Card fraud prevention for merchants.

Card fraud prevention comes down to verifying that the card and the cardholder are real at the moment of payment, and keeping card data out of places where it can be stolen. In person, that means chip and tap payments and terminals that are checked for tampering. Online and by phone, it means address and security-code checks, cardholder authentication and a sharp eye for unusual orders.

Fraud costs merchants twice: once in lost goods and again in chargebacks and fees. This guide walks through the common types of card fraud, the warning signs and the tools that work. It pairs well with our guides on how to prevent chargebacks and PCI compliance for small business.

The common types of card fraud

Type	How it works	Where it happens
Counterfeit cards	Stolen card data written onto a fake card	In store, mainly on swiped transactions
Skimming	A hidden device copies card data at the terminal	Terminals, pumps, kiosks
Card-not-present fraud	Stolen card numbers used without the physical card	Online, phone, mail orders
Card testing	Fraudsters run many small charges to find working cards	Online checkouts and donation forms
Account takeover	A criminal logs in to a real customer account	Online stores with saved cards
Friendly fraud	A real customer disputes a real purchase	Anywhere
Refund fraud	Refunds issued to a card that didn’t make the purchase	In store, often internal

Protecting in-person payments

Chip cards changed in-person fraud by creating a one-time code for every transaction. To get the full benefit:

• Dip or tap every card that has a chip. Swiping a chip card gives up its protection. See EMV chip cards.
• Avoid keying in a card that is present. Keyed transactions skip the chip and are riskier.
• Inspect terminals regularly. Look for overlays, loose parts or extra wires, and compare against a photo of the untouched device.
• Secure unattended devices. Pumps, kiosks and self-checkout need regular checks and tamper-evident seals.
• Watch for fallback. A card that “won’t read” and must be swiped is worth a second look.
• Control refunds. Require a manager code for refunds and review them regularly.

Protecting online and phone payments

Without a physical card, you need other ways to confirm the buyer is the cardholder. Layer these:

1. Address verification (AVS). Checks the billing address against the issuer’s records.
2. Card security code (CVV) checks. Suggests the buyer has the card in hand. Never store the code.
3. 3-D Secure. Lets the issuer authenticate the cardholder and can shift liability for certain fraud chargebacks.
4. Velocity limits. Cap how many attempts a single card, device or address can make in a short time.
5. Bot protection. A challenge on checkout and donation pages slows down card testing.
6. Manual review for risky orders. Hold unusual orders before shipping.

Warning signs worth a second look

• A first-time customer placing a large, rushed order
• Billing and shipping addresses far apart, or shipping to a freight forwarder
• Several cards tried in a row, or many small declined charges
• A phone caller who reads card numbers from a list or keeps changing cards
• Requests to split a large purchase across several cards
• Pressure to ship overnight or to refund to a different card

One sign alone isn’t proof of fraud. Several together are a reason to pause, verify or decline.

Phone orders deserve their own process

Phone orders combine the risks of card-not-present payments with the pressure of a live caller. Give staff a simple routine: key the card straight into the terminal or virtual terminal, never on paper; ask for the billing ZIP code and security code so the checks can run; read back the order and amount; and send an emailed receipt to the customer. If a caller won’t give the billing details, keeps switching cards or pushes for a rush shipment to a new address, it is fine to pause and call them back at a number on file.

Keep card data out of reach

The safest card data is the card data you never hold. Use encrypted terminals, hosted payment pages and tokens for cards on file, so a breach of your systems can’t expose card numbers. Our guide to tokenization and encryption explains how. And stay current on PCI basics: unique logins, updated software, changed default passwords and guest Wi-Fi kept separate from payment devices.

Train your team

Many fraud attempts target people, not technology. Teach staff to recognize phishing emails, callers posing as your processor or “tech support” asking to service a terminal, and customers who pressure them to override declines. Make it normal to say, “Let me check with a manager.” Your processor will never ask for full card numbers or passwords by phone or email.

If you suspect fraud

Act quickly. Stop using any device you think was tampered with, but don’t throw it away. Call your processor, describe what you saw and follow its guidance. If you suspect a data breach, keep records and logs intact. If you carry PCI insurance, contact your insurer too. For legal obligations, talk with your own advisor.

What PayZoom does

PayZoom sets merchants up to stop fraud at the source: chip and tap terminals, payment gateways with address and security-code checks and tokenization, and PCI compliance help with no non-compliance fees. PCI audits and PCI insurance are available when you need them.

If something looks wrong, call 866.242.4325 and a real person answers. Support is never outsourced. Start with a free statement analysis to review your current setup.