Chargeback fraud detection is a stack of signals, each with a blind spot
Chargeback fraud detection is the set of checks that score an order for fraud risk before you ship, so a criminal's transaction gets held or declined instead of surfacing as a chargeback weeks later. It runs at checkout, on signals your payment stack already collects: the AVS result, the CVV result, how many cards a device has tried in an hour, whether the IP sits in the same country as the billing address.
None of those signals is proof. Each one catches a specific fraud pattern and stays blind to the rest, and every threshold you tighten to catch more fraud also declines more real customers. That tradeoff is the whole subject.
This is detection for third-party fraud, the criminal-with-stolen-credentials kind: card testing, account takeover, triangulation, and plain card-absent fraud. It is a different job from spotting friendly fraud, where the cardholder made the purchase and no checkout signal looks wrong. Everything below is about the fraud a signal can actually see.
What is chargeback fraud detection?
It is the screening layer between authorization and fulfillment. The card network approves or declines on whether the card is valid and funded; fraud detection is the separate question of whether the person holding the card is who they claim to be, yours to answer, not the issuer's.
The fraud it targets arrives on Visa as reason code 10.4, card-absent fraud, when the real cardholder later reports a charge they did not make. Detection tries to stop that transaction before it ships, because once the goods are gone and the chargeback lands, a genuinely unauthorized charge is close to unwinnable.
Detection does nothing for the other half of your 10.4 volume, the disputes where the cardholder did buy the item and disputed it anyway. Those look like clean orders because they are clean orders, a separate problem with a separate playbook.
What signals detect ecommerce fraud?
Every signal belongs to one of a few families, and each family answers a different question.
Card-verification signals ask whether the buyer is holding the card. AVS compares the billing address and ZIP against the issuer's record; CVV checks the digits printed on the card, which a stolen number alone does not carry. A mismatch on either pushes the order toward fraud.
Velocity signals ask whether this is one buyer or a machine. A burst of orders, cards, or failed attempts from one device, IP, or email in a short window is the fingerprint of card testing fraud, a bot running stolen numbers to find live ones.
Identity and device signals ask whether you have seen this actor before. Device fingerprint, email age and reputation, and phone reputation link a new order to prior behavior. A device signed into six accounts this week is the signature of account takeover fraud, a criminal riding a real customer's saved credentials.
Geolocation and order-shape signals ask whether the order hangs together. IP geolocation against the billing address, proxy and VPN detection, a billing-versus-shipping mismatch, and an order value or SKU mix that breaks from the norm each flag an order unlike your typical basket.
The table is the honest version: every one of these signals catches something and misses something.
| Signal | What it catches | Its limitation and false-positive risk |
|---|---|---|
AVS address match | A stolen card used without the real billing address | A fraudster with full card details passes it, and many non-US cards do not support AVS, so legitimate foreign orders fail |
CVV result | Card numbers used without the physical card, including tested numbers | Phishing and skimming capture the CVV too, and real customers mistype it |
| Velocity checks | Card testing and bulk runs, many cards or attempts in minutes | A launch, a flash sale, or a family on one network looks identical from the outside |
| Device fingerprint | Repeat fraud and account takeover from one device across many identities | Anti-detect browsers and privacy tools blank it, and shared or library devices trip it |
IP geolocation vs billing | Orders placed far from the stated billing region | Travelers, expats, and mobile networks route legitimately from the wrong place |
| Proxy and VPN detection | Buyers hiding their true origin | VPN use is now mainstream and privacy-minded, not criminal, so the false-positive rate is high |
| Email and phone age or reputation | Throwaway accounts spun up for card testing or takeover | Genuine new customers and relay addresses like Hide My Email read as brand new |
| Billing vs shipping mismatch | Reshipping and triangulation to a drop address | Gifts, office deliveries, and forwarding services are ordinary and legitimate |
| Order value or SKU anomaly | Oversized orders and high-resale items favored by fraud | Your best real customers and gift buyers also place unusual orders |
How does fraud scoring work?
No single signal decides anything. Fraud scoring is the model that weighs all of them at once and returns one number, the probability an order is fraudulent, so you act on the total rather than argue each signal.
Stripe Radar scores every payment from 0 to 99 using, in its own words, hundreds of risk factors and data across its network of businesses. By default a score of 65 or above is elevated risk and 75 or above is high risk, and high-risk payments are blocked automatically (docs.stripe.com/radar, checked 2026-08-07). Shopify's fraud analysis is coarser, sorting each order into low, medium, or high risk from indicators like whether the order passes AVS, whether the CVV matched, the IP details, and whether the buyer tried more than one card, on a model trained across all Shopify stores (help.shopify.com, checked 2026-08-07).
The score feeds three lanes: block the clearly fraudulent, allow the clearly clean, and route the uncertain middle to a manual-review queue where a person weighs context a model flattens. Automation handles the volume, review the judgment calls, and the width of that middle band is a business decision, not a technical one.
Fraud scoring is one layer of prevention, aimed at third-party fraud. It leaves untouched the avoidable disputes that come from confusion rather than crime, an unclear billing descriptor or a delivery estimate that slipped, the gap Resolve is built to close.
Where detection sits in your chargeback stack
Detection is the front line, not the whole line. It is one layer of chargeback protection, which also covers deflection before a dispute is filed and representment after one lands.
Some fraud clears every check. A criminal holding full card details passes AVS and CVV, ships to a clean address, and looks ordinary until the real cardholder reads their statement. That lands as a 10.4 you will rarely win.
The disputes worth fighting wear the fraud label without being fraud, where your own records show the cardholder received what they ordered. Sorting those from the genuine article and building the evidence is representment work. Reclaim handles that recovery at no cost, so the cases detection could never have stopped still get contested.
Can fraud detection stop all chargebacks?
No, for two structural reasons.
The first is false declines. Every threshold that catches more fraud also rejects more real customers, and past a point lost sales cost more than the fraud avoided. A merchant bragging about a near-zero fraud rate is often quietly declining good orders to get there.
The second is that no score is certain. Stripe says plainly that a normal-risk payment can still turn out fraudulent, and it modifies a small share of reported scores just to measure its own error rate (docs.stripe.com/radar, checked 2026-08-07). A probability is not a verdict.
One more limit is worth stating flatly. Winning does not clean your ratio anyway: a dispute counts toward your Visa VAMP ratio whether you win the representment or lose it. The only fraud that never touches the ratio is the fraud detection stops before it disputes, and each chargeback that lands still carries a fee of roughly $15 to $25 or more on top of the lost goods.
Frequently asked questions
What is the difference between fraud detection and fraud prevention?
Fraud detection is the scoring step that flags a risky order at checkout. Fraud prevention is the broader outcome of acting on that score, plus the non-fraud measures that stop avoidable disputes, like a clear billing descriptor and accurate delivery estimates. Detection is one input to prevention, not the whole of it.
Can you detect chargeback fraud with AVS and CVV alone?
Only partly. AVS and CVV catch a stolen card used without the real billing details, but a fraudster holding full card data passes both, and legitimate customers fail them through typos or unsupported foreign cards. On their own they miss card testing, account takeover, and any fraud committed with complete credentials, which is why scoring combines them with velocity, device, and geolocation signals.
What is a good fraud score threshold?
There is no universal number, because the right threshold depends on your margins and your fraud rate. Stripe Radar defaults to treating 65 and above as elevated and 75 and above as high risk, but those are starting points. A high-margin brand can afford to accept more risk, a low-margin one blocks earlier. Set it from your own declined-versus-disputed order data, not a default.
Does fraud detection stop friendly fraud?
No. Friendly fraud, or first-party misuse, is a real cardholder disputing a purchase they made, so the order carries no fraud signal at checkout and every score reads clean. Detection targets third-party fraud committed with stolen credentials. Friendly fraud is addressed after the fact, through prevention that removes confusion and through representment that proves the cardholder received the goods.
The test worth running
Pull two samples from last quarter: a batch of orders you declined or canceled for fraud, and a batch that came back as fraud chargebacks. The declines measure your false positives, how many, read cold, look like orders you should have kept. The chargebacks measure your misses, which signals were green on an order that turned out fraudulent.
Those two piles are the two ends of the dial. If the decline pile is full of ordinary-looking customers, you are tuned too tight and paying in lost sales. If the chargeback pile shares an obvious signal your rules ignored, you can tighten without touching good orders. Calibrate from your own orders: the right setting is specific to your basket, geography, and margins, and no vendor default knows any of that.