Holiday season webinar recap: Payment risk, policy abuse and white signals

Fraud is local

The first thing the panel wanted merchants to hear is that fraud is not one problem. Each region has its own patterns, and a defence tuned for one market can miss the fraud in another.

North America

In North America, payment risk stays high and policy abuse around refunds and returns has grown with it. Tarun Singh put the shift bluntly: "They're not hackers any more. Those are scammers. They know how to… they know the social engineering stuff. It's pretty easy."

That changes what you are defending. The opponent is not probing your stack; they are reading your returns policy and calling your support line.

Regional patterns

One global rule set fails against fraud that is tailored by region. A few of the patterns raised:

• India: scams run over WhatsApp, because that is where commerce and conversation already happen.
• United States: gift card scams, because the cards are popular and the spend is hard to trace.
• Europe and elsewhere: each market has its own mix.

Tauwfiq Wahidi described the scammers' side as a business with a target market: "If you have scammers who understand what geography they are operating with, it's more or less like a business for them, right?" They pick their demographic too, he added, deciding whether to go after older people or younger ones.

So a control that works in one market can fail outright in another. Study the markets you sell into and set the defences per market.

The two schemes that matter most: Payment risk and policy abuse

Asked where holiday losses come from, the panel named two categories.

1. Payment risk

Payment fraud is still the base problem for most marketplaces. It covers:

• Unauthorised transactions on stolen payment credentials
• Chargebacks that come straight out of revenue
• Card testing against the merchant's own checkout
• Account takeover followed by purchases on the stored card

The loss is immediate, and the investigation load lands on teams already stretched by holiday volume.

A worked example: The unauthorised transaction

Alice's card details leak in a breach at another company. Bob uses her card number and security code to buy a $500 electronics item on your marketplace. Alice sees the charge and calls her bank; the bank issues a chargeback. You lose the $500, pay a chargeback fee on top, and the item is already with Bob. Your operations team then spends hours on the investigation and the dispute paperwork. One order, three losses.

2. Policy abuse: Refund and return fraud

The second category is abuse of refund and return processes. The patterns:

• Refunds claimed under lenient policies without a real return
• Warranty claims on products never bought, or used hard first
• Serial returns that point to an organised operation
• Refunds extracted by social-engineering the support team

Tarun Singh: "The refund return, that is going to be one thing which you need to look at. And again, this is based on the business. What kind of business are you in and what kind of fraud has hit your platform?"

Policy abuse costs twice, once in the refund and again in the operational mess: support queues, inventory that never comes back, analyst hours spent on claims. The textbook case is a customer who buys an expensive electronic item, uses it for a week, returns it as "defective" under a no-questions-asked policy, and then keeps it (the empty box scam) or ships back a cheaper item in the original packaging (return swapping).

What fraud does to the business

The damage goes past the refund line. Three effects the panel kept returning to:

• Operational strain. Support drowns in disputes and compromised-account cases, returns fraud corrupts inventory, finance spends its time on chargebacks and reconciliation.
• Lost trust. Account breaches, visible abuse or heavy-handed controls all push customers away, and trust is slow to rebuild.
• Fast-moving risk. With AI in the attackers' hands, a defence that worked last quarter can be obsolete now.

AI speeds up the attacker

Attack techniques change faster now that attackers have AI tools of their own. A defence that worked last quarter may be useless today, so pattern reviews have to be continuous rather than annual.

Fraud controls in the holiday rush protect revenue, and more than that they protect the trust that brings the customer back in January.

The balance

The hard part is strong detection without friction for the genuine customer.

Too much friction:

• Loyal customers hit by false declines
• Carts abandoned at a verification step
• Bad reviews and social media complaints
• Customers moving to a competitor with an easier checkout

Too little control:

• Customer accounts taken over
• Customer and payment data stolen
• Reputation damage
• Fines and legal exposure

Getting the balance right

The panel's recipe has four parts:

1. Know your customer base. What normal looks like for each segment.
2. Apply friction selectively. Extra verification only when the risk signals call for it.
3. Explain the friction. When you do ask for more, tell the customer why.
4. Resolve fast. When fraud happens or a good customer is caught, fix it quickly and fairly.

Merchants that manage this protect revenue and reputation through the peak and after it.

Seven things to do before the peak

From the discussion, seven changes a merchant can make now.

1. Know your own risk profile

Fraud does not hit every business the same way. Assess your markets and their fraud patterns, your vertical's usual schemes, your customer demographics, and which product categories attract fraud.

2. Set defences per region

If you sell in several regions, let the controls differ:

• Risk thresholds by transaction origin
• Verification requirements by region
• Monitoring for the scam types common locally
• Payment processors that know the regional fraud

Seasonal peaks and regional promotions spike fraud in specific places. Tighten where holiday risk rises: higher velocity, unusual shipping addresses, sudden promo abuse.

3. Go after policy abuse

Refund and return fraud is growing, so:

• Review return policies and tighten where it is safe to
• Use a return merchandise authorisation (RMA) process
• Track serial returners and high-return-rate accounts
• Train support to recognise social engineering
• Consider restocking fees for excessive returns

4. Train the staff who get social-engineered

Since the fraud runs through people:

• Teach support teams the common manipulation tactics
• Write clear escalation steps for suspicious requests
• Let staff question unusual account changes without penalty
• Refresh the training as new schemes appear

5. Monitor accounts

Use white signals (more on these below):

• Establish a behavioural baseline for every account
• Run real-time anomaly detection against it
• Watch for sudden pattern changes in trusted accounts
• Flag account takeover indicators: password changes, new devices, location shifts

6. Review often

Patterns change, so:

• Review fraud patterns and control performance monthly
• Subscribe to fraud intelligence feeds
• Share intelligence in merchant and industry forums
• Be ready to change approach when a new pattern shows up

7. Layer the defences

No single control is enough:

• Automated scoring plus human review for high-risk transactions
• Several data points per risk decision, not one
• Step-up authentication for account changes
• Monitoring both before and after the transaction

The fraudster has changed

The theme that ran through the whole discussion was the change in who commits fraud. Tarun Singh again: "I wouldn't like it, they're not hackers anymore. Those are scammers."

From technical to social

Today's fraudsters exploit people and processes rather than systems. They study their target demographics, know what moves each segment, run their operations like businesses with defined markets, and switch methods as soon as a defence closes one.

Fraud as a profession

The work is organised: target segments chosen by age and income, approaches tailored by geography and culture, legitimate channels (support, returns, warranty claims) used as the attack surface, and networks that share what works.

Old assumptions about how fraudsters behave no longer hold, and defences built on them leak.

Use genuine behaviour to find fraud

The panel's most useful idea was a reversal: instead of hunting only for fraud indicators, model what genuine users do and watch for departures from it. They call these white signals.

What white signals are

White signals are evidence of legitimate, trustworthy behaviour. Tauwfiq Wahidi: "One of the biggest white signals is your account history of what you've been doing with your account, are you a trusted account?"

White signals worth tracking

Account history and age. Older accounts with consistent behaviour give a trust baseline, and long-term users with regular patterns are usually genuine. As noted in the discussion: "The older the device, the trusted the device helps a lot".

Transaction patterns. Steady purchasing over time, return rates in line with the platform average, predictable order values and frequency.

Behavioural consistency. Logins from familiar devices and locations, the usual browsing before a purchase, normal patterns of contact with support.

Catching the anomaly

The value of a white signal is in the break. When a trusted account departs from its pattern, that is the flag:

• A sudden spike in returns or cancellations
• A high-value purchase from an account that has always spent modestly
• A change of delivery address or payment method
• A password change followed immediately by a transaction

Tarun Singh on that last one: "If you see there is a password change with a login involved then you got to be like hey though this is a white signal I got to be cautious."

Done this way, genuine customers never see friction and the accounts that drift get a closer look.

Preparing for the next peak

The panel split its advice into what to do before the peak and what to build for the longer term.

Before the peak:

1. Check your current controls against the payment and policy abuse threats above
2. Train the team on social engineering tactics
3. Confirm white signal monitoring is running and producing alerts
4. Prepare for volume surges that hide fraud in the noise

For the longer term:

1. Build fraud intelligence capability in-house
2. Invest in machine learning for pattern recognition
3. Build working relationships with payment processors and fraud prevention vendors
4. Create feedback loops between fraud, support and product teams

Nothing stays tuned

Fraud prevention does not finish. Tauwfiq Wahidi on tracking customer behaviour: "Anything which is not in line with the customer's repeated history becomes an immediate red flag."

The same rule applies to your own numbers. A fraud pattern that departs from what you expect deserves investigation, and possibly a change of approach.

What to take from the panel

Peak season puts peak revenue and peak risk in the same weeks. The panel's four conclusions are the shortest guide to holding both:

Fraud is local. Tune defences per market, and expect North American merchants to carry the heaviest payment and policy abuse risk.

• The fraudster is a scammer, not a hacker. They exploit psychology and process, not code.
• Balance matters. Stop fraud without punishing genuine customers.
• Review constantly. With AI on the attacker's side, last quarter's rules may already be stale.

Before the next peak

If you do one thing after reading this, do it now rather than in November:

• Review the controls you have against the threats above
• Put scoring in front of checkout and login before the surge, not during it
• Train the whole team on fraud awareness, not just security staff

Fraud defence is collaborative. Share intelligence with peers and join the fraud prevention forums for your region and vertical; the scams get harder and less profitable for everyone running them.

Sensfrx scores every signup, login and payment in real time from device, network and behaviour signals, and your rules decide what to allow, review or block. Start on the free plan before the surge; there is also a 14-day trial.