E-commerce fraud is becoming a greater threat around the world. One of the main drivers is the card-not-present (CNP) nature of online purchases, which creates an enormous attack surface for anyone willing to abuse it. The value of global e-commerce fraud is expected to grow from about US$56 billion in 2025 to US$131 billion by 2030. To address this threat, effective e-commerce fraud prevention combines overlapping controls that each catch what the others miss.

Below, we'll explore the common types of fraud that affect online retailers, how real-time detection works at the transaction level, and how to build a layered prevention strategy that can catch fraudulent actors without turning away legitimate customers.

Key takeaways

• E-commerce fraud spans multiple types, including CNP fraud, friendly fraud, and account takeover. Each requires different controls to detect and prevent.

• Real-time fraud detection assigns a risk score based on device signals, behavioural data, and order characteristics. That score determines whether the automated system approves, blocks, or reviews a transaction.

• A layered prevention strategy pairs machine learning models with custom rules and checkout verification controls to enable the broadest coverage with the least friction for legitimate customers.

What is e-commerce fraud?

E-commerce fraud is any attempt to complete an online transaction using stolen, false, or manipulated information to obtain goods, services, or money without legitimate authorisation. Unlike in-person fraud, there's no card to physically steal and no face to identify; that makes the online channel more attractive to fraudulent actors.

What are the common types of e-commerce fraud?

These are some common types of e-commerce fraud:

• CNP fraud: Someone uses stolen card credentials to place an order. The cardholder often disputes the charge with their bank, and the business loses the goods, the revenue, and typically a chargeback fee on top.

• Friendly fraud: A legitimate customer makes a purchase, receives the item, and disputes the charge anyway. They claim it was unauthorised, that the item never arrived, or that it wasn’t as described. Without strong evidence, such as delivery confirmation, internet protocol (IP) records, and device fingerprints, businesses can lose these disputes.

• Account takeover: A fraudulent actor gains access to an existing customer account (often through credential stuffing using breached username and password pairs), then changes the shipping address and places orders using the stored payment method. Because the account has a legitimate purchase history, these orders often pass basic fraud checks without raising any warning signs.

• Return abuse: Customers exploit lenient return policies to get refunds on items they’ve already used or send back damaged or different products. Refund fraud affects margins the same way other kinds of fraud do, but it’s often treated as an operational problem.

• Promotion and coupon abuse: Fraudulent actors create multiple accounts to repeatedly claim new customer discounts, referral bonuses, or promo codes. This is especially common with digital goods or subscription products, where there’s no physical limit to how many times the abuse can repeat.

What best practices for e-commerce fraud prevention should online retailers follow?

Effective fraud prevention programs combine detection signals, checkout safeguards, and internal policies. Transaction monitoring should watch for the following signals that, taken together, indicate the likelihood of fraud:

• Unusual patterns: Multiple orders from the same IP address, card number, or device in a short window of time often indicate automated fraud or carding attacks (i.e., fraudulent actors test stolen card numbers with small transactions before they make larger ones).

• Shipping and billing mismatches: An order where the billing and shipping addresses are in different countries or where the email doesn't match what's on file for that card raises the probability of fraud.

• Device and browser signals: Device fingerprinting captures attributes such as browser configuration, screen resolution, and installed fonts. A device previously associated with a fraudulent order is a strong risk indicator, regardless of what card it's using now.

• Order characteristics: High-value orders placed immediately after account creation, multiple units of the same high-resale item, and expedited shipping for a destination where it doesn't make logistical sense are all scenarios that warrant closer inspection.

At checkout, further verification checks can give you a better understanding of who's completing the transaction. These include the following:

• Address verification service (AVS): This checks whether the billing address a customer enters matches what's on file with the card issuer. A full match doesn't guarantee legitimacy, but a mismatch can be an important risk signal.

• Card verification value (CVV) check: This confirms that the person who places the order has physical access to the card, not just the card number. Requiring CVV at checkout is standard practice.

• 3D Secure (3DS): This adds an authentication step where the cardholder verifies their identity with the card issuer directly, often through a one-time code or biometric prompt. When 3DS authentication succeeds, chargeback liability typically shifts from the business to the card issuer.

Automated rules let you set hard boundaries around transaction behaviour: you can block all orders that ship to a specific high-risk region, require manual review above a certain order value, or decline any transaction where AVS fails and the order exceeds a set threshold. The challenge is that rules are static by default. Fraud tactics shift, and rules that worked effectively six months ago might generate false declines today. Block rates and false positive rates need regular review.

How are fraudulent orders detected in real time?

When a customer places an order, the fraud detection process starts before the payment authorisation request even reaches the card network. Here's how it works:

• Data capture: The checkout system collects device signals, IP address, and session behaviour (e.g., time on page, typing cadence, how form fields were filled) alongside the order details themselves.

• Rule evaluation: The order is checked against any rule-based blocks, such as transaction speed limits, blocked countries, and card restrictions based on Bank Identification Number (BIN). Orders that incur a hard block stop here.

• Risk scoring: A model evaluates the full signal set and produces a score by weighting different signals based on which combinations have historically preceded chargebacks and disputes.

• Decision: Based on the score and configured thresholds, the order is approved automatically, flagged for human review, or declined. A fraud team works through the review queue to manually evaluate borderline cases.

• Feedback loop: When a flagged order is manually reviewed and approved or declined, that outcome feeds back into the model and improves future scoring accuracy.

What is the difference between e-commerce fraud prevention techniques and tools?

E-commerce fraud prevention techniques are the analytical approaches used to identify fraud. Related software can deploy those techniques at scale.

Here are some common techniques:

• Velocity checks: Flag unusual transaction frequency within a time window. This is useful for catching carding attacks, where fraudulent actors test batches of stolen card numbers in quick succession.

• Behavioural biometrics: Analyse how a user interacts with a form (e.g., mouse movement, keystroke timing, autofill patterns) to distinguish humans from bots that are attempting to automate checkout.

• Machine learning models: Train on historical transaction data to identify patterns that precede fraud, including patterns that are too subtle for rules to catch. The more transaction data a machine learning model trains on, the better it gets at distinguishing genuine edge cases from fraud.

• Network analysis: Identify shared signals across accounts (e.g., same device, same IP, same email domain) to detect fraud rings that are operating across multiple accounts simultaneously.

Stripe Radar applies machine learning models trained on transaction data from across Stripe's network. Because Radar sees patterns across millions of businesses, it can identify risk signals that no individual business would have enough data to detect on its own. A card number that appeared in a fraudulent transaction elsewhere on the network is a valuable signal, even if it's the first time you've seen it.

How do you build a layered e-commerce fraud prevention strategy?

A layered strategy means no single point of failure lets fraud through. Each layer catches what the others miss.

Here's what a layered strategy should include:

• Account and identity verification: Before anyone can place an order, confirm that they are who they say they are. Email verification at account creation, strong password requirements, and 3D Secure authentication add baseline identity controls that reduce the risk of account takeover.

• Checkout-level signals: CVV checks, AVS, and device fingerprinting can catch a large portion of card-not-present (CNP) fraud attempts before they complete. Processing transactions without these controls leaves obvious gaps.

• Risk scoring: Real-time scoring evaluates the full order context. This is where a tool like Stripe Radar adds the most value because the model draws on cross-network signals that checkout-level verification alone can't see.

• Custom rules: Business-specific rules adjust the baseline model for your context. A digital goods business faces different fraud patterns from a physical goods retailer, and rules let you encode that knowledge directly into your decisioning.

• Post-transaction monitoring: Chargeback rates, dispute patterns, and fulfilment anomalies are signals too. Monitoring downstream metrics catches fraud that slipped through earlier layers and informs adjustments to rules and thresholds over time.

• Return and policy controls: Businesses that often experience return fraud can mitigate abuse by requiring photos of returned items, issuing store credit instead of refunds for flagged accounts, or implementing return windows proportional to order value. And they can do so without significantly harming the experience for honest customers.

How Stripe Radar can help

Stripe Radar uses AI models to detect and prevent fraud, trained on data from Stripe's global network. It continuously updates these models based on the latest fraud trends, so your business stays protected as fraud evolves.

Stripe also offers Radar for Fraud Teams, which allows users to add custom rules addressing fraud scenarios specific to their businesses and access advanced fraud insight.

Radar can help your business:

• Prevent fraud losses: Stripe processes over US$1 trillion in payments annually. This scale uniquely enables Radar to accurately detect and prevent fraud and save you money.

• Increase revenue: Radar's AI models are trained on actual dispute data, customer information, browsing data, and more. This lets Radar identify risky transactions and reduce false positives, which boosts your revenue.

• Save time: Radar is built into Stripe and requires zero lines of code to set up. You can also monitor your fraud performance, write rules, and more in a single platform, which increases efficiency.

Learn more about Stripe Radar or get started today.