Payment Transaction Fraud: Balancing Security and Progress

Every business that takes payments faces the same trade-off. Block too little, and fraud losses, chargebacks and fines follow. Block too much, and genuine customers are turned away at the checkout, often for good. The goal is not zero fraud at any cost; it is the right balance between security and a smooth customer experience.

Here is how the most common types of payment fraud work, why false declines matter as much as fraud itself, and what a sensible defence looks like.

The main types of payment fraud

Card-not-present fraud

Stolen card details are used online or over the phone, where the card itself is never shown. It is the most common form of card fraud in e-commerce, because data stolen in breaches and phishing campaigns is easy to use at scale.

Account takeover

Criminals log into a real customer's account using leaked passwords or social engineering, then change contact details and spend or withdraw money. Because the account is genuine, this fraud can look like normal behaviour.

Authorised push payment (APP) scams

The customer is tricked into sending money themselves, for example to a fake supplier or a "safe account". In the UK, payment firms have had to reimburse most APP scam victims since October 2024, which has made scam prevention a direct cost for banks and payment providers rather than only a customer problem.

Friendly fraud

A customer makes a genuine purchase and later disputes it with their bank, claiming it was unauthorised or never arrived. Each chargeback costs the merchant the sale, the goods and a fee, and too many can put a merchant account at risk.

The hidden cost of false declines

Fraud losses are easy to measure. Lost good customers are not. When a legitimate payment is declined, many shoppers simply go elsewhere and don't come back. For most online businesses, the revenue lost to overly cautious rules is significant, and it rarely appears on a fraud report.

That is why fraud performance should be measured on two numbers together: the fraud and chargeback rate, and the approval rate for genuine customers. Improving one at the expense of the other is not progress.

A layered defence that keeps checkout smooth

No single tool solves fraud. Effective programmes combine several layers, each catching what the others miss:

• Strong customer authentication. In the UK and Europe, regulations require two-factor checks for many online payments, usually through 3-D Secure. Modern versions use risk data to let low-risk payments through without a challenge.
• Risk scoring and machine learning. Models score each transaction using signals such as device, location, purchase history and velocity, and send only the riskiest for review or challenge.
• Device and behaviour signals. How a user types, navigates and logs in can reveal bots and account takeovers that a password check cannot.
• Tokenisation and virtual cards. Replacing real card numbers with tokens, or using single-use cards, means stolen data is far less useful. See virtual vs physical cards for more.
• Clear evidence for disputes. Order confirmations, delivery tracking and usage logs make friendly fraud chargebacks much easier to win.

Design is part of fraud prevention

Fraud controls are often treated as a back-end problem, but much of the balance is decided in the interface. A well-timed confirmation step, a clear warning before a first payment to a new payee, recognisable billing descriptors and an easy way to contact support all reduce fraud and disputes without adding friction for everyone. Good scam warnings are specific and well designed; generic pop-ups get clicked past.

Where to start

1. Measure both fraud losses and false declines, by channel and customer segment.
2. Review rules regularly, retire ones that block good customers, and test changes before rolling them out.
3. Add risk-based authentication rather than challenging every payment.
4. Invest in data and monitoring, so new attack patterns are spotted in days, not months.

Frequently asked questions

What is a false decline?

A false decline happens when a genuine customer's payment is rejected because it looks suspicious to a fraud rule or bank. The customer did nothing wrong, but the sale is lost and they may not try again. Tracking false declines alongside fraud losses gives a truer picture of how well fraud controls work.

What is the difference between fraud and a chargeback?

Fraud is the unauthorised or deceptive use of a payment. A chargeback is the process a cardholder's bank uses to reverse a card payment, which can be triggered by real fraud, by a dispute about goods or services, or by "friendly fraud", where a genuine purchase is wrongly disputed.

Does 3-D Secure stop all fraud?

No. 3-D Secure adds an authentication step that makes stolen card details much harder to use online, and it can shift liability for some fraud away from the merchant. It does not stop scams where customers are tricked into approving payments themselves, so it works best as one layer among several.

How Eptune can help

Getting this balance right takes product design, data and engineering working together. We design and build the customer journeys, AI-powered monitoring and automation behind secure, low-friction products. Explore our AI and technology expertise and services, or book a free consultation to talk through your checkout or onboarding flow.