Key takeaways
- Card-not-present (online) payments carry the most fraud risk.
- No single check stops all fraud; layered signals work best together.
- Overly strict rules create false declines that turn away real customers.
- Adaptive monitoring learns from behavior instead of relying on static rules alone.
Common types of payment fraud
- Stolen card fraud: criminals use stolen card details to make purchases.
- Card testing: bots run many small transactions to find which stolen cards still work.
- Account takeover: a fraudster logs into a real customer’s account and uses saved payment details.
- Friendly fraud: a real customer disputes a legitimate purchase.
- Refund and triangulation schemes: more complex scams that exploit refunds or resale.
The layers of protection
1. Card verification checks
CVV confirms the customer has the physical card’s security code. Address Verification (AVS) compares the billing address entered with the address on file at the issuing bank. Both are simple, effective first filters for online orders.
2. 3-D Secure
3-D Secure adds an authentication step with the card issuer, often a one-time code or banking-app approval, for transactions that look risky. Modern versions use device and behavioral data so many customers pass through without any extra step, while suspicious payments get challenged.
3. Velocity and limits
Velocity checks watch how often something happens: many attempts from one IP address, multiple cards tried on one account, or rapid-fire small charges. These patterns are classic signs of card testing and bots.
4. Device and behavioral signals
Device fingerprints, geolocation, time of day, typing patterns, purchase history and mismatches between shipping and billing details all add context. Individually they’re weak signals; together they’re powerful.
5. Adaptive monitoring
Static rules (“block all orders over a certain amount from country X”) are easy to set but quickly go stale and often block good customers. Adaptive systems evaluate many signals together and adjust as fraud patterns change.
Don’t forget the cost of false declines
Every legitimate customer you decline is a lost sale and, often, a customer who won’t come back. The goal of fraud prevention isn’t to block the most transactions; it’s to block the right ones. Review declined orders periodically and tune your rules if good customers are being caught.
In-person fraud
Chip and contactless payments are far harder to counterfeit than magnetic stripes, because each transaction generates a unique cryptogram. Keep terminals updated, inspect devices for tampering, and train staff to be cautious with manually keyed transactions.
A practical checklist
- Require CVV and use AVS on online orders.
- Enable 3-D Secure for higher-risk transactions.
- Add bot protection and velocity limits to checkout and login.
- Use tracking and signature confirmation for high-value shipments.
- Protect customer accounts with strong passwords and multi-factor authentication.
- Monitor chargebacks and declines for trends. See our chargeback guide.
Frequently asked questions
What is the most common type of online payment fraud?
Using stolen card details for card-not-present purchases is among the most common, along with card testing by automated bots.
Does 3-D Secure hurt conversion?
Modern 3-D Secure uses risk-based authentication, so most low-risk customers aren't challenged, while suspicious transactions get an extra verification step.
How do I stop card testing attacks?
Use bot protection, velocity limits, CAPTCHA on suspicious traffic and minimum transaction thresholds, and monitor for bursts of small authorizations.
Payments that never stop moving.
Talk to a Cirqle payment specialist about stable processing, fast onboarding and payouts that keep cash flowing.
Get approved