The numbers around online fraud have stopped being shocking and started being routine, which is its own kind of warning. Juniper Research expects online payment fraud to drain more than $362 billion from the global economy across five years, with merchant losses heading past $90 billion a year by 2028. If you sell online, a slice of that is aimed at you.
But that’s precisely what the majority of fraud guides completely miss. You can do it all on the payments side (screening, blocking the bots, winning your chargebacks etc) and still get hit from a direction you weren’t looking. Imagine waking up to a perfect pixel for your own store, running ads under your own brand name, taking all the card details from your customers and shipping absolutely nothing. Every one of those furious victims will jump on you and blame you, not the other person who has created the clone. Your payment defences are completely useless in that scenario as the fraud wasn’t directed at your checkout. It was directed at your identity.
This guide covers the whole picture: what e-commerce fraud actually is, why it keeps growing, who’s most exposed, the main types and their warning signs, what it costs, and how to build a defence that covers both directions it comes from. Because fraud comes at an online business two ways, and most merchants only defend one.
What is e-commerce fraud?
E-commerce fraud is any form of deception which is directed at an online business or its customers with the aim of securing illicit financial gain. That’s a very broad definition as the category is very broad. It encompasses a fraudster using stolen card details at your checkout, a customer legitimately charging something and then disputing it to get a refund they don’t deserve, an attacker taking over a customer’s account, a fake identity opening an account to abuse your promotions, and a scammer cloning your entire store to go and rip off your customers under your name.
What ties those together is that each exploits the central feature of online commerce: the buyer, the seller, and the money never meet in person. Every check that a physical shop does by eye, is this the real cardholder, is this a real store, is this person who they say they are, has to be done remotely, through data, and that’s the gap fraud lives in. The more commerce moves online, the bigger that gap, and the more creative the ways through it.
It helps to hold two ideas from the start. First, e-commerce fraud is much wider than card fraud; the stolen card is only the most familiar face of it. Second, it attacks from two sides at once, the transaction and the identity, which is the frame the rest of this guide is built on.
Why e-commerce fraud keeps escalating
Fraud online isn’t just persistent it’s actually growing and the drivers of that growth are precisely the same forces which are enabling legitimate commerce to grow faster and bigger. More of the world is shopping online every year which means a larger, richer target. Payments are settling in seconds which removes any time for a control to react. There’s a constant stream of breached data available to the criminals to work with.
The most potent accelerant is generative AI. It’s made it trivial and cheap to produce things that previously required skill: convincing fake store fronts (cloned from a single URL), synthetic identities that will pass onboarding, phishing messages in fluent local language, deepfakes of audio and video for impersonation. At the same time fraud has industrialised. There is now effectively a fraud as a service kit economy, a market in stolen data and specialists who sell their own techniques. A fraudster no longer needs to be technical to operate at scale. The sobering conclusion is that attackers will adopt new tools faster than the businesses trying to protect themselves. Fraud prevention can’t be a static solution. It has to be constantly evolving.
Which businesses should be concerned?
The blunt answer is anyone who sells online, and anyone whose brand is known enough to be worth impersonating, which together is almost everyone. But some businesses carry more risk than others, and it’s worth knowing where you sit.
Higher risk profiles include those selling high value goods (electronics, luxury goods etc) where a single fraudulent order is worth stealing; those selling digital goods or anything that has instant delivery as there’s no shipping lead time in which to catch the fraud before the goods are gone; marketplaces and platforms who take on the risk of every seller they have on their site; subscription and recurring billing businesses; and any merchant who operates across borders as it’s much harder to verify and the rules vary from market to market. And of course any brand that is recognisable of any size is a target for impersonation regardless of what it sells.
One myth worth killing: that small merchants are too small to bother with. The opposite is often true. Smaller businesses tend to have thinner defences, which makes them easier, and fraudsters frequently prefer a lot of soft targets to a few hard ones. Being small is not protection; it’s sometimes the reason you were picked.
The two families of e-commerce fraud
Almost every kind of fraud a merchant faces falls into one of two families, and they’re worth naming because they need completely different defences.
The first is fraud against the transaction. Someone abuses a payment, an account, or a policy: a stolen card, a hijacked login, a dishonest refund. This is the family everyone thinks of as “e-commerce fraud,” and it’s where the whole payment-fraud industry points its tools.
The second is fraud against your identity and your partners. Someone is pretending to be you, or is slipping in as a seller or supplier that they’re not. No card is stolen, no account is compromised; it’s an attack that works by leveraging your brand’s reputation or the trust of your partners. That family gets a very small amount of attention and is actually responsible for a rather large amount of damage (particularly in the reputational space), given that so few merchants are actually set up to detect it. A stolen card order is one sale lost. A fake version of your store that goes out and scams 100 customers is 100 customers’ trust lost and they’re very rarely going to be able to draw a clear line between the fraud and you.
Family one: fraud against the transaction
Start with the family you’re probably already familiar with as that’s the one that needs to be covered properly in any complete guide. These are the attacks directed at a payment or an account.
- Stolen card (card not present) fraud. The classic scenario where a fraudster takes stolen card details and uses them to make purchases online. That usually results in a chargeback when the actual cardholder becomes aware of it. A related activity is card testing whereby the fraudster will make very small transactions to see which of the stolen numbers still work.
- Chargeback, or “friendly,” fraud. A real customer buys something, then disputes the charge to get their money back while keeping the goods, claiming it was unauthorised or never arrived. First-party fraud like this is now one of the hardest categories to fight, because the “fraudster” is your actual customer.
- Account takeover. An attacker gets into a legitimate customer’s account, through a leaked password or phishing, and exploits the saved cards, stored value, and trust that come with it.
- New-account and synthetic-identity fraud. Fake or stitched-together identities are used to open accounts, claim sign-up offers, or set up for later abuse. Increasingly, these identities are generated with the help of AI.
- Refund, promo and coupon abuse. Exploiting your own policies: serial refunding, discount code farming, reshipping etc. and the slow, insidious erosion of margin that comes from policy gaps rather than actual theft.
- Bot and automation attacks. Automated scripts that test cards, scalp limited stock, scrape prices, or brute-force logins at a scale no human could.
These are real, costly, and well understood, and a mature merchant has defences against all of them. But notice what they share: every one is an attack on something you operate, your checkout, your accounts, your policies. Which is exactly why the second family slips past them. A tool watching your checkout has nothing to watch when the fraud is happening on someone else’s server, under your name.
Family two: fraud against your identity and your partners
The second family doesn’t touch your systems at all. It targets your brand and the people around it, which is what makes it invisible to tools built to watch transactions.
- Brand impersonation and fake storefronts. Cloned websites on lookalike domains, impostor social-media accounts, and phishing pages that copy your branding to harvest your customers’ money and card details. The customer thinks they’re dealing with you; the damage lands on your reputation. This is one of the fastest-growing fraud fronts, and the one merchants are least equipped to see.
- Fraudulent sellers and suppliers. If you’re a marketplace or platform then the risk runs the other way. You’re taking on the risk of sellers who are selling counterfeits, who take your money and don’t deliver at all, or who are in fact sham or sanctioned businesses. Every single one of those you onboard without proper due diligence is a liability wearing your own logo.
- Supplier and dropshipping risk. The businesses you’re sourcing from or relying on to fulfil your orders could be fronts, they could be counterfeiters and their own problems (legal, reputational, sanctions etc) could become yours the moment a customer or regulator links you to them.
The common thread is that none of this is a transaction problem. There’s no suspicious payment to score, because the fraud is happening next to your business, not inside it. The FTC has reported billions in consumer losses to scams that begin on social media and lookalike sites, and the FBI’s cybercrime reporting tells the same story: impersonation and fraudulent-business schemes are a large and growing share of the loss. A merchant watching only its own checkout never sees any of it coming, and usually only finds out when a scammed customer calls support, by which point the damage is done.
E-commerce fraud warning signs
Much transaction fraud will tell you if you know what to look for. No one signal is going to be proof of anything and treating one as such is how you end up blocking good customers. A cluster of them on a single order is something that’s worth a second look. The usual red flags are:
- Mismatched billing and shipping details, or a shipping address that’s a freight forwarder or reshipping service.
- Several different cards used on one account, or one card attempted across many accounts.
- A burst of orders from the same device or IP address in a short window, or many declined attempts followed by a success.
- An unusually large first-time order, especially with expedited shipping, where speed matters more to the buyer than cost.
- A mismatch between the customer’s name, email, and the card, or an email address that looks randomly generated.
- Orders from a location that doesn’t fit the customer’s stated details, or sudden changes to an account’s contact or payment information just before a purchase.
Two caveats. Firstly the identity-and-partner family simply don’t appear in your order data at all. Their red flags are to be found on social media and the wider web in the form of accounts and domains that are impersonating you rather than in a suspicious basket. Secondly modern fraud is getting very good at looking like normal behaviour so the red flags will catch the naive and miss the discerning. They’re a good filter, they’re not a complete shield.
The cost of e-commerce fraud
The sticker price of fraud, the value of the goods stolen, is only the beginning of what it costs. The real figure is a multiple of it. The LexisNexis True Cost of Fraud study found that retail and e-commerce companies face more than $5 in total costs for every $1 lost to fraud, and that multiplier has been climbing year on year.
Where does the other $4 go? Some of it is direct: on top of the loss of the goods you’ve obviously already incurred, you’ve got the chargeback fee (a chargeback on a fraudulent transaction) and if your chargeback ratio gets too high you can get penalised and in the most extreme cases you can be banned from accepting cards altogether. There’s then the sheer amount of analyst time that goes into reviewing and disputing those chargebacks. The biggest hidden cost is often false declines (legitimate orders that have been legitimately declined by overly cautious controls). For many merchants the revenue lost by turning away good customers as a result of false declines is actually greater than the revenue lost to fraud. And then of course there’s the reputational cost which is the most difficult to quantify and the slowest to recover from, especially in the case of fraud where customers have actually been scammed out of their money via your account.
The latest fraud trends and statistics
A few currents are worth keeping an eye on as they dictate where the risk is headed. The headline figure is of course the Juniper projection (already referenced) of online payment fraud losses at over $362bn over the next five years. Beneath that a number of other trends are worth noting.
Gen AI is the big one. It’s enabling a massive increase in synthetic identities, convincing phishing, deepfakes and automated attacks and it’s dramatically reduced the skill required to carry out any of them. Social media is now the primary vector for fraud with a huge proportion of the consumer fraud losses reported now stemming from a social platform or a lookalike site rather than from a merchant’s own checkout. First party (friendly) fraud is continuing to increase and the line between the customer and the fraudster is getting increasingly blurred. Authorised push payment fraud is also growing rapidly in markets with instant payment rails. The common thread across all of this is that fraud is moving towards deception and impersonation, it’s about attacking the person’s trust rather than breaking a technical control and that’s exactly the ground that the identity and partner family of solutions is on.
Why traditional defences force a bad choice
Here’s the dilemma that every merchant is familiar with. If you tighten your fraud controls to catch more bad orders you’ll reject more good ones and bleed revenue through false declines (which as we’ve already established often cost you more than the fraud itself). If you loosen them to get the good customers through then you’ll let in more fraud with them. Traditional rule-based defences are forced into this trade-off as a static rule can’t distinguish between a sophisticated fraudster and a legitimate customer who just happens to be unusual. It can only be made stricter or looser and both options have a cost.
The aim was never zero fraud. You could get very close to zero by simply rejecting anything that was in the slightest bit odd and in that scenario you’d lose vastly more at the front door than you’d save at the back. The solution to the bad choice isn’t to get a better position on the same dial. It’s better information. The more context you have about who’s actually behind the order/account/device/identity/history/network etc the less you have to guess and the less you’re forced to make that choice between stopping fraud and keeping the customer. Better signals not more friction is the way to break that trade-off.
How to defend against transaction fraud
With that principle in mind, the toolkit for the first family is mature, and a solid programme layers several of these together rather than leaning on any one.
At the very base is payment security itself (PCI DSS for handling card data, 3-D Secure and strong customer authentication to push the verification back out to the card networks and issuers where it’s permitted). On top of that are the detection layers: identity and device signals, address and card verification (AVS and CVV), fraud scoring models which look at dozens of signals per order, and velocity rules to catch a card or device that’s just hammering your checkout. The middle ground is dealt with via manual review and there’s a disciplined chargeback management process in place (including the ability to represent disputes which we can prove were legitimate) to recover revenue post factum. None of that is Beady’s world and a good payment fraud stack is absolutely essential. That’s the first family though.
How to defend against identity and partner fraud
The second family needs a different kind of defence, because the threat lives outside your systems, in the open, where transaction tools don’t look. It comes down to two habits.
The first is to be on the lookout for impersonation of your brand. You need to be actively scanning the social media channels, checking for new domain registrations and the wider web for fake accounts, lookalike domains and cloned stores that are using your name and branding. The aim is to spot them and report them before they’ve managed to build any following with your customers. Speed is everything in this case as a phishing clone will typically do its damage and be gone within a day so a manual monthly check is completely useless.
The second is the due diligence on the businesses and people you allow into your ecosystem. Before you ever onboard a seller, supplier or payment partner you need to verify that the business is genuine, check who the owners and controllers actually are and run them against sanctions and adverse media. The fact is a business that is clean at onboarding can turn nasty later on so the due diligence should be an ongoing process rather than a one off. This is the know your business discipline that banks have had in place for years, just applied to the sellers and suppliers behind an online marketplace.
Fraud prevention tools for e-commerce
The market for fraud tooling is large and sometimes bewildering, but the categories sort fairly cleanly. Mapped to the two families, they look like this:
- Payment security and authentication: PCI-compliant processing, tokenisation of card data, 3-D Secure, and multi-factor authentication to protect accounts.
- Fraud scoring and detection: machine learning models, device fingerprinting, address and card verification and velocity rules which score each transaction in real time.
- Identity verification: checks that confirm the customer is a real, unique individual at onboarding rather than a synthetic or stolen identity.
- Chargeback management: tools that will track disputes, automate representment and keep your chargeback ratio below the thresholds that actually matter.
- Brand and impersonation monitoring: continuous scanning of social, web and domains for fake accounts and cloned stores.
- Business due diligence and screening: know-your-business checks, beneficial-ownership analysis, and sanctions and adverse-media screening for the sellers and suppliers you onboard.
The first four categories address the transaction family and are where most merchants already invest. The last two address the identity-and-partner family, and are where most merchants have nothing at all. A complete toolkit spans both, because a gap in either is a gap a fraudster will find.
E-commerce compliance and regulations
Fraud prevention and compliance aren’t two separate things. A lot of what regulation is about is fraud prevention with a legal obligation on the business. A few frameworks are of course key to the majority of online merchants.
PCI DSS covers how you store and handle card data and non-compliance is subject to penalties as well as risk. In Europe PSD2 and its strong customer authentication requirement will require additional verification on many online payments (this is as much a fraud control measure as it is a compliance box). Data protection law (the GDPR and its equivalents) governs how you collect and use customer data including the data you process to fight fraud so your fraud tooling has to be compliant. If you’re a marketplace or you’re handling other people’s funds then your anti-money laundering obligations will require you to know your sellers and in that case business due diligence becomes a legal obligation rather than just good practice. Sanctions rules mean you simply cannot transact with a designated person or entity (whether you know it or not) and so screening is a must. The practical reality is that putting together a real fraud programme and meeting these various obligations is pretty much the same thing.
Best practices: building a layered defence
Put it all together and the industry’s hard won best practices all come down to a very small number of principles. A single control is not sufficient; you need layers of controls where each one catches what the others have missed.
- Take a risk based approach. Focus your most intensive scrutiny on your highest risk orders, customers and partners rather than spreading it out equally.
- Defend both families: transaction monitoring coupled with active monitoring for brand impersonation and due diligence on your sellers and suppliers.
- Get the fundamentals right: PCI compliance, strong authentication and tokenised card data underneath everything else.
- Keep humans in the loop for the middle ground (the ambiguous bit), and give them sufficient context so that their judgement is actually of any value.
- Measure the right things: track your false decline rate as well as your fraud rate. Optimising one in the absence of the other just moves the loss around.
- Screen partners continuously, not once, since a clean seller at onboarding can become a problem later.
- Keep auditable records of what you checked and why, both to defend decisions and to meet your compliance obligations.
Read down that list and the gap is usually obvious. Most merchants have the transaction-side practices well covered and the identity-and-partner ones barely at all. The payment layer is mature; the identity-and-partner layer is where the exposure quietly sits. It isn’t that merchants decided to ignore it. It’s that nothing in the standard fraud toolkit was pointed at it.
The future of digital fraud
Where is this going? Towards an arms race in which both sides are armed with AI. Fraudsters are already using generative tools to create synthetic identities, deepfakes (audio and video), pixel perfect store clones and automated attacks that operate at machine scale and can adapt faster than any static rules can. As the fakes get cheaper and more convincing the transaction itself becomes an ever weaker signal as anything about it can be faked.
Defenders have the same toolkit (AI and machine learning to spot patterns a human couldn’t, to reduce false positives and to act in real time). The real shift is where the reliable signal is going though. As it becomes easier and easier to fake a transaction, a fake identity, a fake store etc the thing that actually works is the network. It’s the network, the connections, the ownership, the history, the reputation of the people and the entities that are actually behind it. New rails and agentic commerce are going to keep opening up new attack surfaces and the merchants that will survive are going to be the ones who are looking beyond the transaction that goes through their checkout and are actually looking at who is behind it. The future of fraud prevention is not going to be a better transaction filter, it’s going to be about actually knowing who you’re dealing with.
Cover both directions, not just the checkout
E-commerce fraud comes at you from two sides. Your payment stack is there to defend the transaction and that’s absolutely essential work and not ours. The other side is the fraud that takes your identity or slips in amongst your partners and that’s the half of a payment tool that was never designed to see, and that half is only going to get bigger as fakes get cheaper.
That’s the half Beady covers. It’s looking out for the fake accounts and cloned stores that are pretending to be your brand. It screens your sellers, suppliers and partners as you onboard them against sanctions, adverse media and ownership risk and does it on an ongoing basis rather than just a one-off. Every finding is linked back to its original source so you can act. It doesn’t replace your payment fraud tools at all; it fills in the gap in identity and partner risk that those tools don’t cover.
If you’d like to see which fake accounts are already impersonating your brand, or what a proper check surfaces on a seller you’re about to onboard, book a demo and we’ll run it with you.
