Ecommerce fraud: the eight types you'll actually see, and what prevents them

What fraud actually looks like in ecommerce

Most store owners think about fraud wrong. They imagine hackers stealing card numbers. In reality, most fraud is mundane: a legitimate customer disputing a real charge, a bot testing stolen cards on your checkout at 3am, or a "customer" who ordered, received, and then claimed they never did.

Fraud losses in ecommerce run around 2-3% of revenue for stores that don't pay attention, under 0.3% for stores that do. The difference is almost entirely preventable with the right defaults enabled.

Here are the eight you'll actually see.

Friendly fraud (chargebacks)

The most common and most expensive. A real customer buys something, receives it, then disputes the charge with their bank. Sometimes because they forgot they bought it. Sometimes because a family member used the card. Sometimes because they want the item and their money back.

Volume: typically 60-80% of all chargebacks you'll receive are "friendly" rather than actual fraud.

Detection: you don't detect it until the chargeback arrives. By then you've already shipped.

Prevention:

• Clear statement descriptor. Use your brand name, not "ECOM123". Customers dispute things they don't recognise.
• Order confirmation emails with product images. Reinforces the purchase memory.
• Delivery confirmation. Signature-required shipping for high-value orders.
• Response to disputes. Upload shipping proof, tracking, customer communication. You win most "item not received" disputes with this evidence.

Card testing / BIN attacks

Bots try stolen card numbers on your checkout to find which ones still work. They usually buy a cheap item ($1-5), see if the charge clears, then either charge more on your store or move the "verified" card elsewhere.

Detection: a burst of small-value orders from similar IPs, often with throwaway email addresses and billing/shipping mismatch.

Prevention:

• Enable Stripe Radar. On by default; blocks the obvious attacks.
• Rate-limit your checkout. Shoprocket throttles repeated attempts from the same IP automatically.
• Require CVV and address verification. Both are on by default; keep them on.
• Watch for a spike. If you see 200 $1 orders in an hour, that's an attack, not a viral moment.

Account takeover

An attacker gets into a legitimate customer's account (via credential stuffing or phishing) and orders using their saved cards and address.

Detection: login from a new country or device, order shipping to a new address, password changed recently.

Prevention:

• Require email confirmation for shipping address changes.
• Offer 2FA for customer accounts on high-value categories.
• Log and alert on suspicious logins. Shoprocket flags logins from new devices for the account owner.
• Don't store full card numbers. Stripe tokenises them; your database never sees the PAN.

Refund fraud

The customer receives the item, claims it never arrived or arrived damaged, and asks for a refund. If you refund without proof, they keep both the item and the money.

Detection: repeated "item not received" claims from the same customer or shipping address. Claims that conflict with courier tracking.

Prevention:

• Always check tracking before refunding. If it shows delivered, push back or require proof.
• Signature-required shipping over a threshold amount.
• Flag serial refunders. Customers with more than 2 refund claims in 12 months go to manual review.
• Photo evidence for "damaged" claims. Cheap ask; cuts fraudulent damage claims by a lot.

Triangulation fraud

The attacker sets up a fake storefront (often on a marketplace), takes your customer's real order and payment, then buys the item from your real store using a stolen card, shipping to your customer. Your customer gets the item and doesn't know anything's wrong. When the stolen card is reported, you're the merchant on the hook.

Detection: orders where the shipping name doesn't match the cardholder name, shipping address in a different country from billing, multiple orders to the same address with different cards.

Prevention:

• Stripe Radar flags shipping/billing mismatch automatically.
• Verify unusually large orders. A quick email or call to the cardholder.
• High-risk categories (electronics, gift cards, luxury) warrant manual review on first-time orders above a threshold.

Identity theft

An attacker uses a stolen identity (not just a stolen card) to open a customer account, pass verification, and order. Rarer than card theft but harder to catch when it happens.

Detection: new account with high-value first order. Mismatch between provided identity details and address.

Prevention:

• Address verification on payment (on by default in Stripe).
• Manual review for first-order high-value transactions.
• Identity verification services (Stripe Identity, Onfido) for categories where it's worth the friction (firearms, age-restricted, high-ticket).

Interception fraud

The attacker uses a stolen card to order to a legitimate billing address, then intercepts the package in transit (redirects it via the courier's app, or picks it up from the doorstep).

Detection: customer calls to "update shipping address" after placing the order. Multiple courier redirect requests.

Prevention:

• Lock shipping addresses once an order is placed. Changes require verification.
• Signature-required delivery for higher-value orders.
• Don't honour "redirect my order" emails without verifying the sender.

Affiliate / referral fraud

Affiliates (or fake affiliates) generate fake orders to earn commission, or use cookie stuffing to claim credit for sales they didn't drive. Only relevant if you run an affiliate programme, but common at scale.

Detection: affiliate whose orders have abnormal refund rates, similar IPs across "different customers", or conversion rates that are too good to be true.

Prevention:

• Delay affiliate payouts (30-60 days after order) so chargebacks can surface.
• Cap commission per affiliate while they're new.
• Review top affiliates' order patterns regularly.

What Shoprocket handles for you

Stripe Radar + Shoprocket's own checks cover most of the above without you doing anything:

• Card testing: rate limiting + Radar's bot detection
• CVV + AVS: enforced on every transaction
• Chargeback evidence: we surface the order, shipment, and customer communication in the dashboard, packaged for Stripe disputes
• Address verification mismatch: Radar flags
• Velocity / burst detection: Radar's machine learning model
• 3D Secure: automatically triggered on high-risk transactions

What you still have to do:

• Set a clear statement descriptor (biggest win)
• Respond to chargebacks within Stripe's 7-10 day window
• Manually review flagged orders before shipping
• Keep tracking and delivery proof for your records

<!-- EXAMPLE ONLY. Grab your real snippet from Sales channels → Embeds in your dashboard -->
<script src="https://cdn.shoprocket.io/loader.js" data-pk="pk_yourkey"></script>
<div data-shoprocket="catalog" data-embed-id="emb_xxx"></div>

The realistic fraud rate

For most stores that enable the defaults:

• Card fraud (actual stolen cards): under 0.1% of orders
• Chargebacks: 0.1-0.5% of orders (most of which are friendly)
• Refund abuse: 0.5-2% of orders depending on category

Your biggest spend isn't preventing 0.05% of fraud losses. It's writing clear statement descriptors, responding to disputes, and adding signature-required shipping above a threshold. The ROI on that is immediate.

Tip: If you're running a new store, leave Stripe Radar's default rules on for the first 3 months while you build order history. Radar's machine learning gets smarter the more transactions you process, so don't bypass it early.

When to invest more

If you're in a high-fraud category (electronics over $500, luxury, gift cards, high-ticket digital goods, CBD, firearms, supplements), pay attention to:

• Stripe Radar custom rules for your category (flag orders over $X, require 3DS, block specific regions)
• Manual review queue for first-time customers
• Identity verification on registration (not just payment)
• Lower chargeback thresholds. Stripe cuts you off above 1% chargeback rate; high-fraud stores often sit at 0.5-0.8% and need to actively manage

Lower-fraud categories (apparel, home goods, food, most subscriptions) can run on defaults and be fine.

TL;DR

• Friendly fraud (chargebacks) is the biggest category. Clear statement descriptor + delivery proof + dispute responses win most of them
• Card testing attacks happen to every store eventually. Rate limiting + Stripe Radar catches them
• Most fraud prevention is default-on if you use Stripe through Shoprocket. Don't turn things off
• Chargebacks under 1% is the Stripe threshold. Most legitimate stores run at 0.1-0.3%
• Investment scales with category risk. High-ticket / high-fraud categories warrant manual review + custom rules; most stores don't need either

Start a free trial and Stripe Radar + fraud prevention is on from day one. 14 days, no card.