Home/Research library/Fraud Is Blocking Growth

Guide · Payment fraud fundamentals

What Is Payment Fraud?

Fraud is often named at the end of the story. A merchant sees a disputed payment, a suspicious refund, an unusual burst of checkout attempts, a hijacked customer account, or an order paid with credentials that did not belong to the buyer—and applies the same label: fraud. But tho

Source-imported researchEditorial verification pending

Research draft awaiting independent review. This material was adapted from an existing research library. Provider-specific promotions have been excluded automatically; facts, regulatory requirements, and conclusions must be verified before the page is indexed publicly.

What Is Payment Fraud? How Fraud Enters the Payment Lifecycle and Blocks Growth

Fraud is often named at the end of the story.

A merchant sees a disputed payment, a suspicious refund, an unusual burst of checkout attempts, a hijacked customer account, or an order paid with credentials that did not belong to the buyer—and applies the same label:

fraud.

But those events do not have the same cause, actor, target, or remedy.

One may begin with stolen card credentials. Another begins when an attacker takes control of a legitimate customer account. Another uses a constructed identity. Another automates thousands of attempts against a payment endpoint. Another involves a genuine customer exploiting a refund, promotion, subscription, or dispute process.

Understanding what payment fraud is therefore requires looking beyond the final bad transaction.

Payment fraud is deceptive or unauthorized misuse of a payment instrument, account, identity, or payment-related process to obtain economic value. Related payment abuse occurs when legitimate merchant functionality is intentionally used outside its intended commercial rules.

The distinction matters because a control designed to detect a stolen credential will not necessarily identify a genuine customer abusing a refund policy—and a rule aggressive enough to treat both behaviors identically can block good customers without solving the actual fraud problem.

The merchant's first task is therefore not:

“How do we stop fraud?”

It is:

Who is acting, what are they targeting, where are they entering the payment lifecycle, and how does the merchant ultimately lose value?

That is the organizing principle for payment-fraud management.

What is payment fraud?

Payment fraud is the deceptive or unauthorized use of a payment instrument, customer account, identity, or payment-related process to obtain money, goods, services, account value, promotional value, or another economic benefit.

It can involve:

stolen payment credentials;

compromised customer accounts;

fabricated or synthetic identities;

automated attacks;

dishonest use of merchant refund or promotional processes;

certain cardholder-initiated disputes;

abuse of subscription or marketplace systems.

That is broader than:

someone stole a credit-card number.

The editorial brief deliberately defines the category around misuse of payment, account, identity, or merchant processes rather than one instrument.

Payment fraud is not one category

A useful way to understand why fraud gets confusing is to notice that common fraud terms describe different dimensions.

Card-not-present fraud

Describes a remote card-payment environment.

Stolen-card fraud

Describes misuse of legitimate card credentials belonging to someone else.

Account takeover

Describes compromise of a legitimate customer account.

Bot attack

Describes automation as the attack mechanism.

Synthetic identity fraud

Describes use of a constructed identity.

Refund abuse

Describes exploitation of a post-purchase merchant process.

Marketplace fraud

Describes fraud inside a multi-party commercial environment.

These terms can overlap without meaning the same thing.

A bot, for example, might automate:

card testing;

account creation;

promotional abuse.

So:

bot = mechanism

not:

bot = one fraud objective.

The brief explicitly requires this multi-dimensional taxonomy rather than classifying every incident on a single axis.

The four questions that classify payment fraud

Before choosing a fraud control, ask four questions.

Who is acting?

Possible actors include:

external attacker;

automated attacker;

compromised legitimate account;

genuine customer or cardholder;

buyer;

seller;

coordinated group.

Actor classification immediately changes what kinds of evidence might matter.

What is being targeted?

The targeted asset can be:

card credential;

bank or wallet instrument;

customer account;

identity;

account balance or rewards;

merchant promotion;

refund workflow;

subscription entitlement;

marketplace seller account;

seller payout.

A fraud system focused entirely on cards can miss abuse aimed at an account or merchant process.

Where does the behavior enter the lifecycle?

Fraud may begin at:

account creation;

payment credential validation;

checkout;

authorization;

fulfillment;

refund;

dispute;

marketplace payout.

The place where the merchant eventually sees the loss can be much later than the place where the fraud entered.

How is value extracted?

Merchant loss can appear as:

unauthorized purchase;

delivered goods or digital value;

payment reversal;

payout theft;

incentive loss;

dishonest refund;

dispute loss;

operational expense.

This four-question classification implements the brief's editorial position: classify fraud by actor + targeted asset + lifecycle stage + loss mechanism before choosing controls.

The Payment Fraud Lifecycle

The practical framework for this article is:

Actor

Who initiates the harmful activity?

↓

Target

What account, credential, identity, promotion, payment, or workflow is being exploited?

↓

Access

How does the actor obtain the ability to act?

↓

Payment or account event

What merchant event is manipulated?

↓

Value extraction

What does the actor obtain?

↓

Merchant loss

How does the economic damage appear?

↓

Evidence

What signals or confirmed outcomes tell the merchant what happened?

↓

Control

What proportionate response can reduce the loss without unnecessarily blocking legitimate customers?

That is the Payment Fraud Lifecycle.

First-party versus third-party fraud is useful—but it is only one axis

The supplied foundation has one particularly useful organizing distinction:

Who is actually committing the harmful activity?

That distinction should remain in the finished article, with slightly more careful terminology.

Third-party fraud

Broadly, an outside actor uses credentials, accounts, or identity information they are not authorized to use.

Examples can include:

stolen-card misuse;

account takeover;

identity theft;

some synthetic-identity fraud.

The FTC defines identity theft as use of another person's personal or financial information without permission.

First-party misuse or fraud

The person interacting with the merchant may genuinely be the account holder or cardholder.

The problem can instead arise from what they do with a legitimate relationship—for example, disputing a valid transaction.

Visa uses first-party misuse for situations in which a cardholder disputes a legitimate purchase they intended, and its examples show why merchants should avoid assuming every such dispute reflects deliberate criminal intent.

That makes first-party misuse a safer umbrella term when intent has not been established.

Payment fraud versus payment abuse

Not every economically harmful customer behavior needs to be forced into classic unauthorized-payment fraud.

Fraud

Deceptive or unauthorized activity intended to obtain value.

Payment or merchant-process abuse

Use of legitimate functionality contrary to its intended commercial rules.

Examples can include:

promotion abuse;

some refund abuse;

some subscription abuse.

The distinction matters because the merchant may be dealing with a perfectly genuine:

identity;

account;

payment credential.

Identity verification alone cannot solve a policy-abuse problem.

The brief makes fraud-versus-abuse an explicit boundary.

Payment fraud versus suspicious activity

Another critical SEO and operational distinction:

A fraud signal is not fraud confirmation.

A transaction may be:

unusual;

anomalous;

suspicious;

high risk;

without being confirmed fraud.

A risk engine might identify:

unusual device;

unusual geography;

payment velocity;

account changes;

atypical order behavior.

Those observations can support a decision.

They do not establish customer intent.

The brief specifically requires merchants to distinguish:

signal → rule/model → decision

rather than turning every anomaly directly into a block.

Payment fraud versus a chargeback

A chargeback is a dispute and payment-reversal mechanism.

It is not a synonym for fraud.

A chargeback might arise from:

stolen credentials;

account takeover;

customer/service disagreement;

first-party misuse;

processing error.

Likewise, fraud can occur without producing a chargeback.

A payment stopped before fulfillment may be fraudulent even though no dispute is ever filed.

So:

fraud rate ≠ chargeback rate.

The brief requires those metrics and concepts to remain separate.

Visa's current first-party-misuse materials also illustrate this distinction: the dispute is the mechanism through which the cardholder challenges a transaction; the merchant then uses relevant evidence to establish whether the purchase was legitimate and authorized.

Payment fraud versus a refund

A refund can be completely legitimate.

Customers receive refunds because of:

returns;

cancellation;

service failure;

merchant remediation;

ordinary customer-service policies.

Refund abuse occurs when that merchant process itself is intentionally exploited.

So:

high refund rate does not automatically mean high fraud.

Context matters.

The major types of payment fraud merchants should distinguish

The purpose of this pillar page is to orient the reader.

Each category should link to its dedicated article rather than recreate the entire attack model.

Card-not-present fraud

Card-not-present fraud concerns fraud occurring in remote card-payment environments where the card and cardholder are not physically presented in the traditional point-of-sale sense.

Europol describes CNP fraud as unauthorized use of card data in non-face-to-face transactions such as ecommerce or telephone orders.

CNP is an environment.

It should not be used as a synonym for:

stolen-card fraud;

account takeover;

card testing.

Internal link: Card-Not-Present Fraud

Stolen-card fraud

This is unauthorized use of valid payment credentials belonging to another person.

Credentials can potentially be compromised through broader identity or security incidents; the merchant's concern is the resulting unauthorized use.

The FTC's identity-theft definition provides a useful boundary: using another person's personal or financial information without permission constitutes identity theft.

Internal link: Stolen Card Fraud

Account takeover fraud

Account takeover occurs when an unauthorized actor gains control of an existing legitimate customer account.

The account—not merely the payment card—is the compromised object.

That can expose:

stored payment methods;

balances;

rewards;

subscriptions;

delivery addresses;

marketplace payout settings.

Because the attack can occur before checkout, merchants may need account-behavior signals as well as payment signals.

Internal link: Account Takeover Fraud

Card testing attacks

Card testing concerns attempts to determine whether payment credentials are valid.

From a defensive merchant perspective, possible indicators can include combinations of:

unusual low-value attempts;

repeated attempts;

many cards;

elevated velocity;

concentrated or distributed anomalies;

unusual decline patterns.

None of those characteristics proves card testing on its own, and merchant-specific baselines matter.

Internal link: Card Testing Attacks

Bot payment attacks

Bots change the scale, speed and repetition of fraud activity.

They may automate:

payment attempts;

card testing;

account creation;

promotion abuse.

So the merchant should ask:

What is the bot trying to accomplish?

rather than treating “bot fraud” as one underlying fraud category.

Internal link: Bot Payment Attacks

Synthetic identity fraud

Synthetic identity is narrower than:

fake account;

stolen identity;

stolen card.

The Federal Reserve describes a synthetic identity as one assembled from a combination of real and fictional information.

That constructed identity can develop history over time, which makes its behavior structurally different from a simple stolen-card transaction.

Internal link: Synthetic Identity Fraud

Promo abuse

Promotion abuse involves exploitation of merchant incentive rules.

Possible patterns can involve:

repeated new-account benefits;

referral manipulation;

artificial account creation;

prohibited coupon combinations;

incentive farming.

Heavy discount use is not automatically abuse.

The operative question is:

Did the behavior violate the intended eligibility or commercial rules of the promotion?

Internal link: Promo Abuse

Refund abuse

Refund abuse targets the merchant's post-purchase process.

Possible forms can include dishonest exploitation of:

non-delivery claims;

return rules;

damaged-item claims;

partial refunds;

digital-goods policies.

Frequent returns alone do not prove abuse.

Industry and customer context matter.

Internal link: Refund Abuse

Friendly fraud and first-party disputes

The term friendly fraud is frequently used for cardholder-originated disputes in which the underlying purchase was legitimate.

But intent can be difficult to establish.

Visa's own first-party-misuse examples include both inaccurate disputes and circumstances such as forgotten subscriptions or authorized household transactions.

So when intent is uncertain, merchants should prefer language such as:

first-party dispute;

cardholder-initiated dispute;

suspected friendly fraud.

Internal link: Friendly Fraud

Subscription fraud and abuse

Recurring models create their own risk surface.

Potential patterns include:

stolen-card signup;

trial abuse;

repeated promotional accounts;

account takeover;

disputes around recurring charges;

deliberate misuse of billing or cancellation processes.

A normal failed renewal or ordinary churn event is not fraud.

Internal link: Subscription Fraud

Marketplace fraud

Marketplace risk is different because the merchant or platform operates between multiple parties.

Potential actors can include:

buyer;

seller;

compromised buyer;

compromised seller;

colluding participants;

external attacker.

And value can move through:

buyer payment → platform → seller balance → payout.

That creates fraud surfaces at:

pay-in;

fulfillment;

refund;

dispute;

account;

payout.

Internal link: Marketplace Fraud

Why identity-based fraud controls cannot solve every category

The foundation draft makes an important strategic point: controls designed to answer:

“Is this really the authorized customer?”

are best aligned with fraud patterns where identity, account access, or payment credentials have been compromised.

That does not mean they solve:

deliberate refund abuse;

promotion abuse by a genuine customer;

some first-party disputes.

This is precisely why the article should classify the attack before prescribing the control.

Where payment fraud enters the merchant lifecycle

Fraud does not begin at one universal checkout moment.

A broader lifecycle can look like:

Reconnaissance

→ credential / account / identity acquisition

→ validation

→ account or payment preparation

→ transaction attempt

→ fulfillment or value extraction

→ refund / dispute / payout activity

→ repeat or scale

Different articles own different entry points.

Before the payment: identity and account fraud

Examples include:

fabricated identity;

compromised login;

suspicious account creation;

account-profile manipulation.

The merchant may see the first meaningful evidence before payment begins.

That is particularly important for account takeover and synthetic identities.

At payment: instrument and transaction fraud

The exploited event can involve:

unauthorized card use;

card testing;

automated payment attempts;

fraudulent authorization.

Payment signals become especially relevant here.

At fulfillment: the fraud can become irreversible

Fraud economics depend heavily on what the merchant delivers.

A merchant shipping recoverable physical merchandise has different intervention options from a digital-goods merchant delivering value instantly.

The less reversible the value, the more consequential pre-fulfillment confidence can become.

After payment: abuse and disputes

Loss can enter later through:

dishonest refund behavior;

cardholder disputes;

marketplace payout manipulation.

A risk strategy that watches only authorization will therefore miss meaningful parts of the fraud lifecycle.

What does payment fraud cost merchants?

Fraud cost is broader than the face value of a bad payment.

At a high level, merchants can experience:

Direct payment loss

For example, an unauthorized payment or payment reversal.

Fulfillment loss

Goods, digital value, or service already delivered.

Payment and dispute costs

Where applicable and not already counted elsewhere.

Operational cost

Including:

risk review;

investigation;

support;

dispute handling;

engineering response.

Growth cost

Fraud pressure can lead to:

stricter rules;

extra authentication;

manual review;

geographic restrictions;

payment restrictions.

Those controls can also affect legitimate customers.

The dedicated How Fraud Affects Net Revenue article should own the detailed economic model.

This pillar should establish why the loss has multiple channels.

The fraud problem has two directions

An effective merchant risk strategy has to manage both.

Accept too much harmful activity

The merchant can experience:

fraud losses;

fulfillment losses;

disputes;

operational burden.

Reject too much legitimate activity

The merchant can experience:

false declines;

account blocks;

authentication friction;

manual-review delay;

customer churn.

So the target is not:

minimum fraud rate at any cost.

It is:

profitable legitimate growth after fraud loss and prevention friction.

That is the cluster's larger economic principle.

What is a false positive in payment fraud?

A false positive occurs when legitimate activity is incorrectly treated as fraudulent or unacceptable.

Possible outcomes include:

payment decline;

account restriction;

unnecessary authentication;

manual review;

order delay.

The false-positive problem is why an anomaly cannot become a universal blocking rule.

A signal is not a decision

This distinction is one of the most useful concepts a merchant can operationalize.

Signal

Something observed.

Example:

new device.

Rule or model

Logic that evaluates one or more signals.

Decision

Action such as:

approve;

authenticate;

review;

limit;

delay;

decline.

A new device may be perfectly normal for a returning customer.

A merchant should never turn:

new device

into:

fraud

without additional context.

Common payment-fraud signals

No single list applies equally to every merchant, but useful signal families include the following.

Velocity signals

Examples:

attempts per card;

attempts per account;

attempts per device;

attempts per IP/network;

accounts per device;

refunds per account.

Thresholds should be merchant-specific.

Device and network signals

Potential observations can include:

device consistency;

network characteristics;

location mismatch;

automation indicators;

repeated identities/accounts.

Travel, VPN use, shared networks, family devices, and other legitimate behavior can create anomalies, so these are signals rather than proof.

Identity signals

Possible checks can involve consistency among:

name;

email;

phone;

address;

account history;

identity-verification information.

International customers can create legitimate mismatches.

Treat context appropriately.

Behavioral signals

Potential examples include:

abrupt order-value changes;

new destinations;

rapid account changes;

repeated refunds;

unusual retries;

payout changes.

Compare behavior with an appropriate customer or cohort baseline rather than an imaginary universal “normal.”

Payment signals

Depending on method and provider, merchants may have access to signals involving:

authorization outcome;

issuer response;

authentication;

card country;

billing/shipping consistency;

transaction velocity.

Data availability varies, and merchants should not assume they receive every issuer or network signal.

Detection and prevention are different

Fraud detection

Identifies elevated risk or suspicious behavior.

Fraud prevention or control

Determines what action to take.

Possible high-level responses include:

authentication;

step-up verification;

review;

velocity limits;

account challenge;

fulfillment hold;

decline.

The merchant should not jump from:

“this looks unusual”

to:

“permanently block this customer.”

Authentication is one layer, not a universal answer

For card-not-present transactions, authentication can help establish whether the rightful account holder is initiating the payment.

Visa Secure's current EMV 3-D Secure documentation describes an exchange of information among merchant, issuer and, when necessary, the consumer to validate that the transaction is being initiated by the rightful account owner. Visa also explicitly frames the program around reducing CNP fraud while allowing good transactions to proceed.

That makes authentication relevant to some unauthorized-payment problems.

It does not inherently solve:

promo abuse;

refund abuse;

every first-party dispute.

The real customer's identity may already be genuine.

Manual review is a tradeoff, not a default solution

Manual review can make sense for:

valuable;

ambiguous;

unusually risky;

transactions.

But it can also create:

labor cost;

payment delay;

inconsistent decisions;

scaling limitations.

Use it where economics justify it rather than as the universal answer to uncertainty.

Payment fraud looks different across business models

Digital goods and gaming

Immediate fulfillment can make:

stolen credentials;

account takeover;

card testing;

especially operationally important.

SaaS and subscriptions

The lifecycle introduces:

trial abuse;

recurring disputes;

account takeover;

recurring-credential problems.

Retail

Relevant risks can include:

stolen-card activity;

refund abuse;

promotional abuse.

Travel

High-value transactions and delayed fulfillment can alter the economics of review and post-payment disputes.

Marketplaces

Buyer, seller, account, and payout risks coexist.

These are exposure patterns, not claims that every merchant in a sector experiences them equally.

Fraud should not be stereotyped by country

Fraud patterns and available controls can differ by:

payment method;

authentication environment;

network rules;

identity infrastructure;

regulation;

ecommerce maturity;

merchant vertical.

But entire countries should not be labeled:

“high fraud.”

Market-specific evidence should drive market-specific risk policy.

How should merchants measure payment fraud?

The first rule is:

define the denominator.

Fraud rate by transaction count

Confirmed fraudulent transactions

÷ relevant transactions

Fraud rate by value

Confirmed fraudulent payment value

÷ relevant transaction value

Those are different measures.

Do not compare them as though they are interchangeable.

Fraud rate is not financial loss rate

Some value associated with fraud may ultimately be:

blocked before fulfillment;

recovered;

returned;

resolved through another process.

A useful merchant metric is therefore:

Net fraud loss

Gross fraud-associated loss

− recoveries

State what the calculation includes.

Track operating cost separately

A broader fraud-cost analysis may include:

confirmed fraud loss;

dispute-related cost not already counted;

fulfillment loss;

risk tooling;

attributable manual review.

Keep any measured false-positive opportunity cost separate unless the methodology supports combining it.

Avoid double counting.

Chargebacks are an incomplete fraud label

Chargeback data is useful.

It is also delayed and incomplete.

Why?

blocked fraud produces no chargeback;

some fraud never results in a dispute;

some disputes are not fraud.

The brief explicitly warns against building a fraud definition solely from chargeback outcomes.

Risk-engine decisions are not ground truth either

A transaction the merchant's system declined for risk is:

a risk decision.

It is not proof that the transaction was fraudulent.

Possible labels have different evidentiary value:

confirmed unauthorized;

merchant-confirmed abuse;

chargeback;

refund;

customer report;

model decision.

Treating the model's own decisions as ground truth can create a circular measurement problem.

The Payment Fraud Classification Matrix

A useful merchant worksheet is:

Question

Example values

Actor

External attacker / genuine customer / buyer / seller

Target

Card / account / identity / promotion / refund process / payout

Access

Compromised credential / legitimate access / constructed identity

Lifecycle stage

Signup / login / validation / checkout / fulfillment / refund / dispute / payout

Action

Unauthorized payment / account misuse / policy abuse / dispute

Value sought

Goods / service / cash / balance / promotion / refund

Merchant loss

Payment reversal / fulfillment / payout / discount / operations

Evidence

Confirmed fraud / dispute / behavioral signal / customer report

Control

Authentication / review / limits / account challenge / fulfillment control

False-positive risk

What legitimate behavior can look similar?

The matrix prevents teams from reducing every incident to:

“fraud score high.”

That supports claims about:

risk signals;

payment filtering/rules;

risk decision support;

human review.

It does not substantiate:

a universal fraud-reduction percentage;

zero false positives;

guaranteed approval improvements;

detection of every fraud category.

Keep fraud prevention and dispute resolution separate

That claim belongs specifically to chargeback dispute resolution.

It should not be rewritten as:

78% fraud prevention;

78% fraud detection;

78% false-positive reduction.

Fraud prevention and post-payment dispute outcomes are different stages of the lifecycle.

I would remove “Medusa” from the main publishable copy for now

The supplied foundation identifies:

Medusa and Passport

A restrained publishable paragraph is:

Suggested CTA

Payment Fraud Lifecycle visual

The primary graphic should use the brief's original framework rather than another generic fraud taxonomy.

ACTOR

External attacker

Genuine customer

Compromised account

Buyer / seller

Automated actor

↓

TARGET

Payment credential

Customer account

Identity

Promotion

Refund process

Marketplace payout

↓

ACCESS

Unauthorized credential

Account compromise

Constructed identity

Legitimate customer access

Automation

↓

EVENT

Signup

Validation

Payment

Fulfillment

Refund

Dispute

Payout

↓

VALUE EXTRACTION

Goods

Service

Money

Account value

Promotion

Refund

Payout

↓

MERCHANT LOSS

Reversal

Fulfillment loss

Refund loss

Dispute

Incentive loss

Operating cost

↓

EVIDENCE

Signal

Suspicion

Customer report

Dispute

Confirmed fraud / abuse

↓

CONTROL

Authenticate

Review

Challenge

Limit

Hold fulfillment

Decline

Post-payment response

Bottom callout:

Classify the fraud before choosing the control.

Image alt text

Payment Fraud Lifecycle showing how an actor targets a payment instrument, account, identity, promotion or merchant process, gains access, triggers a payment or account event, extracts value, creates merchant loss, leaves evidence and prompts a fraud-control decision.

What merchants should ask when investigating a fraud problem

Before changing risk rules:

What exactly was abused?

Who appears to have acted?

Is that conclusion confirmed or suspected?

Was a credential stolen, an account compromised, an identity constructed, or a legitimate process exploited?

Where did the behavior first enter the lifecycle?

What economic value was extracted?

How did the merchant actually lose money?

Which evidence supports the classification?

What legitimate behavior could produce similar signals?

Which control directly addresses this mechanism?

What false-positive or customer-friction cost could that control introduce?

How will the merchant know the intervention worked?

That investigative sequence is more useful than asking:

“Should we make the fraud score stricter?”

I’d use the shorter draft primarily for its SEO premise and reader intuition—especially the idea that “payment fraud” is much broader than stolen-card use and that the actor matters. I would not let first-party versus third-party become the article’s entire taxonomy, because the controlling brief calls for a more durable classification: actor + target + lifecycle stage + loss mechanism.

I’d also correct three points from the foundation before publishing: friendly fraud/first-party misuse should not automatically imply provable malicious intent; CNP fraud is a remote-payment context rather than a synonym for stolen-card fraud; and synthetic identity should be defined as a constructed identity using real and/or fabricated information, not necessarily one with “no actual victim.” Visa’s description of first-party misuse and the Federal Reserve’s synthetic-identity definition support those narrower distinctions.

SEO package

What Is Payment Fraud? Types, Examples and How It Works

Alternative SEO title:

What Is Payment Fraud? How Fraud Enters Online Payments

H1:

What Is Payment Fraud? How Fraud Enters the Payment Lifecycle and Blocks Growth

Recommended URL:

/solve/fraud-blocking-growth/payment-fraud-fundamentals/what-is-payment-fraud/

This preserves the URL already proposed in the supplied foundation.

what is payment fraud

Secondary keywords:

payment fraud

online payment fraud

ecommerce payment fraud

payment fraud examples

payment fraud types

payment fraud prevention

merchant fraud risk

fraud in digital payments

payment fraud meaning

first party payment fraud

third party payment fraud

payment fraud detection

payment abuse

fraud vs chargeback

Recommended meta description

What is payment fraud? Learn how stolen cards, account takeover, bots, synthetic identities and customer abuse enter the payment lifecycle—and how merchants distinguish fraud from chargebacks, refunds and legitimate activity.

Shorter alternative

Learn what payment fraud is, the major types of online payment fraud, where attacks enter the payment lifecycle, how merchants detect risk, and why false positives matter.

Article excerpt

Payment fraud is broader than a stolen-card transaction. It can target payment credentials, customer accounts, identities, promotions, refund processes and marketplace payouts. Merchants should classify fraud by actor, target, lifecycle stage and loss mechanism before deciding which controls to apply.

Suggested structured data

Article

BreadcrumbList

I would not add a generic FAQ solely for schema. The definition block, fraud-type sections, lifecycle, comparison headings and classification worksheet already cover the search-intent surface with substantially more differentiation.

Why this version is stronger for SEO than the foundation alone

The foundation's meta proposition—“not all payment fraud is theft”—is strong.

The expanded version improves search coverage by creating clear answer passages for distinct queries:

what is payment fraud

payment fraud meaning

payment fraud types

payment fraud examples

first-party vs third-party fraud

fraud vs chargeback

fraud vs refund

payment fraud vs payment abuse

what is a false positive in fraud

how payment fraud is detected

payment fraud lifecycle

payment fraud prevention

It also gives each dedicated cluster page a natural contextual link without letting the pillar cannibalize its detailed search intent.

Internal-link architecture

Types of Payment Fraud

Anchor:

compare the major types of payment fraud

Place after the multi-dimensional taxonomy explanation.

Card-Not-Present Fraud

Anchor:

how card-not-present fraud works in remote payments

Stolen Card Fraud

Anchor:

unauthorized use of stolen card credentials

Account Takeover Fraud

Anchor:

how account takeover compromises an existing customer account

Card Testing Attacks

Anchor:

how merchants identify card-testing patterns

Bot Payment Attacks

Anchor:

how automation changes payment-attack scale

Synthetic Identity Fraud

Anchor:

how synthetic identities differ from identity theft

Promo Abuse

Anchor:

distinguish promotional abuse from ordinary offer usage

Refund Abuse

Anchor:

identify abuse of merchant refund processes

Friendly Fraud

Anchor:

understand first-party and cardholder-initiated disputes

Subscription Fraud

Anchor:

map fraud across the subscription lifecycle

Marketplace Fraud

Anchor:

understand buyer, seller, account and payout fraud

Important cross-cluster internal links

How Declines Affect Payment Economics

Anchor:

why aggressive fraud controls can create false declines

Use from the false-positive section.

How Fraud Affects Net Revenue

Anchor:

measure the full economic effect of fraud and fraud controls

Use from the economic-impact section.

How Chargebacks Affect Net Revenue

Anchor:

separate dispute economics from fraud economics

Use from fraud-versus-chargeback.

Authentication / Fraud Prevention cluster

Anchor:

design controls for the specific fraud mechanism

Do not reproduce detailed control architecture here.

The brief explicitly reserves detailed prevention strategy for adjacent content and keeps this page focused on understanding what fraud is and how the system fits together.

Recommended related entities

Use naturally, not as a keyword list in the published copy:

payment fraud

ecommerce fraud

online payment fraud

card-not-present

unauthorized payment

account takeover

identity theft

synthetic identity

card testing

bot attack

first-party misuse

friendly fraud

refund abuse

promo abuse

subscription fraud

marketplace fraud

chargeback

authentication

3D Secure

false positive

fraud detection

risk signal

velocity

merchant risk

payment lifecycle

fraud loss

Authoritative source recommendations

Visa — first-party misuse

Useful for carefully distinguishing cardholder-originated disputes from classic stolen-credential fraud and avoiding the assumption that every first-party dispute proves malicious intent.

Federal Reserve — synthetic identity

Useful for the narrow definition of synthetic identity as a combination of real and fictional information.

FTC — identity theft

Useful for distinguishing unauthorized use of another person's personal/financial information from constructed identity or legitimate-account abuse.

Visa Secure / EMV 3-D Secure

Useful for the limited point that authentication can help address unauthorized CNP use while supporting legitimate-payment decisioning.

Europol — CNP fraud

Useful for defining unauthorized card-data use in non-face-to-face payment environments.

I would deliberately avoid generic global fraud-loss statistics in this pillar unless there is a compelling editorial reason to include them. The definition and lifecycle are evergreen; volatile headline numbers rarely improve the answer and create recurring fact-maintenance work.

Proposed author and reviewers

Author:

Fraud/risk reviewer:

[Named reviewer]

Payments risk lead:

[Named reviewer]

Merchant operations reviewer:

[Named reviewer]

Data reviewer:

[Named reviewer where fraud metrics remain]

Chargeback operations reviewer:

[Named reviewer for dispute terminology]

Security/privacy reviewer:

[Named reviewer where account/device signals are described]

Last reviewed:

[Publication date]

Do not state that review occurred until completed.

Best first-hand contribution

An approved anonymized fraud classification exercise would be more valuable here than a large headline statistic.

For example, show a set of merchant loss events categorized by:

actor;

target;

lifecycle stage;

evidence;

loss mechanism;

and demonstrate why “fraud” alone was an insufficient operational label.

Do not invent the example.

Fraud-definition fact-check items

Before publication verify:

Payment fraud definition used.

Payment abuse definition used.

First-party terminology.

Third-party terminology.

CNP definition.

Stolen-card definition.

Account-takeover definition.

Synthetic-identity definition.

Friendly-fraud terminology.

Chargeback versus fraud distinction.

Refund versus refund-abuse distinction.

Bot-as-mechanism distinction.

Attack-mechanism fact-check items

Verify any discussion of:

card testing;

automation;

account compromise;

synthetic identity;

payment credential compromise.

Keep mechanics defensive and high level.

Do not add:

evasion methods;

bypass instructions;

operational card-validation procedures useful to attackers;

sensitive rule thresholds.

Signal and data fact-check items

For any signal discussed verify:

whether merchant actually receives it;

which provider supplies it;

whether it is historical or real time;

how it is interpreted;

whether it is a signal or a confirmed label;

legitimate reasons the signal may occur.

Never state:

“signal X means fraud.”

Fraud-statistics fact-check items

If statistics are later inserted, record:

fraud category;

payment method;

market;

merchant segment;

timeframe;

count/value basis;

denominator;

source;

confirmation methodology.

The brief explicitly requires this discipline because fraud prevalence claims are otherwise easy to compare incorrectly.

Industry and market fact-check items

Verify any claim that one industry or market:

has higher fraud;

has more bots;

experiences more account takeover;

experiences more first-party misuse.

Do not stereotype markets.

Use merchant-specific or authoritative market evidence.

Regulatory and privacy flags

Fraud controls can involve:

personal information;

device data;

identity verification;

behavioral data;

automated decision-making;

authentication.

Requirements vary by jurisdiction.

Recommended disclaimer:

This article provides general information and does not constitute legal, regulatory, privacy, security, or compliance advice. Merchants should verify applicable requirements with qualified advisers, payment providers, fraud specialists, and relevant authorities.

Safety and abuse-enablement check

The article should explain:

what card testing is;

what account takeover is;

what bots change;

what signals merchants can monitor;

without explaining:

how to test stolen credentials successfully;

how to bypass fraud controls;

how to evade velocity detection;

how to defeat authentication;

how to exploit refund or promotion rules.

That is also explicitly required by the brief.

Amber-flag claims

“Payment fraud means stolen-card use.”

Too narrow.

“All CNP fraud is stolen-card fraud.”

Too narrow.

CNP is the transaction context.

“A bot attack is a fraud type.”

Incomplete.

Bots are an automation mechanism.

“Synthetic identity means a totally fake person with no real victim.”

Too absolute. Synthetic identities can combine real and fabricated information.

“First-party fraud always involves deliberate customer dishonesty.”

Too strong unless intent is established. Use first-party misuse or suspected first-party fraud where appropriate.

“Every chargeback is fraud.”

Incorrect.

“A refund is evidence of fraud.”

Incorrect without context.

“An issuer decline means the transaction was fraudulent.”

Incorrect. The brief explicitly separates issuer decline from confirmed fraud.

“A risk-engine decline proves fraud.”

Incorrect.

“A new device is fraud.”

Incorrect.

It is a signal.

“3D Secure prevents payment fraud.”

Too broad. It can help with relevant unauthorized CNP risks; it does not solve every form of fraud or abuse.

Requires current internal verification before using the product name prominently.

Before publication verify internally:

Current Passport Risk positioning.

Current risk-rule capabilities.

Current automatic-alert functionality.

Current transaction-filter capabilities.

Machine-learning risk engine terminology.

Data/signals used that may be described publicly.

Device capabilities.

Account-behavior capabilities.

Identity capabilities.

Velocity functionality.

Authentication support.

Manual-review workflow.

24/7 risk-team scope.

Reporting fields.

Fraud-label methodology.

Chargeback early-warning capabilities.

Current 78% dispute-win-rate scope and calculation.

“Digital transactions” denominator for that claim.

Ten-year observation-period wording.

Whether Medusa remains a current public product/brand.

Approved false-positive evidence.

Approved merchant case studies.

Named fraud/risk reviewer.

Named payments-risk reviewer.

Effective dates.

Do not expose proprietary thresholds or sensitive detection logic.

Cluster sameness audit

Field

This article

Title

What Is Payment Fraud? How Fraud Enters the Payment Lifecycle and Blocks Growth

Opening device

Fraud as an end-of-story label hiding different underlying systems

Fraud actor

Multiple: external attacker, genuine customer, buyer/seller, automation

Targeted asset

Payment, account, identity, merchant process

Entry point

Entire payment/account lifecycle

Attack mechanism

High-level umbrella

Merchant loss

Payment, fulfillment, refund, dispute, incentive, payout, operations

Primary signals

Signal families, not one checklist

False-positive risk

Central to definition/control distinction

Primary format

Fraud-system explainer

Unique anchor

Payment fraud is broader than a bad/stolen-card transaction

Editorial position

Classify actor + target + lifecycle + loss before control

Merchant decision

Determine what fraud/abuse problem actually exists

Original framework

Payment Fraud Lifecycle

Primary metrics

Fraud rate by count/value, net fraud loss, false-positive impact

Closing asset

Payment Fraud Classification Matrix

CTA

Review risk signals and controls by actual fraud mechanism

Generic FAQ

None

This preserves the intended cluster architecture: this page owns the conceptual definition and system, while Types of Payment Fraud owns the formal taxonomy and every later article owns its specific fraud mechanism.

Recommended final editorial line

The supplied foundation's strongest instinct is that merchants should stop using “fraud” as one undifferentiated label. The controlling brief makes that idea more useful:

Do not begin by asking which fraud tool to deploy. First determine who is acting, what they are targeting, where the abuse entered the lifecycle, how value was extracted, and what evidence actually supports that conclusion. Then choose the narrowest control that reduces the harmful activity without treating legitimate customers as collateral damage.

What Is Payment Fraud?

Payment fraud usually gets pictured as one thing: a stolen card, used by someone who isn't the cardholder. That's real, and it's a large share of the problem — but it's not the whole problem, and treating it as the whole problem is how a lot of fraud prevention ends up fighting the wrong fight.

A meaningful share of payment fraud isn't committed by an impostor at all. It's committed by the actual customer, using their own real card and their own real identity, with no intention of honoring the transaction — filing a dispute after a legitimate purchase, or applying for credit they never intend to repay. This is called first-party fraud, and it's structurally different from theft in a way that changes almost everything about how a merchant should respond to it.

The distinction that organizes everything else: who's actually committing it

Third-party fraud is what most people picture when they hear "payment fraud": someone using a stolen or fabricated identity — a stolen card number, a compromised account, a synthetic identity built from fragments of real and fake data — to make a purchase they have no legitimate claim to. The victim is a real person whose identity or payment credentials were taken without their knowledge.

First-party fraud is committed by the actual accountholder, using their own real, verified identity, acting in bad faith. There's no impostor here — the person making the purchase is exactly who they claim to be. What makes it fraud is the intent: disputing a legitimate charge to avoid paying for it, or in a lending context, borrowing with no intention to repay. Because the identity is genuine, first-party fraud passes identity verification checks that are specifically designed to catch the other kind of fraud — which is precisely why it's grown as third-party defenses have improved.

This distinction matters because the tools that stop one do close to nothing against the other. Identity verification, device fingerprinting, and stolen-credential detection are built to catch someone who isn't who they claim to be — they have no mechanism for catching someone who is. Conflating the two categories under one "fraud rate" metric leads directly to the mistake covered in How Declines Affect Payment Economics: tightening identity-based fraud rules to fight a first-party problem mostly succeeds at rejecting more legitimate customers, not more fraud.

The common forms of third-party fraud

Stolen card fraud — a card number obtained through a data breach, skimming, or phishing, used by someone other than the cardholder

Card-not-present (CNP) fraud — theft-based fraud specifically in online or phone transactions, where the absence of a physical card and chip makes stolen card details usable without the fraudster ever holding the card itself

Account takeover — a fraudster gains access to a customer's existing account (often through credential theft or phishing) and uses stored payment methods or account privileges to transact

Card testing attacks — small, automated transactions run against a merchant's checkout specifically to test whether a batch of stolen card numbers is still active, before using the valid ones elsewhere

Bot-driven payment attacks — automated, high-volume attempts (testing cards, exploiting promotions, or attempting account takeover at scale) run faster and more cheaply than a human fraudster could manage manually

Synthetic identity fraud — an identity built from a mix of real and fabricated information (a real government ID number paired with a fabricated name and address, for example) that doesn't correspond to any actual victim, making it harder to detect through standard identity-verification checks

The common forms of first-party fraud

Friendly fraud (chargeback fraud) — a legitimate customer disputes a charge they authorized, often claiming it was unauthorized or that the item wasn't received, despite having made a genuine purchase

Refund abuse — exploiting a merchant's refund or return policy, such as claiming an item never arrived or wasn't as described, to receive a refund while keeping the product

Promo abuse — creating multiple accounts, or exploiting sign-up incentives and referral programs, to claim promotional value well beyond what the offer was designed for

Subscription fraud — deliberately signing up for free trials with intent to dispute the first real charge, or misusing cancellation and billing disputes to avoid paying for services genuinely used

Where this gets more complicated: marketplace and mixed models

Marketplace fraud can involve either category, or both at once, depending on which side of the transaction is acting in bad faith. A buyer might commit first-party fraud by disputing a legitimate purchase from a marketplace seller; a bad-faith seller might commit a form of fraud against the platform or against buyers directly. Multi-sided platforms need fraud strategies that account for both directions rather than assuming the buyer side is the only risk surface. (See Marketplace Fraud.)

Why this distinction changes how merchants should respond

Because third-party fraud is committed by someone who isn't who they claim to be, identity-centric defenses work: stronger authentication, device fingerprinting, and behavioral signals that flag "this doesn't look like the real cardholder" are effective precisely because there's a real cardholder to compare against.

First-party fraud defeats that entire category of defense by design, because there's no identity mismatch to detect. The customer is genuinely who they say they are. Addressing it requires different tools entirely — chargeback evidence and representment, behavioral pattern detection across a customer's own dispute history, and policies that make bad-faith disputing and promo abuse less viable over time, rather than anything built to catch a stolen identity. (See Friendly Fraud Prevention and How to Respond to a Chargeback.)

The scale of the problem, treated with appropriate caution

Published estimates of global payment fraud losses vary considerably by source, methodology, and year, and should be treated as directional rather than precise — but the trend across nearly every current study points the same direction: rising losses, driven partly by increasingly automated and AI-assisted attack methods on the third-party side, and partly by the more slowly growing but persistent economics of first-party disputing. Some current industry research puts the effective cost of a dollar of fraud loss well above that dollar itself once chargeback fees, manual review labor, and operational overhead are included — a reminder that the visible loss on a chargeback statement understates the total cost of a fraud event on either side of this distinction.

Why this matters more as a business expands internationally

Both categories of fraud shift in character as a merchant enters new markets. Third-party fraud patterns vary by region — some markets see disproportionately more card testing and bot activity, others more account takeover — while first-party fraud tolerance and dispute culture can also differ by market in ways that are harder to model from a single home-market baseline. A fraud strategy tuned entirely to one market's fraud mix is likely miscalibrated the moment volume shifts into new geographies. (See Fraud Differences by Country and Industry and Payment Fraud in Latin America.)

Title

What Is Payment Fraud?

Url

/solve/fraud-blocking-growth/payment-fraud-fundamentals/what-is-payment-fraud/

Pillar

Fraud Is Blocking Growth

Cluster

A — Payment fraud fundamentals (lead page)

Not all payment fraud is theft. Some of it is your own customer, using their own real card, with no intention of ever paying. The distinction changes everything about how to stop it.

Status

draft — fraud cost figures checked against current industry research (July 2026); figures vary substantially by source and are presented as directional, not precise

Need help narrowing down payment options?

Answer a few questions about your business and compare the capabilities that matter to you.

Explore matching options ↗