Credit card fraud in Australia often shows up when fraudulent actors use information from a card they don’t own to buy something online. Card-not-present (CNP) fraud, where no physical card is involved, made up 90% of Australian-issued card fraud in 2024. Credit card data is usually compromised due to data breaches and phishing schemes. For Australian businesses that sell online, fraud risk is highest at checkout.

Below, we’ll discuss how credit card fraud appears in Australian online retail transactions, what signals to watch out for, and the difference between fraud prevention and fraud protection.

Key takeaways

• CNP fraud accounts for most of the credit card fraud that occurs in Australia and frequently originates from data breaches rather than attacks on individual businesses.

• Prevention and protection serve different purposes, and businesses need to be proactive to reduce this type of theft.

• Tools such as 3D Secure 2 (3DS2) give businesses ways to spot fraud without adding unnecessary delays for legitimate customers.

What is credit card fraud detection in Australia?

Credit card fraud happens when a fraudulent actor uses the details of a card they don’t own. Typically, it’s to make a purchase, but it can also be to take out a cash advance, open a new line of credit, or obtain some other financial benefit. As a business owner, detection tools can help you catch these fraud attempts before they turn into real loss.

How does credit card fraud occur in Australian online retail?

In Australia, CNP fraud frequently starts when card details are exposed in a data breach. This information is sold or traded to fraudulent actors, who often attempt to use it in online checkouts. The tactics fraudulent actors use against Australian online storefronts tend to follow a few patterns.

Card testing

With card testing, bad actors make numerous small transactions with multiple businesses to find out which stolen card numbers still work before they attempt a bigger purchase. This might look like a sudden increase in small failed or approved transactions from unrelated internet protocol (IP) addresses.

Account takeover

An account takeover is when a fraudulent actor gets into a customer’s existing account, usually through a password captured in another breach, and either uses the stored payment details or swaps in a stolen card. This occurs most often on sites where customers save their cards for repeat purchases.

Friendly fraud

When a cardholder makes a real purchase, then disputes the charge with the card issuer and claims they never authorized it, it’s known as “friendly fraud.” This form of fraud tends to be harder to catch at checkout because the transaction itself looks completely ordinary.

Triangulation fraud

With triangulation fraud, bad actors set up a fake storefront, collect orders and payments from real customers, then use stolen card details from a third party to fulfill those orders via a different, legitimate business. That business often has no direct link to the victim (i.e., the owner of the stolen card) but bears the brunt of the scam.

What are the warning signs of a fraudulent credit card transaction?

No single signal will indicate a transaction is fraudulent. But certain scenarios might be worth investigating:

• Billing and shipping mismatches: A common warning sign is a billing address in Australia paired with a shipping address overseas, or a shipping address that’s a freight forwarder rather than a home or business.

• Peaks in activity: Too many transactions on the same card, device, or IP address within a short time frame can be problematic. Since normal customer behavior can vary, appropriate thresholds can help keep genuine customers from being flagged as fraudulent.

• Unusual order composition: A large order of items with high resale value (e.g., electronics, gift cards), especially from a first-time customer with no purchase history, could represent a fraud attempt.

• Time-of-day anomalies: Transactions placed at hours that don’t match the typical shopping pattern of the customer’s stated location can mean a bad actor is operating from a different time zone using someone else’s identity.

• IP and device inconsistencies: A customer’s IP address might geolocate to a country far from their billing address, or a device fingerprint could be tied to previous fraudulent orders.

• Address verification service (AVS) and card verification value (CVV) mismatches: While a failed CVV code or AVS check doesn’t confirm fraud on its own, it’s worth weighing alongside other transaction details.

How do credit card fraud prevention and protection differ?

Though both are key parts of a business’s security strategy, credit card fraud prevention and protection differ in when they take place: before or after fraud occurs.

Credit card fraud prevention is proactive

Credit card fraud prevention covers all measures taken before a transaction goes through, including verifying the customer’s identity, checking the card details against known fraud patterns, and deciding whether to approve, decline, or flag the order for review. AVS and CVV checks, device fingerprinting, and risk scoring using machine learning (ML) all fall into this category.

Credit card fraud protection is reactive

Credit card fraud protection generally refers to what happens after fraud gets through, whether that’s a chargeback dispute, a refund, or an attempt to recover funds with a card network. Even businesses with strong prevention safeguards still experience disputed transactions. That’s why it’s important to have a clear process for disputing chargebacks, which includes collecting the relevant transaction details and submitting a dispute before the card network’s response deadline. A defined process makes it easier to see how much fraud is costing the business.

How does 3D Secure 2 (3DS2) help prevent credit card fraud in Australia?

3DS2 is a global authentication tool Australian businesses can use to help with fraud prevention. It adds a verification step to online card transactions. This step sometimes appears as a prompt from the card issuer asking the cardholder to confirm the purchase through their banking application (app), a one-time code, or biometric verification (e.g., fingerprint recognition).

Version 2 of 3D Secure offers more safeguards to protect businesses. It shares more transaction data with the card issuer behind the scenes, such as device information, transaction history, and billing details. With this extra context, the issuer can approve many transactions without having to prompt the customer. Only high-risk transactions cause an authentication prompt to appear. In practice, businesses using 3DS2 get stronger authentication on the transactions that require it, while low-risk customers never experience an interruption.

This protocol also causes a shift in liability. When a business runs a transaction through 3DS2 and the issuer authenticates it, responsibility for certain fraud-related chargebacks moves from the business to the issuer. Australian businesses that sell higher-value goods, or goods that bad actors target for their resale value, might find that trade-off worth it—even if it means the time it takes to check out increases slightly.

How should Australian businesses evaluate their credit card fraud defenses?

There’s no fixed formula for how much fraud prevention your business needs. It depends on your average order value, the type of goods you sell, how attractive those goods are for resale, and how much friction your business can have at checkout without significantly reducing sales.

It’s important to look at your metrics. Chargeback rate, decline rate, and the ratio of manually reviewed orders to total orders can all help you determine whether the current safeguards are working in your favor. A high decline rate paired with a low chargeback rate could mean legitimate customers are being blocked for no good reason. A low decline rate paired with a rising chargeback rate suggests fraudulent actors are getting through.

From there, it comes down to making specific adjustments: you can lower or raise your risk thresholds, decide which kinds of orders warrant 3DS2 authentication, and change the type of proof you provide to card networks based on the chargeback disputes that have been successful.

How Stripe Radar can help

Stripe Radar helps detect fraud and unlock growth, using AI trained on data from Stripe’s global network. Radar helps protect your business from fraud throughout the customer lifecycle before it affects your bottom line, while helping you approve more legitimate customers and payments.

Radar can help your business:

• Prevent fraud losses: Radar’s AI learns from more than $1.9 trillion in annual transactions across Stripe’s global network, helping it identify and block fraud patterns that individual businesses might not catch on their own.

• Unify protection across evolving fraud attacks: Radar brings protection against transaction fraud, account fraud, and customer abuse all into one solution, so you gain unified protection across major fraud types.

• Adapt as fraud evolves: Radar continuously adapts to changing fraud patterns, from first-party abuse to agentic transactions, helping protect your business against emerging threats.

• Work with your existing tech stack: Use Radar with Stripe payments with no integration required, or access Radar’s intelligence through programmable APIs, whether you process payments on Stripe or not.

Learn more about Stripe Radar, or get started today.

FAQs about credit card fraud in Australia