Ecommerce fraud prevention: how to stop chargebacks and friendly fraud without losing good customers

Fraud is a quiet cost of selling online. It rarely arrives as one dramatic attack. It shows up as a chargeback for an order shipped weeks ago, a customer who swears the parcel never came, a dress returned after a wedding, or a newsletter coupon shared on a deal forum.

For a small or mid-size store, ecommerce fraud prevention does not mean stopping every bad order at any price. Blocking too hard turns away honest customers, and false declines can hurt more than fraud itself. The goal is a sensible system: know the fraud types you face, notice warning signs, review risky orders calmly, collect evidence routinely and keep checkout smooth for the buyers who are exactly who they say they are.

The main types of ecommerce fraud

Card-not-present fraud

Online orders are card-not-present (CNP) transactions. A fraudster with stolen card details places an order, the real cardholder disputes the charge, and the bank pulls the money back. You lose the product, the shipping and usually a chargeback fee.

Chargebacks and friendly fraud

A chargeback is a reversal the cardholder starts through their bank rather than through you. Some are legitimate. Others are friendly fraud (first-party misuse): a real customer received the order but disputes it anyway. Sometimes that is deliberate; often the customer does not recognize your name on the statement, or a teenager used a parent's card.

"I didn't receive it": porch piracy vs. false claims

In the US especially, parcels left on doorsteps do get stolen. So an "item not received" claim can come from an honest victim, from someone who did receive the parcel, or from a carrier mistake. You cannot tell which from the claim alone, which is why tracking and proof of delivery matter.

Refund and return abuse

This covers wardrobing (wearing an item for an event and returning it), sending back a different or damaged item, claiming an empty box arrived, and serial returners. Our guide on how to reduce ecommerce returns covers the honest side of returns; this is the abusive edge.

Account takeover

Someone logs in to a real customer's account, often with a password leaked elsewhere, and uses saved addresses, store credit or loyalty points. The customer then blames you.

Promo abuse and card testing

Public codes leak to coupon sites, "first order" offers are claimed again with new email addresses, and referral rewards are farmed with fake accounts. Separately, fraudsters sometimes use small checkouts to see whether stolen cards still work, leaving bursts of failed or tiny payments. If you notice that pattern, tell your payment provider straight away.

Scams that use your brand

Some fraud targets your customers: phishing emails posing as your store or a carrier ("your parcel is held, pay a small fee") and fake shops copying your name and product photos.

Warning signs in an order

No single detail proves fraud. These signals deserve a closer look, especially when several appear together:

• Mismatched details: billing and shipping addresses far apart, or a name that does not match the email or cardholder.
• Unusual quantities: several units of one high-value item when customers normally buy one.
• Rushed shipping on a high-value order, chosen with little interest in price.
• Many failed payment attempts before one succeeds, possibly with different cards.
• A brand-new account with a high-value first order.
• Freight forwarders where you do not normally ship abroad.
• Address change requests after dispatch.

A manual review routine for risky orders

Small stores do not need a fraud team; they need a few written steps anyone can follow.

If something still looks odd, a friendly message usually settles it: "Thanks for your order! Before we ship, could you confirm the delivery address?" Genuine customers reply quickly; fraudsters tend to go quiet or push for speed. Use the email or phone already on the order, never a new number from someone pressuring you, and never ask for card details.

If you decide not to ship, cancel and refund the original payment. Do not ship "just in case": a shipped fraudulent order costs you the goods and the chargeback.

Payment-side protections: SCA, 3-D Secure and your provider

Your payment provider is your strongest ally. Most offer fraud screening, address and security code checks and authentication. Learn what yours provides and switch on what fits.

3-D Secure adds a step, usually an approval in the banking app, so the cardholder confirms the purchase with their bank. When a payment is authenticated this way, liability for some fraud disputes can shift away from you, depending on provider and card network rules.

• UK and Europe: Strong Customer Authentication (SCA) is a regulatory requirement for many online card payments, so British shoppers are used to approving purchases in their banking app. Some low-risk payments are exempt, as applied by your provider.
• US: there is no equivalent blanket mandate. 3-D Secure is optional, and many US checkouts rely on the provider's risk screening, adding authentication selectively.

Shipping-side protections

Many disputes are really delivery disputes. Our ecommerce shipping guide covers carriers in depth; for fraud, focus on these:

• Always ship with tracking and keep the record with the order.
• Require a signature for higher-value orders, or offer lockers and pickup points instead of the porch.
• Do not change the delivery address after dispatch. Cancel and reship instead.
• Send shipped, out-for-delivery and delivered notifications. A customer who sees "delivered, left with neighbor" is less likely to call the bank.
• Photograph high-value parcels before dispatch to answer "empty box" claims.

How to prevent chargebacks: policies and dispute evidence

Chargebacks are won or lost long before the notice arrives. The best way to prevent chargebacks is to remove the reasons customers go to their bank first.

When a dispute arrives, respond within your provider's deadline with focused evidence: the order confirmation, tracking and proof of delivery, the product page and policy as they were at purchase, and relevant customer messages.

For refund abuse, fair rules help without punishing everyone: attached tags or hygiene seals, a clear return window, inspection before refund and exchanges as an option. Note repeated unusual returns and decide case by case.

Account and team security

If someone takes over your store admin or email, they can change payout details, issue refunds or phish from your domain.

• Turn on two-factor authentication (2FA) for every admin and staff account, and for the email that controls your store.
• Use least-privilege roles: not everyone needs to issue refunds, create discounts or export customer data.
• Remove access promptly when someone leaves.
• Train for phishing: log in through your own bookmark, never through a link in an "account suspended" email.
• Protect customers: encourage strong passwords and notify them of new logins or address changes.

Protecting customers from scams using your brand

• Publish a short "how we contact you" page: your email domain, that you never ask for card details by message, and what real tracking links look like.
• Send messages from consistent, recognizable senders.
• Report fake shops and lookalike domains to the host, registrar and ad platform.
• When a phishing wave hits, warn customers and give support a ready answer.

Balancing friction and conversion

Every check has a cost. Authenticate every payment and some honest buyers drop out; cancel every unusual order and you lose people who simply sent a gift.

Every few months, review which cancelled orders were probably genuine and which disputes you lost, and adjust.

Common fraud prevention mistakes

• Relying on one signal, such as cancelling every order with different addresses.
• Shipping first and asking later on orders that needed review.
• Publishing generic discount codes that end up on coupon sites.
• Sharing one admin login without 2FA.
• Believing any tool or provider guarantees zero fraud. Tools reduce risk; they do not remove it.

Hypothetical example: a UK fashion boutique gets disputes under control

This is a hypothetical example with no real figures. A small online fashion boutique ships across the UK and sometimes to the US. One season it sees more "not received" disputes, dresses returned visibly worn and a public welcome code used far beyond new customers.

1. Billing name: it asks the payment provider to make the shop's name clearly recognizable on statements.
2. Payments: it keeps strong authentication on, as UK buyers expect, and enables the provider's risk checks for US orders.
3. Delivery: higher-value orders ship with a signature or to lockers, with delivery notifications on every order.
4. Review: orders with stacked signals are held and confirmed by message before dispatch.
5. Returns: dresses carry a return tag that must stay attached, explained before checkout.
6. Promotions: the public code is replaced with single-use codes after newsletter sign-up.
7. Team: staff accounts move to 2FA and separate roles.

The lesson: no single fix solved it. Modest changes across payment, delivery, policy and promotions closed the openings while honest customers barely noticed.

Fraud prevention with Shopiyz

Shopiyz is a hosted platform, so servers, security and updates are handled for you. It cannot promise zero fraud, but it gives you a solid foundation for the routine above:

• Platform security: automatic 256-bit SSL/TLS on connected domains, checkout data encrypted end to end, continuous monitoring for suspicious access attempts, independent penetration tests, DDoS protection, encrypted backups and security event notifications. See security.
• Payments: the payment infrastructure works with PCI DSS-certified integration partners, and card details are never stored on Shopiyz servers. 3-D Secure is provided by your payment provider. Offer Stripe, PayPal, Apple Pay, Klarna in the UK and 30+ methods with your own merchant agreement.
• Team access: role-based access and 2FA for admin accounts; you decide what each employee sees and whether they can apply discounts or process returns.
• Confirmation and delivery messages: automated workflows send order confirmations and shipping updates by email, SMS or WhatsApp.
• Safer promotions: single-use coupon codes and personalized offers through smart popups.
• One order view: central order management for your store and marketplaces.

Comparing options? Our guide on how to choose an ecommerce platform covers what to ask about security and payments. See the plans or talk to us.