Online transaction fraud: The four main types and how to stop each

What online transaction fraud is

Online transaction fraud is unauthorized access to, or manipulation of, a financial transaction made over the internet. It starts with stolen data: card numbers, identity details or login credentials taken through phishing emails, malware or a breach at an online retailer.

With that data the fraudster logs into the victim's bank or ecommerce account, or pays with the stolen card. They buy goods, move funds, or sell the data on the dark web for someone else to use.

Where in the transaction fraud happens

Fraudsters work the touchpoints between a business and its customers. Five of them matter most.

1. Account creation

Stolen or synthetic identities open new accounts. Existing accounts are taken over through credential stuffing or phishing.

2. Login and authentication

Brute force and social engineering get past the authentication step. Once inside, the fraudster changes account settings or starts transactions.

3. Payment processing

Stolen payment credentials go through the checkout, or the transaction data is tampered with on its way to the gateway. Weak authorization logic is the usual gap.

4. Order fulfillment

After a fraudulent order is approved, the fraudster reroutes delivery to an address they control, or runs the order through a legitimate platform as triangulation fraud.

5. Customer support

The fraudster poses as the customer to a support agent and talks them into changing account settings, issuing refunds or raising the account's privileges.

Each touchpoint feeds a different type of transaction fraud. A control at the checkout alone misses the account that was created or taken over earlier.

The four main types and how to stop each

Four types account for most of the losses.

1. Credit card fraud

Credit card fraud is the use of stolen or counterfeit card details to pay for something. The details come from a handful of sources.

• Card testing. Scripts run stolen card numbers through an ecommerce checkout in small amounts to find out which ones still work before making larger purchases.
• Skimming. Devices fitted to ATMs, POS terminals or fuel pumps copy card data during a normal payment.
• Phishing. Emails, messages or sites that imitate a bank or retailer and ask the victim to enter card details.
• Data breaches. Retailers, banks and third-party vendors are broken into for card data in bulk.
• Malware. Infected computers, POS systems or phones capture card details as they are typed or sent.

What cardholders can do

The warning signs are on the statement.

• Treat a large charge from a site you do not recognize as fraud until proven otherwise.
• Read bank statements for charges you did not make.
• Do not enter card details on sites or apps you do not know.
• Check credit reports for accounts or inquiries you did not open.

What merchants can do

Four controls cover most of it.

• Address Verification System (AVS). AVS compares the billing address the customer enters with the one the issuer holds. A mismatch is a reason to review the order.
• Card testing validators. Watch decline rates, order sizes and velocity per card, IP and device, and flag the bursts of small payments that mark a testing run.
• A payment processor or gateway that is PCI DSS compliant, so card data is encrypted and tokenized and never sits on your servers in the clear.
• Your own PCI DSS compliance: access controls, regular security assessments and the rest of the standard's requirements for anyone who handles cardholder data.

2. Triangulation fraud

Triangulation fraud uses a fake storefront to collect card details, then spends them at a real one. It runs in four steps.

1. The fraudster builds a site that copies a legitimate marketplace or retailer, branding included.
2. A customer orders from the fake site and enters their payment details.
3. The fraudster uses those details to place an identical order on the real site.
4. The real merchant fulfills the order and ships the goods to the customer's address.

What shoppers can do

• Shop on sites served over HTTPS, so payment data is encrypted in transit.
• Check the URL. A copy differs from the original by a character or a domain ending.
• Leave a checkout that asks for personal information it does not need, or that pushes an odd payment method.

What merchants can do

• Two-factor authentication at login and at payment.
• Behavioral analytics on purchase patterns, so an order that does not fit the account's history goes to review.

3. Chargeback fraud

Chargeback fraud is a customer paying by card, receiving the goods, then disputing the charge with their issuer. Chargebacks exist to protect cardholders from unauthorized payments and dishonest merchants. Used this way, they are a method of getting goods for free.

What it costs a merchant

The lost sale is the smallest part. Each chargeback adds a fee, staff time to contest it, and the risk of penalties from the processor or card network.

A pattern of disputes also costs trust, repeat business and word of mouth.

How merchants reduce it

Two controls do most of the work.

1. Add a verification step on high-risk orders, such as a one-time password sent to the registered phone or email, so the cardholder has confirmed the payment before it completes.
2. Use a billing descriptor the customer will recognize. A statement line that shows your trading name and the product stops the "I do not recognize this charge" dispute before it is filed.

4. Identity theft fraud

Identity theft fraud is the use of someone else's name, Social Security number, card details or other identifying data to act as them. With a working identity the fraudster opens accounts, buys goods and applies for loans, and leaves the victim with the debt and the clean-up.

Where the personal data comes from

• Phishing for passwords, account numbers and Social Security numbers.
• Breaches at businesses and government agencies that expose records in bulk.
• Dumpster diving for bank statements, card statements and utility bills.
• Malware that reads data stored on a device or intercepts it in transit.
• Dark web markets where stolen identities are bought and sold.

What individuals can do

• Do not give Social Security numbers or account details to sites or apps you do not know.
• Check bank and card statements for withdrawals you did not make, and report them at once.
• Treat a bill for an account or service you never opened as a sign someone is using your identity.

What businesses can do

• Watch behavior after login. Repeated failed logins, sudden changes to account settings and high-risk transactions are the signs of a stolen identity in use.
• Keep only the customer data you need. Data you do not hold cannot leak.
• Require strong authentication, multi-factor or biometric, at login and at payment.
• Meet the data protection rules that apply to you, such as GDPR or HIPAA.

How Sensfrx stops transaction fraud

Sensfrx transaction fraud prevention scores every payment in real time from transaction data, user behavior and device fingerprint, and covers chargeback, checkout and payment fraud as well as account takeover. Data is encrypted in transit, device fingerprinting recognizes returning devices, and behavioral analysis flags the sessions that do not fit.

Dynamic risk scoring and friendly-fraud validators pass the transactions that are legitimate and hold the rest for review or block. Customers include NodeSpace and HOSTPRO. Start on the free plan and score your first payments the same day.