Also called: CNP fraud, M-commerce fraud, Mobile app fraud, Online payment fraud
What e-commerce fraud is
E-commerce fraud is deception involving an online sale, account, or payment. The goal is to obtain money, goods, or sensitive information. Most payment fraud in online stores occurs in card-not-present transactions, where the customer does not present a physical card.
A stolen card number is one route. Other cases involve a taken-over customer account, a fake identity, or a buyer who receives an order and later disputes the payment. That last pattern is called friendly fraud, and it does not always involve deliberate criminal intent.
A fraudulent order can cost you the goods, the sale, and the time needed to contest the dispute.
How online fraud happens
Fraudsters use stolen credentials to place orders or take over accounts, then change the shipping address or use a stored payment method. Card-testing bots submit repeated small transactions to find valid card details before attempting larger purchases.
Some attacks target the checkout itself. Malicious scripts added to a payment page can capture entered card details. Fake storefronts, phishing messages, and manipulated refunds or returns also put your money and customer information at risk.
Illustrative cost of a disputed order
| Order amount | $100 |
|---|---|
| Merchandise cost | $60 |
| Potential loss if dispute is lost | $160, before shipping, staff time, or dispute fee |
Illustrative figures only. The example assumes the order is not refunded and the merchant loses the dispute.
What it costs your business
A disputed fraudulent order can leave you without the merchandise and the sale revenue. You also spend time assembling order, delivery, and customer records to answer a chargeback, and your processor may charge a separate dispute fee. The research notes do not establish a standard fraud fee or statement descriptor.
For example, in an illustrative $100 order with $60 in merchandise cost, a lost dispute could mean losing the $100 sale and the $60 goods, before shipping, staff time, or any dispute fee. A false alarm has a cost too: declining a real customer's order means a lost sale.
Where it shows up in your records
There is no universal statement line named “e-commerce fraud.” Look for chargeback or dispute entries, their associated fees, and whether the underlying order was refunded or reversed. Compare those records with your order and delivery history to separate confirmed fraud from customer disputes and mistaken declines.
Under Visa and Mastercard rules, cardholders generally have 120 calendar days from the transaction or expected delivery date to dispute a charge. Keep order details, delivery confirmation, and customer communications organized so you can respond within the deadline in your processor's notice.
What you can actually change
- Add checkout checks. Use AVS and card security code checks, then add 3-D Secure where it fits your checkout. Treat a billing and shipping mismatch as a risk signal, not automatic proof of fraud.
- Review unusual orders. Flag repeated orders in a short period, unfamiliar devices, and unusually large purchases for review. Recheck your rules as order patterns change so legitimate customers are not blocked unnecessarily.
- Protect the payment page. Limit access to your store and checkout tools, keep software updated, and review payment-page scripts for unauthorized changes. PCI DSS v4.0.1 is the current standard; its future-dated requirements became mandatory on March 31, 2025.
- Keep dispute evidence. Save the order confirmation, delivery proof, customer messages, and refund records together. Respond by the deadline in each dispute notice, since your response window is set by your processor.
Frequently asked questions
Is every online chargeback e-commerce fraud?
No. A chargeback can follow stolen payment details, a delivery problem, or a customer's confusion about a purchase. Friendly fraud describes a legitimate customer disputing a transaction, sometimes without criminal intent. Review the order and customer records before classifying the event.
Does e-commerce fraud have a standard fee on my statement?
No standard statement line or universal fraud fee is identified for e-commerce fraud. Look for individual dispute or chargeback entries and their fees, then match them to the affected orders. Your statement may not explain whether a dispute was caused by fraud.
How long do customers have to dispute an online card purchase?
Under Visa and Mastercard rules, cardholders generally have 120 calendar days from the transaction or expected delivery date. Some delayed-delivery cases have outer limits up to 540 days. Your response deadline as a merchant is separate and appears in the dispute notice.
Does 3-D Secure prevent all e-commerce fraud?
No. 3-D Secure adds an issuer authentication step and can shift liability for some chargebacks after successful authentication, but it does not stop account takeover, refund abuse, or every fraudulent order. Use it alongside order review, checkout security, and dispute evidence.