How to prevent credit card fraud in your online shop

You prevent credit card fraud in an online shop in two places. At checkout, your payment provider can check card payments, and before shipping, you check the order yourself. The provider can add 3D Secure, the extra step where the buyer's bank asks them to confirm the payment. Before you ship, you look at each order for warning signs. It also helps to make your refund rules easy to find, so unhappy customers come to you rather than to their bank.

When a card payment turns out to be fraudulent, the cost usually lands on your shop, unless the buyer's bank confirmed the payment with 3D Secure. If you run an e-commerce website, an order paid with stolen card details looks like any other sale until the real cardholder disputes it. By then the goods have usually gone.

What is credit card fraud?

Credit card fraud is when someone steals a card or the details on it. The fraudster then uses them to take money or buy things in the cardholder's name. Online shops mostly deal with the second kind. A fraudster doesn't need the card itself, because an online checkout never sees it. The number, the expiry date and the security code on the back are enough. Payments like these are called card-not-present payments.

When cardholders spot a payment they didn't make, they dispute it with their bank. If the dispute goes their way, the money is taken back from your shop. This is a chargeback. You lose the payment and the goods you've already sent, and you may pay a chargeback fee on top. The one important exception is a payment the buyer's bank has authenticated with 3D Secure. For a fraud chargeback on that payment, the liability shifts from your shop to that bank.

Types of credit card fraud that hit online shops

Four common kinds of card fraud hit online shops, and each looks different from your side of the order.

• Stolen card details. Someone gets card details through phishing, a data breach or a criminal marketplace and orders from you before the cardholder notices. Goods that are easy to resell are popular targets.
• Card testing. Before using a batch of stolen cards, criminals run lots of small payments to find out which cards still work. Even when the tests fail, they can cost you authorisation fees, the charge a payment provider may take for each payment it asks a bank to approve.
• Refund and overpayment scams. A buyer pays, then says there's been an error and asks for an urgent refund to a different account or by another method, or asks you to pass part of the payment on to their own shipping company. When the real cardholder disputes the payment, you have to return the full amount as well.
• Friendly fraud. A real customer receives the order, then tells their bank it never arrived or that they didn't make the purchase. Sometimes it's an honest mistake, because they don't recognise your shop's name on their statement, and sometimes it's deliberate.

Protections that stop card fraud at checkout

Where you can, don't handle card details yourself. According to SumUp, customers who buy from a website go to a secure payment gateway to enter their card details and complete the purchase. With our online shop, you can accept a range of popular payment methods, and we look after the security of the shop itself.

The checks that catch fraud come from your payment provider, so ask yours which of these it runs for you and which you switch on yourself.

• 3D Secure. The buyer's bank asks them to confirm the payment, for example with a one-time code or their banking app. It's the main way card payments meet the UK's Strong Customer Authentication rules, which have applied since 14 September 2019.
• Card security code and address checks. The security code check shows the buyer has the details from the back of the card, and the address check compares the billing address with the bank's records. Neither is foolproof, but you can set payments to be declined automatically when the details don't match.
• Limits on payment attempts. Shops with guest checkout and no limit on payment attempts are frequent targets of card testing. Capping the attempts from one IP address (the address a device uses online), device or card in a short time cuts card testing short.
• Fraud screening. Some payment providers include credit card fraud detection that screens payments for you. Stripe's Radar, for example, checks every transaction as it comes in, with models trained on data from Stripe's whole network.
• A name customers recognise. Make sure your shop's name, not a company name nobody knows, appears on your customers' card statements. Customers who don't recognise a charge may dispute it.
• Clear refund rules. Explain your refund and returns rules clearly to your customers. A customer who can see how to get their money back has less reason to go to their bank.

Under UK payment rules, a payment provider must apply Strong Customer Authentication when someone starts an electronic payment. The rules also allow exemptions, and Stripe describes 3D Secure as a key way for businesses to request them. According to Stripe, many businesses use 3D Secure on riskier orders rather than on every payment, because it adds a step to your checkout process. How and when it runs depends on your payment provider, so ask yours how it works in your shop. In most cases, it's worth keeping it on for high-value and first-time orders, because of the liability shift.

Take card payments, Apple Pay and Google Pay in your own online shop, with an SSL certificate included from day one.

Warning signs of a fraudulent order

According to Stripe, a fraudulent order often looks like a real one at checkout. In a small shop, spotting fraud mostly means reading each order before you ship it. No single detail proves fraud, and a first-time buyer is not a fraudster just for being new. A few of these signs together, though, are worth a closer look.

• Details that don't match. The delivery address differs from the billing address, especially when it's a parcel forwarding service or in another country. Or the IP address places the buyer in one country and the billing address is in another.
• Several cards for one customer. Failed attempts with several different cards before one goes through, all to the same delivery address.
• Large, rushed first orders. A first-time customer places a high-value order with overnight delivery, or orders an unusually large quantity of one item.
• Email addresses that look made up. A long string of random characters, a throwaway email domain, or an address that doesn't match the name on the order.
• Bursts of small or declined payments. Many small payments with different cards in a short time, or a run of declined attempts, can mean someone is testing cards on your checkout.

What to do with a suspicious order

Hold the order rather than ship it. A short delay before shipping is a small cost next to goods you can't get back. Contact the customer through details you already trust, such as the phone number on the order, and ask them to confirm it. If you can't confirm the order, cancel it and refund the payment to the card that paid, never by another method. Either way, keep the order details, emails and delivery confirmation, because you need that record to challenge a chargeback. If a chargeback still comes in, your payment provider tells you and gives you a deadline to respond. Send it the order details, your emails with the customer and the delivery confirmation before that deadline.

What to do if your own card is used

If you see a payment on your card that you didn't make, contact your bank straight away. Use a number you trust, such as the one on the back of your card. Do the same if your card is declined although there's money in your account, or if you suddenly go over your overdraft or credit limit, because that can mean someone is using your card. You can also call 159, a short number that connects you safely to your bank and works for almost all UK retail bank current accounts. The bank can freeze your card while it looks into the payment. Then report credit card fraud to Report Fraud, the national centre that takes fraud reports and has replaced Action Fraud. It serves people in England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101 instead.

You'll notice a payment like this sooner if your bank alerts you when your card is used.

• Turn on bank alerts. Alerts in your banking app tell you each time your card is used, so a payment you don't recognise stands out straight away.
• Chase a missing card. If a new card you're waiting for never turns up, tell your bank or card provider at once.
• Keep your codes to yourself. Criminals try to trick people into sharing the one-time passcode their bank sends. Treat that code as carefully as your PIN.

Opening your own shop

If you're setting up a new shop, you can put these payment checks in place before the first order arrives. Build your online shop with us and take card payments from the start.