# Ecommerce Fraud Prevention: How to Protect Your Store
Ecommerce fraud prevention for small stores: card testing, chargebacks, 3D Secure, risk rules and manual review. Build a four-layer defense today.
*Published 2026-11-02*
**Most ecommerce fraud prevention advice is written for enterprises with a fraud team. You have a Stripe dashboard and a Tuesday afternoon.** This guide covers the fraud that actually hits small online stores (card testing, stolen cards, account takeover, friendly fraud), and a four-layer defense you can set up without a data science budget.
## What Ecommerce Fraud Actually Looks Like
Ecommerce fraud is any order or account action made with stolen credentials, false identity, or bad faith, that leaves you holding the loss. For a card payment the loss is usually the goods you shipped, the shipping cost, and a dispute fee on top, because the real cardholder will eventually ask their bank to reverse the charge.
Small stores see a handful of repeat patterns:
| Pattern | What happens | Where it hurts |
|---------|--------------|----------------|
| Card testing | Bots run lists of stolen card numbers through your checkout with tiny orders to see which ones work | Processor fees, a flood of declines, a damaged payment reputation |
| Stolen-card orders | A fraudster buys real goods with a valid stolen card | Chargeback, lost goods, dispute fees |
| Account takeover | Attacker logs in with leaked credentials and orders with the saved card | Chargeback and an angry customer |
| Friendly fraud | The real cardholder disputes a legitimate order ("I don't recognize this") | Chargeback on an order you fulfilled correctly |
| Refund and return abuse | Empty-box claims, "not received" claims, wardrobing | Lost goods and margin |
| Reseller and promo abuse | Bots and multi-accounts farm discount codes or grab limited drops | Margin loss and unhappy real customers |
Notice that most of these don't feel like "hackers". They feel like a weird order, a spike of failed payments, or a dispute email on a Monday morning.
## Why Small Stores Get Hit Harder Than You Think
Fraudsters don't target you by name. They target weak checkouts. A store with no bot protection, no address checks, and an open payment form is cheap to probe, whatever its size. Card testing in particular is automated and indiscriminate: if your checkout accepts a stolen card number and answers quickly, it gets added to a list and hit again.
The second reason is arithmetic. A large retailer absorbs a few percent of fraud losses inside a healthy margin. If your net margin is 8 to 15 percent, a single chargeback on a $100 order (the goods, shipping, and a dispute fee) can erase the profit from several honest orders.
The third is that card networks watch your dispute ratio. Stay under the line and nobody notices you. Cross it and your processor may add fees, require a reserve, or end the relationship. We cover that threshold below.
## The Four Layers of Fraud Defense
No single tool stops fraud. The stores that keep losses low stack cheap defenses so each layer catches what the previous one missed.
### Layer 1: Before Checkout (Bots and Card Testing)
Card testing is the one fraud type you can often stop completely before it reaches your payment processor.
- **Rate-limit checkout and payment attempts** per IP, per session and per card fingerprint. Real shoppers rarely try more than three cards.
- **Put a bot challenge on payment and account endpoints**, not on every page. A visible CAPTCHA on the homepage costs you conversion; an invisible check on the pay button costs nothing.
- **Never expose a raw "card declined" reason** to the browser. Return a generic message so attackers can't tell a stolen-but-invalid card from a blocked one.
- **Watch for the signature**: many small orders, many different cards, same email domain or IP range, a high decline rate, usually in bursts.
If you want a deeper treatment of the bot side, a dedicated guide on ecommerce bot protection is on our roadmap. The rule of thumb is simple: protect the endpoints that cost you money.
### Layer 2: At Payment (Risk Scoring, AVS, CVC and 3D Secure)
This layer has the highest leverage, because it is where a fraudulent order is cheapest to stop: before you have ever picked or shipped anything.
**Risk scoring.** Modern processors score every payment using signals from their whole network. [Stripe Radar](https://docs.stripe.com/radar) evaluates payments in real time and gives a risk level you can allow, block, review or challenge with rules. It is on by default for Stripe payments, and the rules engine lets you add your own logic.
**AVS and CVC checks.** The Address Verification System (AVS) compares the billing address with the one the bank has on file. The card verification code (CVC) proves the buyer has the physical card details. A mismatch on both is a red flag. Don't hard-block on AVS alone: it is mostly a US, UK and Canada tool, and it misfires for international buyers and recently moved customers.
**3D Secure (3DS).** 3DS asks the cardholder to confirm the payment with their bank, usually through a banking app or a one-time code. When a payment is authenticated, liability for fraud-related disputes generally shifts from you to the issuer. That is the single strongest protection against stolen-card chargebacks. See [Stripe's 3D Secure documentation](https://docs.stripe.com/payments/3d-secure) for the exact flows and liability rules.
The trade-off is friction, so apply it selectively:
- **In the EU and UK**, strong customer authentication (SCA) is required for most online card payments under PSD2 and its UK equivalent, so 3DS is part of normal checkout there. Exemptions exist for low-value or low-risk payments.
- **In the US**, 3DS is optional. Request it only for risky payments: a medium or high risk score, a first order above a certain value, or a mismatch between shipping and billing country.
### Layer 3: After Payment (Rules and Manual Review)
Some orders pass the processor but still look off. A short rule set puts these in a review queue instead of straight to your warehouse. Good starter rules:
| Rule | Why it works |
|------|--------------|
| Review if billing and shipping countries differ and order value is above your average | Classic stolen-card pattern |
| Review if the shipping address is a known freight forwarder or reshipper | Fraudsters avoid their own address |
| Review if the same card or IP places more than 3 orders in an hour | Velocity abuse |
| Review if the email was created today and the basket contains your most resellable item | New account plus high-value goods |
| Block if the card's country and IP country differ and the risk score is high | Cheap, strong signal combined with score |
[Radar's rules reference](https://docs.stripe.com/radar/rules) shows the exact syntax for allow, block, review and 3DS-request rules.
**Run manual review with a stopwatch.** For a store doing a few hundred orders a month, review 1 to 3 percent. Check the order against these questions: Does the email look like the name? Does the shipping address match the billing region? Is the delivery speed unusually urgent? When in doubt, email the customer. A real customer answers within hours; a fraudster usually vanishes.
Keep a list of trusted customers (repeat buyers with clean history) that skip review, and a block list of cards, emails and addresses tied to past fraud.
### Layer 4: After Shipping (Disputes and Monitoring)
You will lose some disputes. The goal is to keep the ratio low and win the ones you can.
- **Keep evidence for every order**: IP address, device, AVS and CVC results, 3DS result, delivery confirmation with signature or photo for high-value orders, customer emails, and your return policy as shown at checkout.
- **Respond inside the deadline**, which is short (often around a week or two depending on the network). Missing it is an automatic loss.
- **Use a clear billing descriptor** so customers recognize the charge. A surprising share of "fraud" disputes are customers who simply didn't recognize the statement line.
- **Answer refund requests quickly.** A refund costs you the sale. A dispute costs you the sale, a fee, and a mark on your ratio.
## The Chargeback Threshold You Must Know
Card networks track the share of your transactions that end in fraud reports or disputes. Visa's current monitoring program (VAMP) counts fraud reports and disputes against settled card-not-present transactions, and the "excessive" merchant threshold has been reported to drop to [1.5 percent from April 2026](https://www.chargebackgurus.com/blog/visa-announces-even-more-vamp-changes), with some regional exceptions and stricter limits set by individual acquirers. Sources disagree on details and the numbers keep changing, so confirm the current figures with your processor.
The practical takeaway: aim for **well under 0.5 percent**. Once you are near 1 percent, you are one bad week of card testing away from trouble.
## Fraud Prevention vs. Conversion: The Trade-Off Nobody Mentions
Every control adds friction or false positives. A store that blocks aggressively rejects real customers, and those lost sales don't show up in any fraud report. Track both sides:
- **Fraud rate**: disputes divided by transactions.
- **False-positive rate**: legitimate orders you blocked or challenged. Sample a few blocked orders each month and ask whether they were real.
- **Authentication success rate**: share of 3DS challenges the customer completes.
- **Approval rate**: share of attempted payments that succeed. A sudden drop is a card-testing alarm.
If you sell low-risk, low-price goods, a lighter touch is correct. If you sell electronics, gift cards, supplements, or limited drops, tighten up. The right setting depends on your product, not on a universal checklist.
## Fraud Prevention for a Small Store: A 60-Minute Setup
1. **Turn on your processor's risk tools** and confirm they cover every payment method you offer.
2. **Request 3DS for medium and high risk** payments (and by default where SCA applies).
3. **Add three review rules** from the table above and set an alert on review volume.
4. **Rate-limit checkout** and add an invisible bot challenge to the pay button.
5. **Set a clear billing descriptor** with your store name and a support URL or phone number.
6. **Write down your evidence checklist** so disputes take ten minutes, not an hour.
7. **Put a weekly reminder** in your calendar to look at declines, reviews, and disputes for five minutes.
## Fraud Prevention on Your Next Store
[Your Next Store](https://yournextstore.com/) uses Stripe for payment processing, so Stripe's risk tooling, including Radar and 3D Secure, applies to your store's payments. Your products, orders, and customers live in the YNS backend, so your admin dashboard shows the order context (items, shipping address, customer history) that you need during manual review.
What YNS does not do is replace a dedicated fraud team: you still set your Radar rules, decide your review thresholds, and keep your evidence. That is on purpose. Fraud tolerance is a business decision, and it differs between a $12 sticker shop and a $900 electronics store. Pricing for the platform is on the [pricing page](https://yournextstore.com/pricing), with 0 percent platform transaction fees on every plan; Stripe's standard processing and dispute fees still apply.
**Always check the current rules where you sell.** This guide summarizes general card-network and payment practices, with notes on EU and UK strong customer authentication and US dispute handling, as of November 2026. Network thresholds, liability rules and legal requirements change and vary by country and processor, so confirm the details with your payment provider and a qualified adviser. This is general information, not legal advice.
## FAQ
### What is the most common type of ecommerce fraud?
For small stores it is stolen-card fraud, followed closely by friendly fraud (a real customer disputing a legitimate purchase) and automated card testing. Which one dominates depends on what you sell and whether your checkout is easy to probe.
### Does 3D Secure stop all chargebacks?
No. It shifts liability for most fraud-coded disputes to the card issuer when the payment is authenticated, but it doesn't cover "product not received" or "not as described" disputes. Pair it with good evidence and clear communication.
### How much does ecommerce fraud prevention cost?
For most small stores the core tools are bundled with the payment processor. Dedicated fraud platforms add a monthly or per-transaction fee and make sense once your dispute losses clearly exceed their cost. Check your processor's current fraud-tool pricing before adding another vendor.
### Should I block orders from certain countries?
Only if your data supports it. If you don't ship to a country, block it. If you do, use a review rule rather than a hard block, and revisit it quarterly.
## Related Blog Posts
- [Ecommerce Checkout Optimization](/blog/ecommerce-checkout-optimization)
- [How to Sell Online With Stripe](/blog/how-to-sell-online-with-stripe)
- [Buy Now, Pay Later for Ecommerce](/blog/buy-now-pay-later-ecommerce)
- [Ecommerce Launch Checklist](/blog/ecommerce-launch-checklist)