Home / Knowledge hub / Payment fraud
Knowledge hub
Payment fraud
Using stolen or fake payment details to buy from your business.
What it means
Payment fraud is when someone pays with details they have no right to use: a stolen card number, a hijacked account, a fake or borrowed identity. The goods or service are delivered, and the real card owner later says the purchase was not theirs.
From the seller's side, the sale looked normal. The card was accepted, the order shipped and the customer seemed real. The loss arrives weeks later, usually as a dispute that the seller has to answer.
Why it matters
The seller usually carries the loss. You lose the goods, the sale and often a dispute fee, and a high share of disputed payments can bring extra scrutiny from your payment provider. See chargeback fraud for the dispute side.
Fraud also damages the people behind the card. Real customers get caught in blocks and extra checks that your team added in a hurry. A checkout that is too open loses money, and one that is too strict loses honest buyers, so the design matters.
How it shows up
It shows up at checkout, in saved payment methods, in top-ups and wallets, in free-trial sign-ups that need a card, and in refunds sent to a different method. Weak points include unlimited payment attempts, order values that can be altered, and flows that release goods before the payment is confirmed.
Many fixes are about your own application rather than the payment network: confirm payment on the server, bind the amount to the order, limit attempts, and watch for card testing. Test the logic around the payment as well as the page, since price manipulation and skipped steps are common.
Questions people ask
Payment fraud, answered
Is payment fraud the same as a data breach?
No. A breach is theft of data from you. Payment fraud is the use of someone else's payment details against you. A breach elsewhere may be where the cards came from.
Does using a payment provider remove the risk?
It removes the burden of storing card data, which is a large help. It does not remove fraud on your checkout, because the logic around the payment is still yours to secure.
What are common signs of payment fraud?
Many orders with different cards from one device, shipping addresses that differ from billing, unusually large first orders, and a rise in disputes. None is proof alone, so teams combine several signals.
Who is responsible for the loss?
It depends on your agreement with the payment provider and on the type of payment. For card payments without strong customer authentication, the seller commonly bears it. Check your own terms.
How do we test our checkout for fraud weaknesses?
Try to change prices, quantities and totals in requests, skip steps, replay requests and run many payment attempts. Those checks find logic flaws that a scanner for known vulnerabilities misses.
Sources
Where this comes from
Related
Terms that sit next to this one
Chargeback fraud
Disputing a genuine purchase with the card issuer to get money back and keep the goods.
Card testing
Using your checkout to check which stolen card numbers still work.
Price manipulation
Changing a price, quantity or discount in a request so you pay less than you should.
Fraud detection
Spotting abuse of your business by patterns in behaviour, devices and payments.
PCI DSS
The security standard for any business that handles payment card data.
Can your checkout be talked into it?
Business-logic flaws around payment are in scope for us: altered totals, skipped steps and replayed requests. Each finding shows the request that did it. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.