Ecommerce Fraud Prevention: The Declines You Cannot See

Ecommerce fraud prevention is usually sold as catching bad orders. That framing produces bad systems, because the expensive mistake is not the fraud you miss. It is the real customers you refuse.

A declined genuine order costs you the margin, the customer, and everything they would have bought later. And they do not complain. They assume your site is broken and buy elsewhere, so the cost never appears in a report, which is why teams tune ever tighter and never notice.

Any fraud system has two failure modes and you are always trading one against the other. Pretending otherwise is how stores end up with excellent fraud numbers and declining revenue.

The kinds of fraud, which need different answers

Stolen card. Someone uses card details that are not theirs. The real cardholder disputes it, you lose the goods and the money, and usually pay a fee. This is what people mean by fraud.

Card testing. Not really about your store. Someone runs thousands of small authorisations against your checkout to find which stolen numbers still work. It costs you gateway fees, wrecks your authorisation rate, and gets you noticed by your processor for the wrong reasons.

Friendly fraud. A genuine customer disputes a genuine purchase. Sometimes deliberate, more often somebody not recognising a charge or a family member ordering. This is a different problem and fraud screening does not touch it.

Promotion abuse. One person, many accounts, the new-customer discount every time. Not chargebacks, just margin leaving quietly.

Refund and return abuse. Claiming non-delivery, returning something else, wardrobing. A policy and evidence problem rather than a screening one.

A tool aimed at the first will do nothing about the fourth. Work out which is actually costing you before buying anything.

What the signals are, and what they are not

The useful signals are about consistency rather than suspicion.

Does the billing address match what the card issuer has. Was the security code correct. Does the shipping address relate to the billing one. Is this card being tried with several different names. Is this email address new, and does it look generated. How does the order compare to what this customer usually does. Is the device or network associated with previous trouble.

None of these are conclusive alone, which is the point people miss. A billing and shipping mismatch is a gift. A new email address is a new customer. High value is your best day. Any single rule of that kind refuses real people at a rate that will eventually be larger than the fraud it stops.

Where the real gains are

3D Secure, used selectively. The current versions authenticate in the background most of the time, and where it applies it shifts liability for fraudulent chargebacks to the issuer. Apply it to risky orders rather than all of them, because every extra step costs conversions. Rules differ by region and mandates apply in some markets.

Rate limiting your checkout. Card testing is stopped by boring infrastructure: limits per IP and per card, a challenge after repeated failures, and an alert when your decline rate moves. Most stores have nothing here and it is the cheapest fix on the list.

A review queue instead of a decline. Three outcomes, not two. Accept, refuse, and hold for a human. Most of the value in fraud tooling is in the third, because a person can spend ninety seconds and save an order a rule would have thrown away.

Refusing orders you cannot legally fill. Different problem, same place in the flow. If a product cannot ship to a state, that check belongs before payment, not at fulfilment.

Measuring it honestly

Most fraud reporting is one number: fraud as a share of revenue. On its own it is meaningless, because you can drive it to zero by refusing everyone.

Track the pair. What fraud cost you, and what you declined. Then sample the declines: take fifty refused orders and work out how many were probably real. That number is your false positive rate and it is almost always worse than anyone assumed, because nothing in the system was measuring it.

Also watch the ratio of value to volume. A small number of large losses is a different problem from many small ones and wants a different response.

Proportionality

A store losing a fraction of a percent to fraud does not need a fraud platform. It needs address verification on, security codes required, rate limiting at checkout and a review queue. That is an afternoon of work and it covers most of it.

Dedicated fraud tools earn their cost at real volume, in high-risk categories, or where average order value makes a single loss hurt. Below that you are paying a subscription to decline customers slightly more confidently.

Where we fit, and where we do not

The infrastructure is ours: rate limiting at checkout, destination rules that refuse an order before payment, orders detailed enough to support a review decision or contest a dispute, and payment routing you control so screening sits where you want it rather than where a platform put it.

Where we are the wrong answer: we are not a fraud scoring service and do not run a cross-merchant risk network, which is exactly what dedicated providers offer and what makes them worth buying at scale. If you are on a hosted platform with fraud analysis included and your numbers are fine, leave it alone. And no platform decides your risk appetite, which is a commercial judgement rather than a technical one.

The short version

Find out which kind of fraud is actually costing you. Turn on the cheap controls. Build a review queue rather than a wall. And measure your declines, because the cost you cannot see is usually the larger one.