Launching a new retail business has never been easier. In just a few minutes, digital entrepreneurs can set up storefronts and payment gateways and start accepting payments from customers. Yet the rise in global ecommerce retail, predicted to surpass $13 trillion in 2030, has also created more opportunities for fraudulent actors to exploit vulnerabilities in the payment system—a liability for both customers and businesses.

In the payment industry, merchant fraud generally refers to fraud committed by dishonest businesses or sellers, but the term is also occasionally used to refer to fraud attempts by bad actors against businesses. The cost of ecommerce-related fraud was $44.3 billion in 2024 and is projected to reach $107.0 billion in 2029. Merchant fraud affects businesses of all sizes and types. Consequences can be severe and include financial losses, reputation damage, and legal penalties.

Below, we’ll explore what businesses need to know about merchant fraud, how it works, how it hurts businesses, and how to prevent it.

What’s in this article?

• What is merchant fraud?
  
• Types of merchant fraud
  
• What types of businesses are affected by merchant fraud?
  
• How does merchant fraud hurt businesses?
  
• How to prevent merchant fraud
  
• How Stripe Radar can help
  

What is merchant fraud?

Merchant fraud encompasses two related but distinct threats: fraud committed by fake or deceptive businesses against customers and payment networks, and fraud committed against legitimate businesses by bad actors who exploit payment systems.

In some cases, fraudulent actors might create fake online storefronts or social media accounts that look like legitimate businesses, with the goal of tricking customers into making purchases. These dishonest storefronts could offer goods at extremely low prices or advertise hard-to-find items to entice unsuspecting customers. In other cases, the bad actors might use the customer’s credit card information to make additional fraudulent purchases, leading to further financial harm.

Types of merchant fraud

Merchant fraud can take many forms.

Credit card fraud

One of the most common types of merchant fraud is credit card fraud, in which criminals use stolen or counterfeit credit cards to make purchases. In cases of merchant fraud, stolen credit card numbers might be used to transact with fake businesses to defraud credit card companies. The prevalence of credit card fraud highlights the need for businesses to have tight security protocols and quickly detect and respond to suspicious transactions. In a 2026 report, about 22% of fraud victims reported seeing unauthorized recurring charges from the same business, nearly double the rate in 2024.

Account takeover fraud

Account takeover fraud occurs when fraudulent actors gain access to a customer’s account credentials, such as their username and password, to make fraudulent purchases. This type of fraud can be more difficult to detect as it frequently appears as though the legitimate account holder is making the purchase.

Synthetic identity fraud

Synthetic identity fraud happens when criminals blend legitimate data (e.g., a stolen Social Security number) with fabricated details such as a fake name and address to create an entirely new, fictitious persona. Unlike traditional identity theft, which targets a real person, synthetic fraud involves hybrid identities that have no clear victim on the customer side. This makes the fraud exceptionally difficult to detect.

Phishing scams

In phishing scams, fraudulent actors send emails or messages to individuals, often in an attempt to obtain sensitive information, such as login details or credit card numbers. These scams can be highly sophisticated and fool even the most savvy internet users, making phishing a significant threat to businesses and their customers.

Identity theft

Identity theft occurs when bad actors obtain an individual’s personal information (e.g., name, address, Social Security number) to make fraudulent purchases or open new lines of credit in their name. Identity theft can have devastating consequences for both individuals and businesses, including stolen funds, damaged credit scores, and legal trouble. This highlights the importance of strong data protection and privacy measures.

Chargeback fraud

Chargeback fraud, frequently referred to as friendly fraud or first-party misuse, occurs when a legitimate customer disputes a valid, delivered purchase with their credit card issuer instead of requesting a refund directly from the business. This can happen accidentally if a customer doesn’t recognize a billing descriptor or maliciously to secure a refund while keeping the product. This type of fraud is a growing liability for businesses, with a 2026 global industry survey indicating that 64% of businesses are experiencing rising rates of first-party misuse.

What types of businesses are affected by merchant fraud?

Merchant fraud is a growing problem that affects businesses of all types and sizes. While all businesses are at risk of merchant fraud, there are certain industries and business types that tend to see the highest occurrence of fraud:

• Ecommerce: Online transactions are harder to verify than in-person ones so ecommerce businesses can see a higher occurrence of merchant fraud. Fraudulent actors can exploit vulnerabilities in payment processing systems or commit chargeback fraud by claiming they didn’t receive a product.

• Travel and hospitality: Since it often involves high-value transactions and complex payment processing systems, the travel and hospitality industry also sees higher rates of merchant fraud. Bad actors can use stolen credit card numbers to book flights, rental cars, or hotel rooms.

• Retail: Retail is often a fast-paced environment that can involve high-value goods, which can make it more challenging to detect fraud in real time. Fraudulent actors might use stolen credit card numbers to purchase high-priced items or engage in return fraud by claiming a refund for an item they didn’t return. A 2026 study found that retail fraud costs businesses over $5 for every $1 of direct loss in the US.

• Digital goods and services: Businesses that sell digital goods and services, such as software and online courses, are also highly vulnerable to merchant fraud. In these cases, bad actors might use stolen credit card numbers to purchase digital goods or dispute the charge after accessing the product and receiving the benefit. In 2026, digital goods fraud is expected to cost businesses $12.4 billion.

How does merchant fraud hurt businesses?

Merchant fraud can target customers directly without specifically targeting a legitimate business, or it can involve the penetration and exploitation of legitimate businesses. These scams can pose a financial risk to customers and damage the reputation of the legitimate businesses targeted.

Here’s how merchant fraud can often hurt businesses.

Damages brand reputation and erodes customer trust

When fraudulent actors pose as legitimate businesses, they can damage customer trust of those businesses. That leads to a decline in sales and revenue. This is especially true in industries where merchant fraud is more prevalent. If a certain type of company becomes associated with fraudulent activity, then even legitimate businesses might have a harder time gaining and keeping customer trust.

Causes operational disruption and diverts resources

Investigating and resolving fraudulent transactions can cause significant operational disruption for businesses. Managing fraud diverts valuable resources away from important business functions as teams must spend time investigating issues, updating security measures, and implementing new policies to prevent future attacks. This loss in productivity impacts overall efficiency and prevents a company from focusing on constructive, growth-oriented tasks.

Causes direct financial losses and chargeback liability

Businesses that fall victim to merchant fraud scams might be subject to chargebacks and other financial liabilities, resulting in revenue losses and additional fees and penalties.

Exposes businesses to fines and legal action

Businesses that fall victim to merchant fraud scams might also face legal consequences, such as fines and lawsuits, if they’re found to have been negligent in their fraud prevention measures.

Increases payment processing costs

An elevated frequency of merchant fraud in some industries or sectors can result in higher payment processing fees for legitimate businesses. Payment processors might charge higher fees to compensate for the increased risk. Read about how Stripe defines and handles high-risk merchants.

How to prevent merchant fraud

Merchant fraud is a complex, multifaceted problem that requires constant vigilance and a proactive approach to prevention. It’s important for businesses to understand the risks of merchant fraud, take measures to protect themselves, and create playbooks for stopping merchant fraud proactively. By educating themselves about the different types and implementing robust fraud prevention measures, businesses can protect themselves and their customers.

Here are some measures businesses can take to prevent, detect, and address merchant fraud:

• Implement fraud prevention tools: Tools such as fraud detection software, address verification systems, and device fingerprinting can help businesses prevent fraudulent transactions. They use algorithms to flag suspicious transactions such as purchases made with stolen credit card information or from a high-risk location.

• Use 3D Secure authentication: 3D Secure is an extra layer of security that requires customers to enter passwords or codes to verify their identities when they make online purchases. This can help prevent fraudulent transactions and protect businesses from chargebacks, which occur when customers dispute charges and demand refunds from the business.

• Train employees on fraud prevention: Businesses should train employees to recognize the signs of fraud, such as unusual customer behavior and suspicious transactions. Employees should also know how to report and respond to suspected fraud incidents. This includes proper handling of personal information and secure payment processing.

• Monitor transactions for unusual patterns: If something looks odd, it’s worth digging deeper. This is a good rule when it comes to fraud detection. Businesses should monitor transactions for unusual patterns, such as multiple transactions from the same internet protocol (IP) address and multiple transactions from different cards with the same billing address, as these patterns might indicate fraudulent activity. By flagging suspicious transactions, businesses can prevent fraud before it occurs.

• Conduct background checks: A key part of preventing merchant fraud is ensuring you know exactly who’s on your team. Businesses should conduct background checks on employees and vendors to ensure they don’t have a history of fraud. This helps minimize the risk of insider fraud, which occurs when an employee or vendor intentionally commits fraud.

• Establish robust policies and procedures: Businesses should establish policies and procedures for preventing fraud. Those include guidelines for accepting credit cards, verifying identities, and handling chargebacks. Policies and procedures should be regularly reviewed and updated as needed to keep up with new fraud trends.

• Use encryption and secure data storage: Businesses should use encryption to protect customer data and secure data storage to prevent unauthorized access to sensitive information, including physical and digital storage. By safeguarding customer data, businesses can help prevent identity theft and protect their own reputations with customers.

• Stay up-to-date on fraud trends: Monitor fraud intelligence from payment networks (e.g., Visa, Mastercard) and industry bodies (e.g., the Merchant Risk Council) to stay current on emerging threat patterns. Keeping pace with developing tactics allows businesses to proactively update their fraud prevention rules and security protocols before new vulnerabilities are exploited.

How Stripe Radar can help

Stripe Radar helps detect fraud and unlock growth, using AI trained on data from Stripe’s global network. Radar helps protect your business from fraud throughout the customer lifecycle before it affects your bottom line, while helping you approve more legitimate customers and payments.

Radar can help your business:

• Prevent fraud losses: Radar’s AI learns from more than $1.9 trillion in annual transactions across Stripe’s global network, helping it identify and block fraud patterns that individual businesses might not catch on their own.

• Unify protection across evolving fraud attacks: Radar brings protection against transaction fraud, account fraud, and customer abuse all into one solution, so you gain unified protection across major fraud types.

• Adapt as fraud evolves: Radar continuously adapts to changing fraud patterns, from first-party abuse to agentic transactions, helping protect your business against emerging threats.

• Work with your existing tech stack: Use Radar with Stripe payments with no integration required, or access Radar’s intelligence through programmable application programming interfaces (APIs), whether you process payments on Stripe or not.

Learn more about Stripe Radar, or get started today.