Ecommerce fraud and chargebacks: how to prevent them, with a risk register for online stores

Every online store pays for fraud twice: once in lost goods and fees, and again in good customers turned away by over-cautious rules. Here are the fraud types that matter, how chargebacks and card scheme monitoring work, which controls stop what, and a sample risk register you can adapt.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 13 min read

Types of ecommerce fraud

“Fraud” covers several different problems with different causes, different victims and different fixes. Treating them as one risk is the most common reason prevention budgets are spent in the wrong place.

Card-not-present fraud with stolen cards

A criminal buys with card details stolen in a data breach, phishing campaign or skimming attack. The real cardholder spots the transaction and disputes it; you lose the goods, the sale and a chargeback fee. Resaleable, easily shipped goods are the usual targets.

Friendly fraud (first-party misuse)

The cardholder made the purchase themselves and then disputes it: “I never received it”, “I didn’t authorise this”, “it wasn’t as described”. Some of it is deliberate chargeback fraud; much of it is confusion — a family member used the card, the billing descriptor was unrecognisable, or the customer could not find a way to get a refund from you. Card networks increasingly call this first-party misuse.

Account takeover and credential stuffing

In an account takeover, a criminal logs in to a real customer’s account, usually with a password leaked from another site and tried automatically against yours (credential stuffing). Once inside they use saved cards, drain loyalty points or store credit, or change the delivery address. The account’s good history helps the order pass fraud checks.

Refund and return fraud

Ecommerce return fraud includes returning a different, cheaper or broken item; claiming an empty box; “wardrobing” (wearing and returning); and refund-as-a-service schemes, where third parties coach buyers on how to obtain refunds without returning anything. Payment fraud controls at checkout do not see it.

Promo and coupon abuse

Creating multiple accounts to reuse new-customer discounts, sharing single-use codes publicly, or stacking offers in ways you did not intend. It can wipe out a campaign’s margin.

Triangulation fraud

A fraudster lists goods on a marketplace at an attractive price. When a real buyer pays them, they order the same item from your store with a stolen card and ship it to the buyer. The buyer is happy, the fraudster keeps the money, and you receive the chargeback weeks later. Tell-tale signs are a billing address and a shipping address with no apparent relationship, on orders that otherwise look normal.

Card testing

Bots run large numbers of small authorisations through your checkout or donation form to find out which stolen cards still work. You may see a spike in declined payments, authorisation fees and, later, disputes. Card testing also counts against you in card scheme monitoring (see below).

Magecart and formjacking

Magecart is the umbrella name for attacks that inject malicious JavaScript into a checkout page — directly, or through a compromised third-party script such as an analytics or chat widget. The script copies card details as the customer types them (formjacking) and sends them to the attacker. It can run unnoticed for months, and the result is a data breach rather than a single chargeback.

Insider and merchant-side fraud

Staff issuing refunds to their own cards, creating fake orders with discounts, or diverting returned stock. Shared admin logins make it untraceable.

How chargebacks work

A chargeback is a forced reversal of a card payment, initiated by the cardholder’s bank (the issuer) under card scheme rules. It is not the same as a refund: the money is taken back through your acquirer or payment provider, you usually pay a dispute fee, and the case counts towards your dispute ratio whether or not you win it.

Reason codes

Every chargeback carries a reason code. Each scheme numbers them differently, but they fall into broadly the same groups:

Analysing chargebacks by reason code tells you whether your problem is criminals, operations or customer experience — each needs a different owner.

The dispute timeline

1. Cardholder disputes the charge with their bank. Cardholders typically have months, not weeks, to do this; for many reason codes the window is around 120 days from the transaction or expected delivery date, and it varies by scheme and reason.
2. Issuer raises the chargeback; your acquirer or payment platform debits the amount plus a fee and notifies you.
3. You decide whether to accept or fight it. Your provider sets a response deadline that is much shorter than the cardholder’s — often only a few weeks or less. Missing it means automatically losing.
4. Representment. If you contest, you submit evidence through your provider and the issuer reviews it.

Compelling evidence

Winning a dispute depends on evidence that answers the specific reason code. Useful evidence includes order details and timestamps, AVS and CVV results, 3-D Secure authentication results, IP address and device information, delivery confirmation with tracking (and signature for high-value orders), customer correspondence, proof the customer used the product or logged in afterwards, and the terms and refund policy accepted at checkout.

For fraud disputes on Visa, the Compelling Evidence 3.0 rules allow merchants to point to earlier undisputed transactions by the same customer that share data such as device ID, IP address, shipping address or account login. If they match, the issuer should not hold the merchant liable. This only helps if you capture and keep that data for every order.

Do not fight everything. If the customer has a point, accept it and fix the process; spend representment effort on disputes you can win.

Card scheme monitoring programmes

Visa and Mastercard monitor merchants with high levels of fraud and disputes. Being identified in a programme can mean fines passed on by your acquirer, mandatory remediation plans, higher processing costs and, ultimately, losing the ability to take card payments. For a small store, that is a business-ending risk and belongs at the top of the register.

• Visa Acquirer Monitoring Program (VAMP). In April 2025 Visa replaced its separate fraud and dispute monitoring programmes (VFMP and VDMP) with a single programme. VAMP combines reported fraud and non-fraud disputes into one ratio against settled transactions, and also tracks card testing through a separate enumeration ratio. According to published processor guidance, the merchant “excessive” threshold was 2.2% (220 basis points) from June 2025 in most regions, tightening to 1.5% from April 2026 in Asia Pacific, Europe, Latin America and North America, with a minimum monthly count of fraud and dispute reports before a merchant is assessed. Because fraud reports and disputes are both counted, one stolen-card order can count twice.
• Mastercard Excessive Chargeback Program and Excessive Fraud Merchant programme. Mastercard identifies merchants with excessive chargebacks (the Excessive Chargeback Merchant and High Excessive Chargeback Merchant levels) and, separately, merchants with excessive card-not-present fraud chargebacks. The fraud programme looks at both the volume and the ratio of fraud chargebacks, and merchants that authenticate enough of their transactions with 3-D Secure can be excluded.

Thresholds, minimum volumes and fees change and are applied through your acquirer, who may set stricter limits of its own. Ask your payment provider which programmes and thresholds apply to you, and set your internal limits well below them.

Prevention controls mapped to fraud types

No single control covers every type of fraud. Use this table to check that each fraud risk in your store has at least one preventive and one detective control.

3-D Secure by region

In the UK and EU, Strong Customer Authentication is a regulatory requirement for most online card payments, and 3-D Secure 2 is the usual way to meet it; exemptions (low value, low risk, merchant-initiated) exist but are applied by the issuer. In the US, 3-D Secure is optional, so it is a business decision: apply it selectively to higher-risk orders to gain the liability shift without adding friction everywhere. In Australia, the industry’s card-not-present fraud mitigation framework expects merchants with high fraud levels to use stronger authentication; check with your acquirer whether it affects you.

Skimming and PCI DSS

Defences against Magecart overlap with your PCI DSS obligations for payment pages. Using a hosted or embedded payment form from your provider reduces, but does not remove, your exposure: the page that loads the form can still be tampered with. We cover the requirements in the PCI DSS compliance checklist.

KPIs and KRIs to track

Fraud is a balance between two kinds of loss: fraud that gets through, and good customers you turn away. Measure both, monthly at least, and give each indicator amber and red thresholds below the levels that would hurt — see our guide to key risk indicators for how to set them.

The chargeback ratio lags the sale by weeks or months; decline spikes, failed logins and review rates move first. You want both.

A sample risk register for an online store

Fraud and chargebacks are not just a payments problem; they are business risks that need owners, scores and regular review like any other. Below is an example register for a mid-sized online store selling physical goods, scored on a 5×5 risk matrix (likelihood × impact, 1–25). Scores are illustrative residual scores — adjust them to your own business.

Notice that two risks with modest likelihood — losing card acceptance and a skimming breach — score as significant because the impact would be severe. Both are easy to ignore in a busy month, so they need an owner and a scheduled review. For each significant risk, agree a treatment plan with dates, and record whether the score after treatment is within your appetite.

How to keep it alive

• Review monthly alongside the chargeback report: are disputes moving between reason codes? That often means one control improved and another weakened.
• Re-score after incidents — a card-testing attack or a spike in “not received” claims is evidence that likelihood was underestimated.
• Re-assess before changes: a new payment method, a new market, a buy-now-pay-later provider, a big promotion or a new checkout script all change the picture.

Common mistakes

• Over-blocking. Tight rules make fraud charts look good while sales quietly fall. Declined customers rarely complain; they go elsewhere and may not come back.
• Ignoring false declines. If you never measure them, you can only see one side of the trade-off. Sample declined orders regularly and contact a few customers to find out whether they were genuine.
• Treating all chargebacks as criminal fraud. Many disputes come from delivery failures, unclear descriptors or slow refunds. Fraud tools will not fix those; operations and customer service will.
• Making refunds hard. If customers cannot get a refund from you quickly, they get one from their bank — and you pay a fee and gain a dispute on your record.
• Not keeping evidence. If order, device, login and delivery data are not stored and easy to retrieve, you cannot win disputes or use Visa’s Compelling Evidence rules.
• Set-and-forget rules. Fraudsters adapt within weeks. Rules written for last year’s attack pattern block today’s customers and miss today’s fraud.
• No single owner. Payments, customer service, tech and finance each see part of the problem. Without one person accountable for the overall fraud and chargeback position, nobody acts until the acquirer calls.