Ecommerce Fraud Prevention for High-Risk Merchants

Ecommerce fraud prevention for a high-risk merchant works best before a dispute is filed, not after. Once a chargeback is formally recorded, it counts against the account whether the merchant wins representment or not, so the highest-leverage move is catching the transaction earlier in the process.

Why high-risk merchants see more disputes#

High-risk categories combine two dispute sources that lower-risk retail rarely sees at the same volume: genuine fraud, and "friendly fraud," where a legitimate cardholder disputes a real purchase instead of requesting a refund or canceling a subscription. Subscription and continuity billing models see this constantly. A customer forgets to cancel, doesn't recognize the billing descriptor, or simply finds disputing faster than calling support.

Visa's Acquirer Monitoring Program (VAMP) reflects exactly this, and it's worth getting the current numbers right because most of what's quoted online is out of date.

From 1 June 2025 VAMP consolidated the previous VAMP, the Visa Fraud Monitoring Program, and the Visa Dispute Monitoring Program into one global program (Visa). The VAMP ratio is count-based, not value-based: the count of fraud (TC40) plus disputes (TC15) divided by the count of settled transactions (TC05), on card-not-present volume. It excludes disputes resolved through pre-dispute solutions and fraud that qualified for Compelling Evidence 3.0.

The thresholds are published. Visa identifies an acquirer portfolio as Above Standard at 50 basis points and Excessive at 70. For merchants in the US, the Excessive threshold is 150 basis points combined with 1,500 or more fraud and dispute events in the month, and both conditions must be met. That US ratio dropped from 220 basis points on 1 April 2026.

Two practical consequences. A small merchant will rarely trip Visa's merchant test on ratio alone, because the 1,500 event floor is high. And because acquirer thresholds are far tighter than merchant ones, your processor will act on its own limits long before Visa's merchant numbers come into play. Use the VAMP calculator to estimate where you sit, and ask your acquirer what limits it applies to you.

The real scale of ecommerce fraud right now#

It's worth being honest about the numbers here, because this is a field awash in them. Published global ecommerce fraud loss totals and forward projections vary enormously between sources, and essentially all of them originate with vendors selling fraud prevention. We are not going to quote you one. What is not in dispute is the direction: card-not-present fraud has been climbing for years, and it climbs fastest in exactly the categories that struggle to get merchant accounts in the first place.

Here's the part that surprises most merchants: catching fraud aggressively isn't free either. False declines, meaning legitimate transactions blocked by an overcautious filter, are widely believed to cost retailers more than fraud itself does. The specific multiples you'll see quoted come from vendor research without disclosed methodology, so treat them with caution, but the shape of the problem is real and well understood by anyone who has tuned a rules engine. A fraud program set too tight doesn't just annoy real customers. It can quietly cost more revenue than the fraud it prevents.

The layered defense that actually works#

Fraud prevention and dispute prevention are two different problems, and a real defense addresses both. On the fraud side: 3-D Secure authentication, AVS and CVV matching, and device or velocity screening catch stolen-card transactions before they settle, without needing to decline every borderline transaction outright.

On the dispute side: a billing descriptor that clearly matches the storefront name, fast and responsive support, and a genuinely easy cancellation flow all reduce the friendly-fraud disputes that fraud tools can't catch, because the transaction itself was legitimate.

Pre-dispute alert networks like Ethoca and Verifi sit between the two. They notify the merchant when a cardholder contacts their bank about a transaction, before a formal dispute is filed, giving a window to refund and avoid a chargeback being recorded against the account at all.

Balancing fraud screening against false declines#

Given that false declines cost roughly nine times more than fraud itself, the right calibration matters more than the strictest possible filter. A 3-D Secure challenge on every single transaction, for instance, reduces fraud but also introduces friction that a real percentage of legitimate customers abandon at checkout rather than complete.

The better approach layers risk-based authentication: light-touch verification on low-risk-looking transactions, stepped-up checks (3DS challenge, manual review) only on the transactions that actually score as higher risk. That keeps the fraud-catching benefit without applying the same friction to every customer regardless of their actual risk profile.

Why device fingerprinting and ML scoring matter more each year#

The technology underneath fraud screening has shifted meaningfully in the last two years, and it's worth understanding why. Through 2025 and into 2026, the industry moved away from static, threshold-based rule engines (block any order over $X from a new device, flag any mismatched billing ZIP) toward graph-based machine learning that scores a transaction against patterns across an entire network of merchants, not just one store's own history. Rule engines catch what they were explicitly told to catch. ML scoring catches the fraud pattern nobody wrote a rule for yet, which matters because sophisticated, multi-step fraud attacks nearly tripled from 2024 to 2025, rising from 10% to 28% of all identity fraud.

Device intelligence is the other half of that shift. Fingerprinting a device, not just a card number, lets a fraud model recognize when the same physical device or browser fingerprint is being used across dozens of "different" customer identities, a pattern a card-only check can't see at all. Vendors publish volume figures for how many devices they profile; we've left those out because they're self-reported and unauditable.

None of this means a high-risk merchant needs to build ML fraud scoring in-house. Most gateway and processor-level fraud tools already include some version of device fingerprinting and behavioral scoring today. The practical takeaway is narrower: when comparing fraud tools or evaluating what a processor bundles in, device intelligence and adaptive scoring, not just static rule lists, are the baseline worth expecting in 2026, not a premium add-on.

What Authentication Actually Buys You#

One number here is worth having because it comes from a card network rather than a fraud vendor. Visa reports that transactions authenticated through Visa Secure show roughly a 45% reduction in fraud, at 11 basis points against 20 basis points for non-authenticated e-commerce, alongside a 9% lift in authorization approval rates (Visa).

That's Visa reporting on Visa's own product, so read it with that in mind. It is still network-published rather than marketing from a company selling you a subscription, and the direction matches the underlying logic: an authenticated transaction carries less risk than an unauthenticated one. See 3D Secure for when the checkout friction is worth it.

When a dispute is filed anyway#

Representment under card network dispute rules comes down to documentation: proof of delivery, a clear billing descriptor matching what the customer saw at checkout, and, for subscriptions, proof that cancellation terms were disclosed and honored. The dispute reason codes tool breaks down what each specific reason code actually requires to fight successfully.