Stopping e-commerce fraud & chargebacks

Every online store that takes a card is a target. The attacker does not need to breach your systems — they simply use your checkout the way it was designed to be used, with someone else's money. Below is a working guide to the fraud Australian merchants actually face, a layered way to defend against it, and how to fight back through the chargeback process when a dispute lands.

The fraud you're up against

"E-commerce fraud" is not one problem. It is a family of distinct attacks, each with its own economics, its own signals, and its own defence. Lump them together and you will over-invest in one while another quietly drains the account. The common types worth naming:

• Stolen-card, card-not-present (CNP) fraud. A criminal uses stolen card details to buy goods online. Because the physical card is never presented, the usual defences — chip, PIN, the cashier's eye — do not exist. This is the classic third-party fraud, and it almost always ends in a chargeback once the real cardholder notices.
• Card testing and BIN attacks. Before stolen numbers can be spent, fraudsters need to know which are still live. They run large volumes of card numbers through checkouts and payment APIs with tiny or zero-dollar authorisations. Your store becomes a free validation service — and the flood of attempts can trigger fees, hurt your authorisation rates and damage your standing with acquirers.
• Account takeover (ATO). Rather than paying with a stolen card, the attacker steals the customer instead — logging into a legitimate account with a saved card, stored value or loyalty balance, then draining it. Covered in depth below.
• Friendly (first-party) fraud. The genuine cardholder buys something, receives it, then disputes the charge — claiming they never ordered it or never got it. Sometimes it is opportunism; sometimes it is a household member; sometimes it is honest confusion at an unrecognised descriptor. Either way, the money leaves.
• Refund abuse. Exploiting your returns and refund policy — claiming an item never arrived, returning an empty box, or citing damage that was never real — to keep both the goods and the money.
• Promo, loyalty and coupon abuse. Creating multiple accounts to farm sign-up offers, stacking coupons beyond their intent, or scripting referral and loyalty schemes to extract value you never meant to give away.
• Triangulation fraud. A fake storefront or marketplace listing takes a genuine order from an unwitting shopper, then fulfils it by buying the item from a real merchant (you) using a stolen card. The shopper is happy, you ship the goods, and the chargeback lands on you weeks later.
• Reshipping. Mules recruited under the guise of "package-forwarding jobs" receive goods bought with stolen cards and re-post them offshore, breaking the link between the delivery address and the fraudster.

Fraud types at a glance

The same order can carry more than one of these risks, and the signals overlap. This matrix maps each type to the signals that expose it, the primary defence, and where in your stack that defence belongs.

A layered prevention stack

No single control catches everything, and any single control that tried would block half your genuine customers. The goal is defence in depth: cheap, invisible checks stop the obvious attacks, and heavier friction is reserved for the orders that earn it. Working from the outside in:

Address (AVS) and card (CVV) verification

The Address Verification Service compares the billing address entered at checkout with the address on file at the issuer, and the CVV check confirms the three- or four-digit code printed on the card. Neither is decisive on its own — plenty of good customers fat-finger an address — but a CVV failure combined with an AVS mismatch and a mismatched delivery address is a strong early signal. Treat these as inputs to a score, not as a pass/fail gate.

Device and behavioural signals

Device fingerprinting and behavioural analytics look past the card to how the order is being placed: the device and browser, whether the session is scripted, typing and navigation cadence, time zone versus stated location, and whether this device has transacted before. A single stolen card looks fine on paper; the device placing forty orders on forty different cards does not.

Velocity and rate limits against card testing

Card testing is a volume game, so cap the volume. Rate-limit authorisation attempts per device, per IP, per card and per session; throttle or block after repeated failures; and remove any zero-dollar or trivially small authorisation path that serves no genuine checkout purpose. This is the single most effective control against BIN attacks, and it lives at the edge of your payment flow, before a request ever reaches the issuer.

3-D Secure 2 step-up on risky orders

3-D Secure 2 (the technology behind Visa, Mastercard and other card-scheme authentication programmes) lets the issuer authenticate the cardholder mid-checkout — often silently in the background, sometimes with a one-time code or a prompt in the banking app. For many fraud-related dispute categories, a successfully authenticated 3-D Secure transaction shifts chargeback liability from you to the issuer. The art is selectivity: apply it as a step-up on medium- and high-risk orders rather than on every transaction, so you gain the liability protection where it matters without adding friction to the low-risk majority.

Bot defence at login and checkout

Automated abuse — card testing, credential stuffing, promo farming, inventory scraping — all runs on bots. Bot-management controls at your login and checkout endpoints separate scripted traffic from humans using signals a human never trips, and escalate to an invisible or visible challenge only when the traffic looks automated.

Manual review queues

Automation should clear the easy decisions and escalate the genuinely ambiguous ones. A well-run manual review queue takes the narrow band of orders the model is unsure about — high value, mixed signals — and puts a trained analyst on them, with the customer contactable if needed. Keep the queue small and well-targeted; a review team buried under false positives is a sign the scoring upstream needs tuning, not more headcount.

Defending against account takeover

Account takeover deserves its own attention because it bypasses most payment-fraud controls: the card is already on file, the account is real, and the order history looks clean. The attack starts at the login page, so that is where the defence starts.

• Credential-stuffing protection. Most ATO begins with credentials leaked from some other breach, replayed against your login in bulk. Bot management, rate limiting on login attempts, and monitoring for credentials known to be compromised blunt the attack before an account is opened.
• Multi-factor authentication (MFA). A second factor — ideally more than a code sent by SMS — defeats the great majority of credential-based takeovers. Offer it, encourage it, and require it for high-risk actions such as changing the delivery address, adding a payment method, or redeeming stored value.
• Login and session anomaly detection. Watch for logins from new devices and unfamiliar locations, impossible travel between sessions, and sudden changes to email, password, phone or shipping address — especially the classic pattern of a detail change immediately followed by a high-value order. Step up authentication when the pattern looks wrong rather than trusting the session outright.

The chargeback lifecycle

When a cardholder disputes a transaction, it moves through a defined lifecycle set by the card schemes. Understanding it is the difference between accepting losses and contesting them:

1. Dispute raised. The cardholder contacts their issuing bank to dispute a charge. The issuer assigns a reason code — fraud, non-delivery, not-as-described, duplicate, and so on — that defines what the dispute is about and what evidence can rebut it.
2. Chargeback issued. The issuer reverses the funds, debiting your account (usually with a fee) and crediting the cardholder while the dispute is worked through.
3. Representment. If you believe the charge was legitimate, you contest the chargeback by re-presenting the transaction with supporting evidence matched to the reason code. This is your opportunity to get the funds back.
4. Issuer decision. The issuer weighs your evidence against the cardholder's claim and either upholds the chargeback or reverses it in your favour.
5. Arbitration. If the dispute remains unresolved, either side can escalate to the card scheme for a binding decision — a step that carries its own fees and is worth reserving for material amounts.

Two things matter throughout: the reason code dictates which evidence is relevant, and the deadline is unforgiving. Miss the window and you forfeit the dispute regardless of how strong your case was.

Winning representment with evidence

Representment is won on evidence, not on argument. The single most useful thing you can build is a habit of capturing and retaining the right transaction and delivery records at the moment of sale, so that when a dispute lands weeks later the case is already assembled. Compelling evidence typically includes:

• Proof of delivery to the cardholder's address — tracking, carrier confirmation, and where available a signature or delivery photo.
• AVS and CVV match results from authorisation, showing the buyer knew the card details.
• 3-D Secure authentication data where the order was authenticated.
• Device, IP and session records tying the order to the customer's usual footprint.
• Account and order history — prior undisputed purchases, the same login, the same saved address.
• Customer communications — order confirmations, dispatch notices, and any support correspondence.

The discipline is simple to state and easy to neglect: respond inside the deadline, address the exact reason code the issuer raised, and present the evidence clearly and legibly. A tidy, reason-code-matched submission beats a large pile of unsorted screenshots every time. Friendly fraud in particular is beaten here, after the fact, because the transaction itself was genuine — your delivery and authentication records are what expose the dispute as opportunistic.

The policy and operations side

Technology stops fraud at the transaction; policy and operations stop it everywhere else. Several levers sit entirely within your control:

• Refund policy design. Clear, fair, and specific terms — on timeframes, condition, evidence and exceptions — reduce both genuine disputes and the room for abuse. Vague policies invite friendly fraud and lose representments.
• Delivery proof as standard. Tracked, confirmable delivery on anything above a value threshold is your strongest single defence against "item not received" claims. If you cannot prove it arrived, you will usually lose the dispute.
• Blocklists and allowlists. Maintain lists of devices, cards, emails, addresses and freight-forwarders tied to confirmed fraud — and, equally, trusted repeat customers who should never be needlessly challenged.
• KYC on high-risk orders. For unusually high-value orders, mismatched-address orders, or first-time buyers spending far above the norm, light-touch identity verification is a proportionate control that stops the orders most likely to end in loss.

Balancing fraud loss against conversion

The uncomfortable truth of fraud prevention is that the easiest way to eliminate fraud is to block every order — and that would destroy the business. Every control you add turns away some genuine customers alongside the fraudsters. The job is not to minimise fraud; it is to optimise the trade-off.

That means watching several measures together, qualitatively, rather than chasing any one to zero:

• The fraud rate — the share of transactions that turn out to be fraudulent.
• The chargeback rate — disputes as a share of transactions, which the card schemes themselves monitor and which carries consequences if it runs high.
• The false-positive rate — good orders wrongly declined or challenged, the most expensive and least visible cost of over-tuning.
• The manual-review load — how many orders need a human, and how fast they clear.
• The win rate on representment — how often you recover funds you contest.

Push any one of these hard in isolation and another gives way: crank up the rules and false positives climb; loosen them and fraud returns. A mature programme tunes the whole system so that risk maps to friction — invisible for the many, escalating for the few — and reviews the numbers as a set, not a scoreboard for a single figure. That balance is different for every business, and it moves as the attackers adapt.

If you are trying to work out where your online store is leaking — whether it's card testing hammering your checkout, account takeover draining loyalty balances, or friendly fraud you keep losing at representment — our loss prevention and fraud services are built for exactly this. Talk to a specialist and we'll tell you where you stand and what to fix first.