Clean Fraud

What clean fraud is

Clean fraud is an unauthorized card purchase made with stolen payment and personal details. The order appears ordinary, and routine checks such as a matching billing address or correct card security code can pass. The word “clean” describes how convincing the transaction looks, not whether it is authorized.

It occurs in card-not-present sales, including ecommerce, phone and in-app orders. A payment approval confirms that the issuer approved the transaction, but it does not prove the person placing the order is the cardholder. Clean fraud is an operational description, not a separate card-network reason code.

A passed address or card security code check is evidence about the details, not proof of who placed the order.

How it affects your business

A criminal places an order using someone else’s card details, and you may release the goods before the real cardholder notices the charge. When the cardholder disputes it, you face the merchandise loss and a chargeback process. A successful address or card security code check does not settle who placed the order.

The gap between purchase and dispute complicates tracking. For example, a sale recorded this month can become a chargeback weeks later, so the loss appears in a different reporting period from the original revenue. As of 2026, Visa and Mastercard cardholders generally have 120 calendar days to dispute, with outer limits up to 540 days for some delayed-delivery cases. Merchant response windows are often 20 to 30 days, set by the processor.

Why routine checks miss it

Address Verification Service (AVS) checks whether billing address details match issuer records, and a card security code check tests the submitted code. A criminal using accurate stolen details can pass both. Those results are useful signals, but neither verifies the person holding the device or placing the order.

Adding checks based on more transaction fields does not automatically solve the problem. Attackers can use convincing details, while extra friction can block legitimate customers. Clean fraud also differs from friendly fraud, where the real cardholder disputes a purchase, and card testing, which involves attempts to validate card details. A dispute record alone does not always establish which situation occurred.

What it means for your costs

There is no clean-fraud fee or dedicated clean-fraud line on your merchant statement. The financial hit comes from the disputed sale: lost goods or services, the transaction amount, and any chargeback fee your processor applies. The research does not establish a standard fee amount, so compare the actual chargeback fee on your statement rather than assuming a fixed price.

Track confirmed unauthorized transactions separately from unresolved disputes. That distinction matters because chargeback reason codes do not prove that a transaction was clean fraud. If you group every disputed sale as confirmed fraud, you can overstate fraud losses and make poor decisions about which orders to review.

What you can actually change

1. 01
   Review the full order. Before releasing a higher-risk order, consider account history, changes to contact or delivery details, and payment risk results together. Do not treat one matching field as proof of identity.
2. 02
   Tie review to fulfillment. Give a named staff member responsibility for unresolved orders and set an internal deadline before shipment or pickup. Record the reason for the decision and any exception.
3. 03
   Keep useful records. Preserve order, account, customer communication, and fulfillment records. Never retain a card security code after authorization; keep the check result instead.
4. 04
   Measure delayed losses. Compare confirmed unauthorized transactions, chargebacks, review time, cancellations, and legitimate orders declined. Allow time for disputes to arrive before judging whether a change helped.

Frequently asked questions