🛡️ Fraud prevention and tooling

Friendly fraud: enemy number one

Friendly fraud (first-party misuse in Visa’s terminology) is a chargeback filed by the legitimate cardholder. The purchase really happened, but the cardholder disputes it as fraudulent or not received. Industry estimates (Visa, Datos Insights) converge on 60% to 80% of e-commerce chargebacks. That share changes what anti-fraud work is about. Most of the “fraud” an online merchant sees comes from its own customers’ behavior, not from third parties using stolen cards.

Scoring: rules vs. machine learning

Fraud scoring assigns every transaction a risk score before or during authorization, and that score determines the outcome: approve, decline, 3DS challenge, or manual review. Two approaches coexist and complement each other. Expert rules are readable and take effect immediately. Machine learning models capture correlations humans can’t see (entity graphs, typing speed, device reuse), at the cost of less explainability.

# Rules act as fast guardrails around the ML score.
rules:
  - id: card-velocity
    condition: distinct_cards_per_device_24h >= 3
    action: decline
    comment: testing stolen cards (card testing / enumeration)

  - id: geo-mismatch
    condition: ip_country != bin_country AND amount > 150
    action: challenge_3ds
    comment: targeted friction instead of a hard decline

  - id: loyal-customer
    condition: account_age > 180d AND delivered_orders >= 5 AND ml_score < 20
    action: request_tra_exemption
    comment: acquirer TRA exemption if the fraud rate is below the EBA thresholds

  - id: gray-zone
    condition: ml_score between 60 and 85
    action: manual_review
    queue: priority_if_amount > 300
    comment: human review absorbs the model's zone of uncertainty

Alerts and deflection: stopping the dispute before the chargeback

Deflection means resolving the cardholder’s dispute before it becomes a formal chargeback. Between the two, there is a 24- to 72-hour window to settle the matter. The Verifi (a Visa subsidiary) and Ethoca (a Mastercard subsidiary) alert networks cover this ground, connected directly to participating issuers. A deflected dispute does not count as a chargeback in monitoring program ratios, with one exception described below. It costs a fraction of what a chargeback costs.

3DS: across the board or targeted?

In the EEA, strong customer authentication (SCA) is mandatory. The merchant’s choice is therefore not “with or without 3DS” but who requests exemptions, and which ones. An authenticated 3DS transaction shifts fraud liability to the issuer (liability shift). A TRA (transaction risk analysis) exemption keeps checkout smooth but leaves liability with whoever requested the exemption. Fine-tuning this setting has a direct impact on conversion.

• EBA thresholds for TRA: exemption possible up to €100 if the requesting PSP’s fraud rate is ≤ 13 basis points, €250 if ≤ 6 bps, and €500 if ≤ 1 bp. What counts is the PSP’s rate, not the merchant’s.
• Low value: exemption under €30, with cumulative counters (5 transactions or €100 in a row) managed by the issuer, which explains “surprise” challenges on small baskets.
• Measured impact: in France, the rollout of SCA came with a lasting drop in the fraud rate on remote payments, from about 0.27% in the early 2010s to ~0.16% in 2023 (OSMP).

Proactive refunds

A proactive refund returns the funds to the customer before their dispute turns into a chargeback. The point is the cost gap between the two outcomes. A refund costs only the amount, while a lost chargeback costs the amount + €15–50 in fees + the hit to the ratio. A proactive refund policy sets out in advance when the merchant refunds without investigating the case.

• Alert received (CDRN/Ethoca) on a losing case: always refund within 72 hours, since that is what the alert is for.
• Customer complaint before a dispute (“I’m going to my bank”) on a small amount: refund if fighting it costs more than what is at stake, even if you doubt the customer’s good faith.
• Confirmed merchant error (duplicate charge, credit note never issued, parcel lost with no proof of delivery): refund immediately. Any representment would be lost, with fees.
• Anti-abuse limit: cap per customer (cumulative amount, number of goodwill gestures) and track repeat recipients. Proactive refunds must not become a reward for repeat friendly fraud.

The fraud KPIs to track

Managing a fraud prevention setup is an economic trade-off: every euro of fraud avoided has a measurable cost. That cost takes two forms. One is false positives, legitimate sales declined because they could not be told apart from fraud. The other is the cost of the tools that make the distinction. A minimum dashboard therefore tracks four families of metrics: fraud losses, disputes, false positives, and total cost.