Payment fraud costs UK online retailers hundreds of millions of pounds a year, and the tactics keep evolving. Understanding the difference between genuine chargebacks, friendly fraud and automated card-testing attacks is the first step to defending your margins.
Understanding the three main threats
Chargeback fraud, friendly fraud and card-testing are often lumped together as 'payment fraud', but each requires a different defence. Chargeback fraud happens when a criminal uses a stolen card to buy goods, and the real cardholder later disputes the charge with their bank — you lose the goods, the payment, and pay an additional chargeback fee.
Friendly fraud is different: a genuine customer makes a legitimate purchase, receives the goods, and then disputes the charge anyway — claiming they never received the item, don't recognise the transaction, or were dissatisfied — rather than requesting a refund through you directly. Card-testing is an automated attack where fraudsters run large batches of stolen card numbers through your checkout in small transactions to identify which cards are still active, usually as a precursor to larger fraud elsewhere.
Spotting the warning signs
Certain order patterns correlate strongly with fraud. A mismatch between the billing address and shipping address, particularly when the shipping address is a freight forwarder or a different country, is one of the most reliable signals. Orders placed in rapid succession from the same IP address using different card numbers are a classic card-testing pattern, as are a string of small-value transactions that fail authorisation in quick succession.
- First-time customers placing unusually large orders, especially for high-resale-value goods like electronics or trainers.
- Orders using an email address that bears no resemblance to the cardholder name.
- Requests for expedited shipping paired with a new or unverified account.
- Multiple failed payment attempts followed by one successful attempt using a slightly different card number.
None of these signals is proof of fraud on its own, but two or three occurring together on a single order should trigger manual review before you dispatch goods.
Building layered checkout defences
Address Verification Service (AVS) checks compare the billing address on file with the address the cardholder's bank holds, and CVV verification confirms the buyer has physical possession of the card. Both are supported by every major UK payment gateway and should be enabled by default rather than left as an option.
3D Secure (branded as Verified by Visa or Mastercard Identity Check) shifts liability for fraudulent transactions from you to the card issuer in most cases, and is effectively mandatory under UK Strong Customer Authentication rules for card-not-present transactions above certain thresholds. Velocity checks — limiting how many orders or payment attempts can come from a single IP address, device or card within a short window — are the single most effective defence against card-testing specifically, since the attack relies on volume.
Responding to a chargeback dispute
When a chargeback notification arrives from your payment processor, respond within the deadline stated (typically 7–20 days depending on the card scheme) with clear evidence: proof of delivery with a signature or tracking confirmation, the customer's IP address and device details at checkout, any communication with the customer, and evidence the AVS and CVV checks passed. A well-documented response wins a meaningful proportion of friendly fraud disputes, particularly when delivery confirmation is unambiguous.
Reducing friendly fraud through better service
A significant share of friendly fraud isn't malicious — it's a customer who doesn't recognise your billing descriptor on their statement, or who found it easier to dispute with their bank than to navigate your returns process. Set your payment gateway's statement descriptor to clearly match your trading name, and make your customer service contact details prominent on order confirmation emails and packing slips.
Proactive order confirmation and dispatch emails that clearly state what was ordered, when, and for how much reduce 'I don't recognise this charge' disputes measurably, because they give the customer an easy, low-friction way to resolve confusion before it becomes a formal dispute.
When to escalate to specialist tools
If chargeback rates climb above roughly 0.5–1% of transaction volume, most UK acquiring banks will flag your account for review, and sustained rates above 1% can result in higher processing fees or account termination under card scheme monitoring programmes. At that point, manual review alone is rarely sustainable, and dedicated fraud prevention software — covered in the next article in this section — becomes a cost-effective investment rather than a luxury.
Putting This Into Practice
It's rarely useful to treat preventing chargeback fraud, friendly fraud and card-Testing attacks in UK e-Commerce as a standalone decision — the strongest results tend to come from lining it up with the rest of your operation. For the practical mechanics, see Building and Testing a Minimum Viable Product Before You Commit to a Full E-Commerce Launch.
For related reading: If you haven't already, A/B Testing and Conversion Rate Optimisation Tools for UK E-Commerce Stores is a useful companion read on this exact point. If you haven't already, Understanding Product Liability Insurance for UK E-Commerce Sellers is a useful companion read on this exact point.