The core defenses that actually reduce fraud losses
Online payment fraud costs merchants money through chargebacks, lost inventory, and processing fees—but most fraud is preventable with the right combination of tools and processes. The most effective defense is not a single technology but a layered approach: address verification, card security codes, velocity checks (flagging multiple transactions in short windows), and real-time monitoring of transaction patterns.
Merchants who implement these controls together see fraud rates drop significantly compared to those using only one or two. The goal is to make your checkout process harder for fraudsters without making it so difficult that legitimate customers abandon their orders.
What works depends partly on your business model. A subscription service faces different fraud patterns than a one-time retailer. A high-ticket seller needs different rules than a bulk commodity seller. The defenses below are the ones that move the needle across most online businesses.
Key Takeaways
- Address Verification System (AVS) and Card Verification Value (CVV) checks catch most basic fraud at checkout and should be your first layer of defense.
- Velocity checks—flagging multiple transactions from the same card or IP address in a short time—stop many fraud attempts before they process.
- 3D Secure (3DS) authentication shifts liability to the card issuer in many cases and is increasingly required by payment networks for high-risk transactions.
- Monitoring for unusual patterns—large orders from new customers, overnight shipping to different addresses, bulk purchases of high-resale items—catches fraud that passes basic checks.
- Chargebacks still happen; keeping clear records of customer communication, shipping confirmation, and delivery proof protects you during disputes.
Address Verification and CVV checks at the point of sale
Address Verification System (AVS) compares the billing address the customer enters against the address on file with their card issuer. CVV (Card Verification Value)—the three or four-digit code on the back of the card—requires the customer to have the physical card in hand. Together, these are your first line of defense and should be enabled on every transaction.
AVS returns a code indicating whether the address matches, the ZIP code matches, or neither matches. A mismatch does not automatically decline the transaction, but it flags it for review. Many merchants set rules to decline transactions where the address does not match at all, or to require additional verification (like a phone call) before processing.
CVV checks are simpler: the customer either provides the correct code or does not. Fraudsters often have card numbers but not the physical card, so they cannot provide a valid CVV. Requiring CVV on every transaction is standard practice and catches a large portion of stolen-card fraud.
These checks cost nothing to run through your payment processor and should be non-negotiable. If your system does not perform them, contact your processor immediately.
Velocity checks and transaction pattern monitoring
Velocity checks flag transactions that happen too fast or too frequently from the same source. A fraudster testing stolen cards often runs multiple small transactions in minutes or hours. A legitimate customer rarely makes five purchases in ten minutes or charges $10,000 to a card that has never been used before.
Set rules based on your business: if you sell software licenses, you might flag any customer making more than three purchases in one hour. If you sell groceries, you might flag orders over a certain dollar amount from a new customer. The rules should reflect what is normal for your customers and what is not.
Beyond velocity, monitor for patterns that correlate with fraud: orders placed at unusual times (3 a.m. from a customer in a different time zone), requests for overnight shipping to an address different from the billing address, or bulk purchases of items with high resale value. None of these alone means fraud, but they are signals worth investigating before you ship.
Your payment processor or a fraud detection service can automate this monitoring. Many processors include basic pattern detection at no extra cost; others charge a monthly fee for more sophisticated tools. The investment usually pays for itself in prevented chargebacks.
3D Secure authentication and liability shift
3D Secure (3DS) is an authentication protocol that requires the customer to verify their identity with their card issuer—usually by entering a one-time code sent to their phone or email. It adds a step to checkout, but it also shifts liability for fraud to the card issuer in many cases.
When a customer completes 3DS authentication and a transaction is later disputed as fraudulent, the card issuer often cannot charge back the merchant because the customer authenticated the transaction themselves. This protection is not absolute—some chargebacks still succeed—but it significantly reduces your exposure.
3DS is increasingly required by Visa, Mastercard, and American Express for high-risk transactions: large orders, orders from new customers, orders shipping to a different country, or transactions flagged by your processor as suspicious. Many payment processors now enable 3DS by default for these scenarios.
The tradeoff is that 3DS adds friction to checkout. Some customers abandon their orders rather than complete the extra step. Test whether the reduction in chargebacks outweighs the increase in cart abandonment for your business. For high-ticket or high-risk sales, the answer is usually yes.
Monitoring new customers and unusual order patterns
A new customer with no purchase history is higher risk than a repeat customer. Fraudsters often make one large purchase and disappear; legitimate customers build a relationship over time. Flag orders from customers with no prior history, especially if the order is large or the shipping address is unusual.
Common fraud patterns include: orders for items that are easy to resell (electronics, designer goods, gift cards), orders shipping overnight or to a commercial address, orders placed from a different country than the billing address, or orders for multiple units of the same item. None of these is fraud on its own, but they warrant a manual review before you process the payment or ship the order.
For high-risk orders, contact the customer before shipping. A simple email or phone call asking to confirm the order catches many fraudsters, who will not respond or will abandon the transaction. Legitimate customers are usually happy to confirm.
Keep records of this communication. If a chargeback is filed later, your documentation that you contacted the customer and they confirmed the order strengthens your case.
Shipping and delivery confirmation as chargeback defense
Even with all the fraud prevention in place, some chargebacks will happen. Your defense depends on proof that the customer received what they ordered. Signature confirmation, tracking numbers, and delivery confirmation are your strongest evidence.
Always use a shipping method that provides tracking and delivery confirmation. USPS Signature Confirmation, UPS, and FedEx all provide this. The cost is small compared to the cost of losing a chargeback.
For high-value orders, require a signature on delivery. This proves the customer (or someone at their address) received the package. Keep the signed receipt and the tracking number in your records.
Digital goods and services are harder to defend because there is no physical delivery. For these, keep records of the customer's IP address, email address, and any communication confirming they received access. Some merchants require customers to log in and confirm they received the product before processing the payment.
Chargeback management and documentation
A chargeback occurs when a customer disputes a charge with their card issuer, and the issuer reverses the transaction. The merchant loses the payment, the product, and often pays a chargeback fee (usually $15 to $100 per dispute). Preventing chargebacks is cheaper than fighting them, but you need a process for the ones that do happen.
When you receive a chargeback notice, you have a limited time (usually 7 to 10 days) to respond with evidence. Gather: the order confirmation, the customer's email address and IP address, shipping and delivery confirmation, any communication with the customer, and your refund policy. Submit all of this to your processor.
Card networks and issuers favor merchants who can prove delivery and customer communication. If you can show the customer received the product and did not dispute it until weeks later, you have a strong case. If you shipped to an unconfirmed address with no tracking, you will likely lose.
Track your chargeback rate. If it exceeds 1% of your transactions, payment networks may fine you or restrict your account. If you see a spike in chargebacks, investigate whether a specific product, customer segment, or fulfillment method is the cause.
Frequently Asked Questions
Should I decline every transaction that fails AVS or CVV?
No. AVS mismatches happen with legitimate customers who have moved, use a different address, or have outdated information on file. Review the transaction for other risk factors before declining. For CVV failures, decline immediately—there is no legitimate reason a customer cannot provide the code if they have the card.
What is the difference between 3D Secure and tokenization?
3D Secure authenticates the customer during a transaction. Tokenization replaces the card number with a unique token so the card number is never stored on your server. Both reduce fraud, but they work differently. Tokenization protects stored payment information; 3DS protects individual transactions. Use both if possible.
Can I use a fraud detection service instead of building my own rules?
Yes. Services like Kount, Sift, and Forter analyze transactions in real time and flag suspicious activity. They cost money (usually a percentage of transaction volume or a monthly fee), but they are more sophisticated than most merchants can build alone. Start with your processor's built-in tools, then add a third-party service if your fraud rate remains high.
What should I do if a customer claims they never received an order?
Provide the tracking number and delivery confirmation. If the package was delivered to the address they provided, you have proof. If they claim they did not receive it despite delivery confirmation, the carrier is responsible, not you. File a claim with the carrier. Do not refund the customer and the carrier simultaneously.
How do I know if my fraud prevention is working?
Track your chargeback rate (chargebacks divided by total transactions), your cart abandonment rate (customers who start checkout but do not complete it), and your false-positive rate (legitimate transactions declined by your fraud filters). A good fraud prevention system keeps chargebacks below 1%, does not abandon more than 2 to 3% of carts, and declines fewer than 5% of legitimate transactions.