Why it is called online payment fraud
Online payment fraud is a plain-language label for deception connected with a digital payment, such as unauthorized use of payment details or a fraudulent online order. Businesses use the phrase in discussions of online sales, payment security, and customer disputes.
The terms online payment fraud and e-commerce fraud overlap and are used as names for the same subject. Online payment fraud puts the payment transaction in focus, while e-commerce fraud can also refer to abuse involving online orders or customer accounts. The phrase does not identify a specific fraud method or a separate card fee.
You might see suspected transactions in a payment risk report, while a cardholder dispute arrives as a chargeback notice. As of 2026, cardholders generally have 120 calendar days to dispute a transaction under Visa and Mastercard rules. The rest of this page explains the primary term, e-commerce fraud.
What e-commerce fraud is
E-commerce fraud is deception involving an online sale, account, or payment. The goal is to obtain money, goods, or sensitive information. Most payment fraud in online stores occurs in card-not-present transactions, where the customer does not present a physical card.
A stolen card number is one route. Other cases involve a taken-over customer account, a fake identity, or a buyer who receives an order and later disputes the payment. That last pattern is called friendly fraud, and it does not always involve deliberate criminal intent.
A fraudulent order can cost you the goods, the sale, and the time needed to contest the dispute.
How online fraud happens
Fraudsters use stolen credentials to place orders or take over accounts, then change the shipping address or use a stored payment method. Card-testing bots submit repeated small transactions to find valid card details before attempting larger purchases.
Some attacks target the checkout itself. Malicious scripts added to a payment page can capture entered card details. Fake storefronts, phishing messages, and manipulated refunds or returns also put your money and customer information at risk.
Illustrative cost of a disputed order
| Order amount | $100 |
|---|---|
| Merchandise cost | $60 |
| Potential loss if dispute is lost | $160, before shipping, staff time, or dispute fee |
Illustrative figures only. The example assumes the order is not refunded and the merchant loses the dispute.
What it costs your business
A disputed fraudulent order can leave you without the merchandise and the sale revenue. You also spend time assembling order, delivery, and customer records to answer a chargeback, and your processor may charge a separate dispute fee. The research notes do not establish a standard fraud fee or statement descriptor.
For example, in an illustrative $100 order with $60 in merchandise cost, a lost dispute could mean losing the $100 sale and the $60 goods, before shipping, staff time, or any dispute fee. A false alarm has a cost too: declining a real customer's order means a lost sale.
Where it shows up in your records
There is no universal statement line named “e-commerce fraud.” Look for chargeback or dispute entries, their associated fees, and whether the underlying order was refunded or reversed. Compare those records with your order and delivery history to separate confirmed fraud from customer disputes and mistaken declines.
Under Visa and Mastercard rules, cardholders generally have 120 calendar days from the transaction or expected delivery date to dispute a charge. Keep order details, delivery confirmation, and customer communications organized so you can respond within the deadline in your processor's notice.
What you can actually change
- Add checkout checks. Use AVS and card security code checks, then add 3-D Secure where it fits your checkout. Treat a billing and shipping mismatch as a risk signal, not automatic proof of fraud.
- Review unusual orders. Flag repeated orders in a short period, unfamiliar devices, and unusually large purchases for review. Recheck your rules as order patterns change so legitimate customers are not blocked unnecessarily.
- Protect the payment page. Limit access to your store and checkout tools, keep software updated, and review payment-page scripts for unauthorized changes. PCI DSS v4.0.1 is the current standard; its future-dated requirements became mandatory on March 31, 2025.
- Keep dispute evidence. Save the order confirmation, delivery proof, customer messages, and refund records together. Respond by the deadline in each dispute notice, since your response window is set by your processor.
Frequently asked questions
Is online payment fraud the same as e-commerce fraud?
Yes. Online payment fraud is another name for e-commerce fraud, though it emphasizes the payment transaction. E-commerce fraud can also include abuse involving online orders or customer accounts.
Does online payment fraud mean someone used a stolen card?
Not necessarily. The phrase covers fraud connected with online payments, including unauthorized use of payment details and fraudulent orders.
Will online payment fraud appear as a fee on my statement?
The phrase itself does not name a standard card fee. Look for chargeback notices and separately itemized fees rather than expecting a line called online payment fraud.