Also called: Fraudulent transaction, Unauthorized transaction
What fraud is
Payment fraud is activity that uses stolen payment information, a compromised account, or deception to obtain money, goods, or services without proper authorization. In an online sale, someone could use stolen card details, take over a customer account, or use automated bots to test card numbers. A real customer’s account history does not prove that the person placing the order is the account owner.
Fraud does not always mean a stranger stole a card. A customer who received an order and then disputes the charge is sometimes described as friendly fraud. Scams aimed at your business also count as a risk: a fake check can appear cleared before the bank discovers it is invalid, leaving you responsible for money you sent back.
Fraud costs more than the disputed sale: you can lose the goods, pay a fee, and lose the next legitimate customer to a false decline.
How fraud affects your business
A fraudulent order can cost you the sale, the goods, and the shipping expense. If the cardholder disputes the charge, you face a chargeback and a separate chargeback fee. For example, an illustrative $120 order with $70 in goods and $8 in shipping leaves those costs at risk if the payment is reversed and the goods cannot be recovered.
Card testing creates a different bill. Attackers submit repeated small authorization attempts to find working card numbers, and you absorb authorization fees for those attempts. A wave of declines can also block real customers. That false-decline risk matters because a strict filter that stops fraud but rejects legitimate orders still costs you revenue.
Under Visa and Mastercard rules, cardholders generally have 120 calendar days to dispute a transaction, with outer limits up to 540 days for some delayed-delivery cases. Your response deadline is set by your processor and is often 20 to 30 days. Miss that window and you lose the chance to present evidence.
Illustrative cost of a disputed order
| Order value | $120 |
|---|---|
| Goods cost | $70 |
| Shipping cost | $8 |
Illustrative figures only. A fraud dispute can put the sale, goods, shipping, and a separate chargeback fee at risk.
Where the losses build
There is no single standard fraud fee. Your direct exposure comes from lost inventory or services, chargebacks, their fees, and the staff time spent reviewing orders and answering disputes. Repeated fraud disputes also put your processing relationship at risk.
As of 2026, Visa’s Acquirer Monitoring Program (VAMP) counts TC40 fraud reports and TC15 disputes against settled card-not-present transactions. For US merchants, the Excessive threshold is 1.5% and at least 1,500 fraud reports plus disputes in a month, effective April 1, 2026. Crossing monitoring thresholds can trigger added scrutiny and pressure to reduce fraud and disputes.
What you can actually change
- Review risky orders. Use order value, device and location signals, and repeated attempts to route suspicious purchases for review before fulfillment. Set rules that flag unusual activity without automatically rejecting every order that differs from your normal pattern.
- Limit card testing. Set velocity controls for repeated attempts and use bot protections at checkout. Review authorization declines and fees for sudden spikes that point to testing activity.
- Meet dispute deadlines. Keep order records, delivery confirmation, customer communications, and refund details together. Record each chargeback deadline when it arrives, then submit relevant evidence before your processor’s response window closes.
- Track false declines. Review declined orders against later customer contacts and completed sales. Adjust filters that repeatedly block legitimate customers, and monitor fraud reports and disputes against your card-not-present volume.
Frequently asked questions
What counts as a fraudulent transaction?
A transaction is fraudulent when someone uses payment information, an account, or deceptive tactics to obtain money, goods, or services without proper authorization. Stolen card details and account takeover are examples. A customer disputing a purchase they received is often called friendly fraud.
Does fraud always appear as a line on my processing statement?
No. There is no universal statement line called “fraud.” Look for the transaction reversal or chargeback, any separate chargeback fee, and unusual authorization fees during a card-testing spike. Line descriptions depend on your processor.
How long do I have to respond to a card fraud dispute?
Under Visa and Mastercard rules, cardholders generally have 120 calendar days to dispute, with longer outer limits for some delayed-delivery cases. Your processor sets your response deadline, often 20 to 30 days. Use the deadline shown in the dispute notice.
Can fraud controls hurt sales?
Yes. A filter that rejects legitimate customers creates false declines and lost sales. Review rejected orders and decline patterns, then adjust rules that block good customers without reducing fraud or disputes.