Payment fraud costs merchants twice: once when the money is lost, and again when the chargebacks, fees and reserves that follow make processing harder. For high-risk businesses, where acquirers already watch fraud and dispute ratios closely, a fraud problem can quickly become an account problem.
This guide explains what fraud protection and fraud prevention mean, the most common types of payment fraud, the controls that work, how real-time transaction monitoring fits in, and how to build a fraud strategy that keeps losses down without blocking good customers.
Key takeaways
- Fraud prevention stops fraudulent payments before they are approved. Fraud protection is the wider set of controls, monitoring and processes that limit the damage when fraud gets through.
- The most common threats for online merchants are stolen card fraud, account takeover, card testing and friendly fraud.
- Layered controls work best: 3D Secure, AVS and CVV checks, velocity rules, device and behavioural signals, and real-time monitoring.
- In the EEA, payments authenticated with strong customer authentication show lower fraud rates than unauthenticated ones, according to the ECB and EBA.
- Every fraud report and chargeback counts towards card scheme monitoring such as Visa VAMP, so fraud control is also account protection.
What is fraud prevention?
Fraud prevention is everything you do to stop a fraudulent payment from being approved in the first place: authentication, screening rules, risk scoring and blocking known bad patterns at checkout. Fraud protection is broader. It includes prevention, but also monitoring, investigation, refunds, dispute handling and the processes that stop a single incident becoming a pattern.
In practice, the two work together. Prevention reduces how much fraud reaches you. Protection limits what that fraud costs you.
Fraud prevention vs chargeback prevention
| Fraud prevention | Chargeback prevention | |
|---|---|---|
| Goal | Stop payments made with stolen or fake details | Stop disputes on payments, including genuine ones |
| Main threats | Stolen cards, account takeover, card testing | Friendly fraud, unrecognised charges, merchant errors |
| Main tools | 3D Secure, risk scoring, velocity rules, device data | Clear descriptors, refunds, alerts, pre-dispute tools |
| When it acts | Before and at authorisation | After the sale, before the bank dispute |
You need both. Our guide to preventing chargebacks covers the second half.
Common types of payment fraud
Stolen card fraud
Card details stolen through data breaches, phishing or malware are used to buy online. The real cardholder disputes the charge, and the merchant usually bears the loss unless the payment was authenticated with 3D Secure.
Account takeover
A fraudster gains access to a real customer’s account, often with a password reused from another breach, and uses stored cards or changes delivery details. Strong login security, two-factor authentication for account changes and alerts on new devices help.
Card testing
Fraudsters run large numbers of small authorisations to find out which stolen cards work. Card testing creates declines, fees and fraud reports, and card schemes monitor it: under VAMP, acquirers must stop their merchants reaching high levels of enumeration. Bot protection and velocity limits on authorisation attempts are the main defences.
Friendly fraud
A real customer disputes a real purchase, sometimes deliberately, more often because they don’t recognise the charge or forgot a renewal. It is common in adult, dating, gaming and subscription businesses. See our guide on how chargebacks work.
Phishing, malware and refund fraud
Fraud doesn’t only target the checkout. Phishing emails aimed at your staff, malware on admin machines, and requests to refund to a different card or account are all ways money leaves the business. Staff training and clear refund rules matter as much as payment controls.
Fraud prevention controls that work
Strong customer authentication and 3D Secure
In the EEA and UK, most online card payments need strong customer authentication, which for cards usually means 3D Secure. Authenticated payments shift liability for most fraud chargebacks to the issuer, and the ECB and EBA report lower fraud rates on SCA-authenticated card payments than on unauthenticated ones.
Card verification checks
- CVV checks: require the security code on every new card.
- Address verification (AVS): compare the billing address with the issuer’s records, where your acquirer and the card’s country support it.
Velocity rules
Limit how many attempts, cards or orders can come from one card, device, email address or IP address in a set time. Velocity rules are the simplest defence against card testing and bulk fraud.
Device, behaviour and data signals
Fraud tools look at the device, browser, IP address, location, email age and how the customer behaves on the site. A mismatch, such as a card from one country, an IP address in another and a brand-new email address, raises the risk score.
Geographic and product rules
If you don’t ship to certain countries or see repeated fraud from them, block or review those orders. Apply stricter checks to high-value orders and products that are easy to resell.
Secure infrastructure
Use a PCI DSS compliant payment gateway, tokenisation for stored cards, HTTPS everywhere and regular security checks of your site and admin accounts.
Real-time transaction monitoring
Real-time transaction monitoring means checking each payment as it happens, and acting before it is approved or settled, rather than discovering fraud in next month’s chargeback report.
What it does
- Scores each transaction against rules and models as it comes in.
- Approves, declines, steps up to 3D Secure, or holds the order for manual review.
- Flags sudden changes, such as a spike in declines, a new country or an unusual order size.
- Feeds outcomes, such as confirmed fraud and chargebacks, back into the rules.
How to implement it
- Start with your data. Look at past fraud and chargebacks by country, product, amount and time of day.
- Set clear rules and thresholds. Decide what gets declined, what gets 3D Secure and what goes to review.
- Create a review process. Someone has to look at held orders quickly, or good customers wait and leave.
- Track false positives. Measure how many good orders you decline, not just how much fraud you stop.
- Review monthly. Fraud patterns change. Rules that worked last quarter may now block good customers or miss new attacks.
Building a fraud strategy for a high-risk business
- Know your numbers. Track fraud reports, chargebacks and declines every week, and compare them with the thresholds your acquirer and the card schemes use.
- Layer your controls. No single tool catches everything. Combine authentication, screening, monitoring and pre-dispute tools.
- Balance fraud and conversion. Every rule blocks some good customers. Tune rules with data, not fear.
- Talk to your acquirer. Tell them before you launch in new markets or run big campaigns, and share what you are doing about fraud.
- Choose the right tools. Our guide to fraud protection services explains the types of tool and how they are priced, and our guide to payment risk management covers the wider framework.
Frequently asked questions
What is fraud protection?
Fraud protection is the set of controls, monitoring and processes a business uses to stop fraudulent payments and limit the losses when fraud gets through. It includes fraud prevention at checkout as well as monitoring, investigation and dispute handling.
What is the difference between fraud prevention and fraud detection?
Fraud prevention stops fraudulent payments before they are approved, for example with 3D Secure and velocity rules. Fraud detection finds fraud that is happening or has happened, for example through transaction monitoring and reviewing chargebacks.
How can online merchants prevent payment fraud?
Use 3D Secure, CVV and address checks, velocity rules, device and behaviour signals, and real-time monitoring. Review declines and chargebacks regularly and adjust your rules.
What is real-time transaction monitoring?
It is the checking of each payment as it happens, so suspicious transactions can be declined, sent for 3D Secure or held for review before they are approved or settled.
Does 3D Secure stop fraud?
It reduces it significantly. In the EEA, payments authenticated with strong customer authentication show lower fraud rates, and authenticated payments usually shift liability for fraud chargebacks to the issuer.
Why does fraud matter more for high-risk merchants?
High-risk merchants start closer to the fraud and dispute thresholds that acquirers and card schemes monitor. Extra fraud can lead to higher reserves, processing limits or a closed account.
Next step
Good fraud controls make you a merchant acquirers want to keep. Fasto works with adult, subscription, nutraceutical, gaming, dating and hospitality merchants. Approval typically takes two to three weeks.
Get a free quote, or read more about our high-risk merchant accounts.
