Websites & online business
How small online stores can reduce fraud and chargebacks
When a stolen card is used in your online store, you usually lose the goods, the payment and a chargeback fee. Small stores are attractive because they often have fewer checks. Your payment provider does much of the heavy lifting, but a few settings and habits make a real difference.
The short version
The essentials
- Turn on 3-D Secure and your provider’s fraud screening.
- Hold and check orders with several warning signs.
- Keep records of delivery and customer contact.
- Protect your store and payment accounts with MFA.
Warning signs of a fraudulent order
No single sign proves fraud, but several together should make you pause.
- Shipping address very different from the billing address, or to a parcel locker or freight forwarder
- Unusually large orders, or many units of the same high-value item
- Several orders from the same person with different cards
- Express shipping on a large order from a first-time customer
- Email addresses that look random or don’t match the name
- Many failed payment attempts before one succeeds
- Requests to change the delivery address after the order is placed
Use your payment provider’s protections
| Setting | What it does |
|---|---|
| 3-D Secure (such as Visa Secure or Mastercard Identity Check) | Asks the cardholder to confirm the payment with their bank, and often shifts fraud liability away from you |
| Fraud screening (Stripe Radar, Shopify fraud analysis, Square risk tools) | Scores orders and can block or flag risky ones automatically |
| CVC and address checks | Rejects payments with missing or wrong card details |
| Rate limits or bot protection on checkout | Stops automated “card testing” attacks |
Check which of these your platform offers and turn them on.
Card testing attacks
Criminals sometimes use small stores to test thousands of stolen cards with tiny purchases. You’ll see a flood of small, failed or successful payments. Turn on bot protection or CAPTCHA at checkout, contact your payment provider, and refund any that went through.
Before you ship a risky order
- Contact the customer using the details they provided and ask a simple question about the order.
- Check the order in your fraud tool’s risk score and notes.
- If in doubt, cancel and refund. Losing one sale is cheaper than losing the goods and paying a chargeback fee.
- Never ship to a different address than the one on the order because someone asked by email.
Handling chargebacks
A chargeback happens when a cardholder disputes a payment with their bank.
Respond on time
Your payment provider will set a deadline. Missing it usually means you lose automatically.
Provide evidence
Order details, delivery tracking with signature or photo, customer emails, and proof the customer used the product or service.
Learn from it
If chargebacks come from a particular product, shipping method or region, adjust your checks.
Protect the store itself
- Turn on MFA for your store admin, payment provider and email.
- Give staff their own logins with limited permissions.
- Watch for changes to your payout bank details, a favourite target for attackers.
- Follow our website security checklist.
Common questions
If the payment was approved, aren’t I protected?
Not necessarily. An approved payment can still be disputed later. 3-D Secure gives the strongest protection.
Should I refund or fight a fraud chargeback?
If the card was genuinely stolen, fighting usually fails. Focus on preventing the next one. Fight chargebacks where you have strong evidence the customer received what they ordered.
Does a high fraud score mean I must cancel?
It means look closer. Use it with the warning signs above and your own knowledge of your customers.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.