The three places fraud enters your business, and how to block each one
Payment fraud at a business usually comes through one of three routes: a criminal using a stolen card or account to buy from you, an employee or vendor stealing money directly, or a customer disputing a legitimate charge they made themselves. You cannot stop all three the same way. Stolen-card fraud is caught by your payment processor's fraud detection. Employee theft requires internal controls and reconciliation. Chargeback fraud requires documentation that proves the customer received what they paid for. The fastest wins come from knowing which type you are actually vulnerable to, then building defenses that match.
Most small businesses lose more money to employee or vendor theft than to external fraud, but they spend all their effort on the external kind because it feels more dramatic. Start by looking at your actual loss history—which transactions got reversed, which employees had access to cash or refunds, which customers disputed charges months later. That tells you where to spend your time.
Key Takeaways
- Stolen-card fraud is usually caught by your payment processor's built-in detection, but you can reduce it further by requiring CVV codes, address verification, and 3D Secure authentication on online sales.
- Employee theft is the largest fraud risk for most businesses and requires separation of duties—the person who handles cash should not be the person who records it, and neither should approve refunds.
- Chargebacks happen when a customer disputes a charge; you win by keeping receipts, delivery confirmations, and signed agreements that prove the customer received the goods or service.
- Reconcile your bank and payment processor statements weekly, not monthly, so you catch unauthorized transactions before they compound.
- Require two people to approve refunds over a set amount, and keep a log of every refund with the reason and who approved it.
How to spot and stop stolen-card transactions before they settle
When someone uses a stolen card to buy from you, your payment processor's fraud filter usually catches it before the transaction completes. Visa, Mastercard, and American Express all run real-time checks on card data, velocity (how many transactions in how short a time), and the cardholder's typical spending pattern. If the transaction looks wrong—a card used in two cities in one hour, or a $5,000 purchase from an account that normally spends $50—the processor flags or declines it.
You can tighten this yourself on online sales by requiring three pieces of information: the CVV code on the back of the card (which a thief usually does not have), the billing address (which the processor checks against the card issuer's records), and 3D Secure authentication (a second password the real cardholder enters). Require all three, and stolen-card fraud drops sharply. In-person sales are lower risk because the thief has to show up with the physical card, which is rare.
The transactions that slip through are usually small—under $100—because they are below the threshold where processors flag them. If you see a pattern of small charges that later get reversed as fraud, lower your CVV and address-verification requirements temporarily to see if you are being tested, then raise them back. Do not disable these checks permanently; the fraud loss will exceed the legitimate sales you gain.
Set up internal controls to catch employee and vendor theft
The most common theft at small businesses is an employee who processes refunds to themselves, a vendor who invoices for work never done, or a cashier who pockets cash and voids the transaction. These happen because one person controls the whole cycle: they handle the money, record it, and approve the reversal. Stop this by splitting the work.
The rule is separation of duties. The person who handles cash should not be the person who reconciles the register. The person who approves refunds should not be the person who processes them. The person who receives a vendor invoice should not be the person who pays it. If your business is small and you cannot split every job, split the highest-risk ones: refunds, cash handling, and vendor payments. At minimum, you review and sign off on all three categories yourself, and you do the reconciliation.
Require written approval for every refund over a set amount—$50, $100, $500, whatever makes sense for your business. Keep a log with the customer name, the reason for the refund, the amount, the date, and who approved it. Review this log weekly. If an employee is processing refunds to the same customer repeatedly, or refunds are clustered on certain days, that is a red flag.
For vendors, require a purchase order before work starts, an invoice after it is done, and a receipt or proof of delivery before you pay. Do not pay invoices that arrive without a matching purchase order. Spot-check vendor work—call the client to confirm the service was delivered, or inspect the goods yourself. Criminals count on you being too busy to verify.
Document every transaction so you can win chargebacks
A chargeback happens when a customer tells their bank or credit card company that they did not authorize a charge, or that they paid for something and never received it. The bank reverses the charge and takes the money back from your account. You can fight the chargeback and win, but only if you have proof that the customer authorized the transaction and received what they paid for.
For in-person sales, keep the signed receipt or the card reader's authorization record. For online sales, keep the order confirmation email, the shipping tracking number, and the delivery confirmation. For services, keep the signed contract or invoice, the date the service was completed, and any communication from the customer confirming they received it. If the customer paid by check, keep the cancelled check. If they paid by bank transfer, keep the confirmation email from your bank.
The strongest proof is a signature—either on a physical receipt or a digital signature in an email or contract. If a customer disputes a charge and you have their signature authorizing it, you win the chargeback almost every time. If you have only an order confirmation with no signature, you lose more often. If you have nothing, you lose automatically.
Store these documents for at least two years. Chargebacks can be filed up to 120 days after the transaction, and some disputes take months to resolve. If you delete records after 30 days, you will not have proof when you need it.
Reconcile your accounts weekly to catch fraud fast
Reconciliation means comparing your records to your bank's and your payment processor's records to make sure they match. Most businesses do this monthly, which means fraud can sit undetected for weeks. Do it weekly instead, or at minimum twice a month.
Pull three statements: your bank account, your payment processor account (Stripe, Square, PayPal, or whoever you use), and your own sales records. Check that the deposits match—if you processed $10,000 in sales, your processor should show $10,000 in volume, and your bank should show a deposit for that amount minus the processor's fee. Look for transactions you do not recognize, refunds you did not authorize, or deposits that are smaller than expected.
If you find a discrepancy, investigate it immediately. Call your processor and your bank. Do not assume it will sort itself out. Fraud that goes unnoticed for a month is harder to reverse than fraud caught in a week. If an employee is stealing, catching it fast limits the damage and gives you a clear record for law enforcement or a civil claim.
Use fraud detection tools your processor already provides
Most payment processors include fraud detection at no extra cost. Stripe, Square, and PayPal all flag suspicious transactions automatically. Some let you set rules—decline transactions over a certain amount, decline cards from certain countries, or require extra verification for repeat customers. Log into your processor's dashboard and check what tools are available. Turn on the ones that match your business.
If you process a high volume of transactions or sell high-value items, consider a dedicated fraud detection service like Kount or Sift. These services use machine learning to spot patterns that simple rule-based filters miss. They cost money—usually a percentage of sales or a monthly fee—but if you are losing thousands a month to fraud, they pay for themselves.
Do not rely on fraud detection alone. It catches most stolen-card fraud, but it misses employee theft, vendor fraud, and some chargebacks. Use detection as one layer, but also use the controls and reconciliation described above.
Train your team on what fraud looks like and what to report
Your employees see transactions every day. If they know what to watch for, they can catch fraud before it becomes a big problem. Tell them to report: a customer who buys the same item repeatedly and returns it, an employee who processes refunds to themselves or their friends, a vendor invoice that does not match a purchase order, or a transaction that seems out of place.
Make it easy to report without fear of retaliation. Set up an anonymous tip line or email, or let employees report to you directly. Follow up on every report, even if it seems minor. Most fraud is caught by someone noticing something small and reporting it.
Train new employees on your refund policy, your approval process, and what counts as suspicious activity. If an employee knows that refunds over $100 need two signatures, they are less likely to try to process one without approval. If they know you reconcile accounts weekly, they know they will get caught.
Frequently Asked Questions
What should I do if I discover an employee has been stealing?
Stop the theft immediately by removing their access to cash, refunds, or payment processing. Do not confront them alone. Consult an employment lawyer or your HR advisor before firing them, because how you handle it affects whether you can recover the money or press charges. Document everything—the dates, amounts, and method of theft—and preserve all records. Report it to your bank and payment processor so they can flag the employee if they apply elsewhere.
Can I get my money back if a customer does a chargeback?
You can fight the chargeback if you have proof the customer authorized the transaction and received the goods or service. Submit your evidence to your payment processor, which forwards it to the customer's bank. If the bank agrees with you, the money is returned. If the bank sides with the customer, you lose the money and usually pay a chargeback fee of $15 to $100 on top of it. Prevention through documentation is much cheaper than fighting chargebacks after the fact.
What is the difference between fraud and a legitimate dispute?
Fraud is when someone intentionally lies—a customer claims they did not authorize a charge when they did, or claims they never received an item when they did. A legitimate dispute is when there is a real problem—the customer authorized the charge but the item arrived damaged, or the service was not performed as promised. You can prevent fraud through documentation, but legitimate disputes require you to actually fix the problem or issue a refund.
Do I need to report fraud to the police?
If the fraud is small—under a few hundred dollars—police usually will not investigate. If it is large or ongoing, report it to your local police department and to the FBI's Internet Crime Complaint Center (IC3) if it happened online. Report employee theft to police as well; it creates an official record that helps if you pursue civil recovery. Your bank and payment processor may also report it on your behalf.
How much fraud is normal for a business?
There is no universal "normal," but most businesses lose between 0.1% and 1% of revenue to fraud. If you process $100,000 a month, expect to lose $100 to $1,000. If your losses are higher, your controls are too loose. If they are lower, your controls are working. Track your fraud rate over time and compare it to your industry if you can—your processor or industry association may publish benchmarks.