Also called: Card blacklist, Merchant Fraud list, Payment fraud blacklist
What a fraud blacklist is
A fraud blacklist is a list of details linked to suspected or confirmed fraud. For an online order, those details could include an email address, IP address, card number, name, phone number, or shipping address. A BIN, the first six digits of a card number, can also be used to match cards from a particular issuer.
When a new payment or order matches a listed detail, your configured rules determine what happens. A rule can block the payment or send it for review. Adding an entry to a list by itself does not ensure a payment will be blocked; the matching rule must be set up too.
A blacklist can stop a repeat match, but a shared or outdated detail can block a legitimate customer.
How a blacklist works with fraud detection
You add an identifier after a suspicious order or confirmed fraud, then your payment system compares later transactions against the list. For example, you could flag an email address tied to a fraudulent order and send a later order using that address to manual review instead of rejecting it automatically.
A blacklist is one specific control within fraud detection. Fraud detection can assess multiple signals for each transaction, while a blacklist checks for matches against details you have already listed. A blacklist does not prove that a new order is fraudulent, and a fraudster can avoid a simple match by changing an email address or other detail.
The cost of blocking the wrong order
A blacklist can help prevent another order tied to known fraud, reducing the chance of losing the sale amount, merchandise, or a chargeback fee. It does not guarantee that every listed match is fraudulent or prevent fraud using different details.
Shared details create false declines. For example, blocking a shipping address after one fraudulent order can affect other people at the same apartment building or university dorm. A blacklist is not a card-network fee or a standard line on your processing statement; any charge for a fraud tool is a separate service charge.
What you can actually change
You control what goes on your list, how long entries stay there, and whether a match is blocked or reviewed. A narrow, regularly checked list is less likely to reject legitimate customers because they share an address, device, or other detail.
- Add specific identifiers tied to confirmed fraud, rather than blocking a broad location or customer group.
- Send uncertain matches to manual review instead of automatically declining them.
- Review and remove stale entries, including IP addresses that may have changed users.
- Use blacklist matches alongside other fraud checks, such as device details and transaction behavior.
- Narrow each entry. Record the specific detail tied to a fraudulent order and avoid blocking a whole address range or customer group.
- Choose review carefully. Set a manual review path for matches that do not establish fraud on their own, such as a shared shipping address.
- Clean the list regularly. Remove details that are no longer reliable, especially IP addresses that may have been reassigned.
Frequently asked questions
What information can go on a fraud blacklist?
A list can use details such as an email address, IP address, name, phone number, card number, or shipping address. Some systems also match a BIN, the first six digits of a card number. The details and matching options depend on the fraud tools your business uses.
Can a fraud blacklist block legitimate customers?
Yes. People can share an address, device, or public IP address, so a match does not prove that an order is fraudulent. Send uncertain matches to review and remove entries when the detail is no longer reliable.
Is a fraud blacklist the same as fraud detection?
No. A blacklist checks whether transaction details match entries you have already listed. Fraud detection is broader and can assess multiple signals, such as device details and transaction behavior, for a new order.