules.
• Manual review queues: orders that score above a threshold but below an automatic decline are checked by a person who may call the customer, request ID or confirm the delivery address before shipping.

Manual review is where most stores lose money quietly. A flagged order is not a declined order, so give the reviewer a short, documented routine: check the card country against the IP country, look at the customer's order history, search the email and shipping address for past chargebacks, and confirm the phone number if you collect one. Write the reason for each hold and its outcome into the order notes. Over time those notes show which rules produce good holds and which only produce noise.

Signals in the Order Data

Every order arrives with dozens of data points: billing and shipping addresses, email domain, device and browser details, time on site, and how the customer reached the checkout. Fraud shows up as mismatches between these signals, not as one red flag. A first-time buyer shipping to an address thirty miles from the billing address is unremarkable. A first-time buyer whose card country, IP country and shipping country are all different, ordering four of the same high-value item at 3 a.m., is a different animal.

A few patterns carry real weight. Orders that exceed available stock or normal purchase limits, especially for resellable goods like electronics, gift cards and designer clothing, deserve a second look. So do email addresses from throwaway providers that were created the same day, and free email accounts whose local part matches the shipping name exactly.

Velocity tells you more than any single field. If the same card, email or device has placed five orders in ten minutes across three different storefronts, something is wrong. Tracking velocity by customer, card fingerprint, device and address separately catches fraud rings that rotate through one variable to keep the others clean. When you build your own checks, look at order frequency per card and address over a rolling window, not a fixed month.

Address Verification and Card Verification

AVS compares the billing address you collect with the one on file at the card issuer, and CVV checks the three- or four-digit code against the card. Both run through your payment processor and return pass, fail, or "not checked" (some issuers and many markets do not support them). A CVV fail is a strong reason to hold. An AVS fail on just the street number, with the ZIP correct, is often a move or a formatting quirk. Treat them as evidence, not as a gate.

The question is not whether a fraudulent order ships but how much a single process step costs. The table below shows how the common checks compare on what they catch and what they cost you when they misfire.

For a small store, the most reliable rule is this: any order that combines high value, physical goods and a first-time customer with mismatched location signals should not ship the same day. Slow it down, not off.

How Fraud Detection Tools Fit Together

Fraud detection tools do three kinds of work, and most merchants need a mix. Rules engines let you write your own if-then logic, such as "hold any order above a threshold from a new customer." Scoring models, built on patterns from across many merchants, return a risk score for each order. Device and identity tools fingerprint the browser, check whether the email has a history, and flag connections between orders that look unrelated in your order table. Your payment processor may bundle some of this; separate providers sell the rest.

The practical split depends on volume. Below a few hundred orders a month, the built-in tools at your payment processor plus a manual review rule are usually enough. Above that, the manual queue becomes the bottleneck and a scoring model earns its fee by cutting the number of orders you review without letting more fraud through. Ask any vendor for their false-positive rate at a given fraud capture level, and test them against your own historical orders before you commit.

When you evaluate a tool, look at the parts that decide your cost. Does it let you see why an order scored the way it did? Can you export decisions and outcomes to compare against your chargeback reports? Can you change a rule without a support ticket? A tool that scores well but hides its reasoning is hard to tune, and tuning is where the value sits.

Fraud Prevention Rules That Carry Legal Weight

The card networks set the chargeback rules, and issuers apply them. If you ship to an address that differs from the cardholder's billing address and the order is later disputed, you may lose the dispute outright unless you can show the transaction was authenticated. For European Economic Area transactions, Strong Customer Authentication under the second Payment Services Directive (PSD2) changes this: a transaction that fails SCA can shift liability back to your payment provider, or back to you, depending on the case. Verify how your acquirer handles liability shift in your market; it varies.

Some jurisdictions go further. In the United Kingdom, the Financial Conduct Authority (FCA) regulates payment services and expects firms to follow its rules on fraud controls. In the United States, the Fair Credit Billing Act gives cardholders the right to dispute, which means a customer can win a chargeback even when your records are clean if the claim holds up. These rules affect how you document orders, not just how you screen them.

Data rules matter too. In the European Union, the General Data Protection Regulation (GDPR) limits how long you keep review data and what you can collect. In the United States, the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) enforce rules on how you handle consumer data. Never ask a customer for a photo of their card or ID through email; use a secure upload if you must request documents. Keep order records, shipping records with tracking, and customer communication for the period your processor and jurisdiction require, and verify current requirements on the official source.

Where Fraud Detection Gets It Wrong

Most fraud systems fail in one of two directions, and both cost money. Too loose, and losses rise. Too tight, and you decline customers worth keeping. A risk score of 80 is not proof of fraud, and a score of 10 is not proof of safety. Treat every threshold as a trade-off you review quarterly against your actual results: fraud losses, chargeback rate, and the revenue from orders you declined that later turned out to be legitimate.

Beware of rules that look precise but age poorly. A block on all orders from a certain country hits legitimate customers in that country. A block on all orders from a certain device type hits the people who share it. The useful version is usually narrower: same country as the IP, new customer, high-value physical goods, and a shipping address that has been linked to a previous chargeback. That rule catches more real fraud and fewer honest buyers.

Test Declines Against Real Revenue

Keep a sample of declined orders and check what happened to them. If you had accepted those orders, would the customer have paid? Many processors can tell you the share of declined authorizations that would have been approved. Reviewing your own declined orders is slower, but it is the only way to know what your rules actually cost. Add the chargeback fee to the comparison: the fee often makes a decline decision that looked safe look expensive.

One more trap: merging prevention and dispute work. Third-party tools that only score orders are not the same as ones that also manage disputes. The second group is a chargeback workflow, and merging the two hides which side is working. Keep them apart and give each one a metric you check.

Building a Fraud Review Process That Holds Up

Start with a baseline. Pull your last twelve months of chargebacks and flag every one of them against the order data. Look for the pattern those orders share: the same email domain, the same shipping city, the same item. That pattern becomes your first rule, and it is built from your own losses, not from a vendor's general model. Then add your processor's risk score, set the threshold where it flags more orders than you can review by hand, and route the rest to a manual queue.

Write the decision into the order record every time. Over three months, the record shows which rules catch fraud and which catch noise, and you can retire the noise. A small store running this loop will usually beat a larger store that buys a system and never checks it. The aim is a process that improves from your own data, and a team that knows why each hold happened.

Last, cut the data you keep to what the job needs. Customer records, device fingerprints and review notes are personal data in many jurisdictions, and retention rules differ. Set a policy, document it, and review it when your processor or the law changes.

Practical Takeaway: Five Steps This Month

These steps turn your own chargeback history into rules you can test, in the order most merchants get value from. Each one is small enough to finish without a project plan, and together they give you a baseline to measure against next quarter.

1. Pull last year's chargebacks and list the signals every one of them shared.
2. Turn the strongest shared signal into a hold rule, not a decline rule.
3. Route held orders to a manual queue with documented outcomes.
4. Compare your fraud losses, false declines, and chargeback rate at the end of the quarter.
5. Confirm your data retention and authentication obligations with your payment processor and the relevant regulator in your market.

Run these five steps before you shop for new tools. A store that knows its own loss patterns can judge a vendor's claims against real data, and one that does not will pay for a system it cannot measure. General information only, not financial, legal, or tax advice.