Introduction
Merchants need to detect suspicious card transactions without turning every unusual order into a declined sale. That balance matters because fraud controls that are too weak increase chargebacks and loss, while controls that are too aggressive can reject legitimate customers and damage conversion.
The most effective approach is layered risk assessment. Instead of relying on one field, merchants combine authorization results, cardholder-verification signals, EMV 3-D Secure data, device and account context, order history, velocity, behavioral anomalies, and post-transaction feedback.
EMVCo describes EMV 3-D Secure as an e-commerce fraud-prevention protocol that enables cardholder authentication and supports risk assessment for card-not-present transactions. Visa and Mastercard also provide services such as address and card-verification checks that can contribute useful evidence during payment decisioning.
No individual signal proves fraud. A billing-address mismatch may be legitimate. A first-time customer may place an expensive order. A customer may travel, use a new device, or ship a gift to another address. Merchants therefore need risk scoring, escalation, and human review rather than brittle one-rule systems.
This article is defensive. It explains merchant detection principles without publishing bypass thresholds, exact rule values, fraud-model weights, or other details that could help criminals tune transactions against a merchant's controls.
Quick Answer: How Should Merchants Detect Suspicious Transactions?
Use multiple independent signals rather than one yes/no rule.
Validate the payment account and use AVS and CVV/CVC results where supported.
Use EMV 3-D Secure for appropriate e-commerce transactions and incorporate authentication outcomes into risk decisions.
Compare the transaction with the customer's normal account, device, order, and payment behavior.
Watch for abnormal velocity, repeated declines, rapid account changes, unusual shipping patterns, and inconsistent identity signals.
Use fraud scoring or machine-learning systems to combine signals consistently.
Route medium-risk orders to stepped-up authentication or manual review instead of automatically declining everything suspicious.
Feed confirmed fraud, chargebacks, refunds, and false positives back into the detection system so controls improve over time.
Principle 1: One Signal Is Not Enough
Fraud detection works best when weak signals reinforce one another.
A single address mismatch can occur because a customer recently moved. A new device can appear after a phone upgrade. A large basket can be legitimate during holidays.
But several inconsistencies occurring together can justify stronger verification.
The merchant should evaluate the whole transaction rather than treat one field as conclusive proof.
This also reduces false positives and makes fraud controls more resilient as consumer behavior changes.
Principle 2: Separate Authentication, Authorization and Fraud Risk
These concepts are related but different.
Authentication asks whether the payer can be verified as the legitimate cardholder or authorized user.
Authorization asks the issuer whether the transaction can be approved against the account.
Merchant fraud risk asks whether the order, customer, device, fulfillment pattern, and surrounding behavior are suspicious.
A transaction can be authorized and still later become disputed. Likewise, a legitimate customer can fail one risk signal and still be genuine.
Merchants should use the layers together rather than assuming issuer approval guarantees that an order is safe.
Authorization Responses Are Foundational
Merchants should respect issuer authorization responses and avoid attempting to override or work around declines.
Authorization provides issuer-side information about the payment account and transaction.
A successful authorization is necessary for many card transactions, but it is not a complete fraud guarantee.
Merchant systems should preserve relevant authorization metadata so later disputes and fraud analysis can reconstruct what happened.
Use Account Verification Before Saving or Reusing a Card
When a customer first saves a card or establishes a card-on-file relationship, supported account-verification services can help validate that the payment account is eligible and correctly presented.
Visa Acceptance Solutions describes account verification as helping validate payment accounts when they are first used or saved, reducing fraud risk and avoidable declines.
Account verification should complement account security, authentication and transaction monitoring rather than replace them.
Use AVS as a Risk Signal, Not a Verdict
Address Verification Service compares billing-address information supplied during a card-not-present transaction with information held by the issuer or payment network.
Mastercard describes AVS as a security feature that compares the payer's billing address with issuer records. Visa likewise provides address verification to reduce risk exposure during CNP transactions.
A mismatch can be useful context, but merchants should consider legitimate causes such as recent moves, formatting differences, corporate cards, international addressing, or data-entry mistakes.
The safest design is to feed AVS outcomes into a broader risk score or review workflow rather than expose a simple public rule such as “mismatch equals decline.”
Use CVV or CVC Results Carefully
Card-verification values can help indicate that the shopper has access to card details not normally printed in receipts or stored by compliant merchants.
Visa and Mastercard both support card-verification checks for card-not-present transactions.
A failed verification is relevant, but a successful result does not prove that the payer is legitimate because criminals can sometimes obtain complete card details through phishing, malware, or compromised checkout pages.
PCI DSS also restricts storage of sensitive authentication data after authorization, so merchants should not retain card-verification values for future convenience.
EMV 3-D Secure Adds Stronger Context
EMV 3-D Secure allows merchants and issuers to exchange data to authenticate consumers and assess e-commerce risk.
EMVCo says the protocol is designed to prevent card-not-present fraud while avoiding unnecessary friction.
Lower-risk transactions can proceed with little or no visible challenge, while higher-risk activity can trigger issuer authentication.
Merchants should use the authentication result and related risk information as part of the fraud decision rather than judging a transaction only by whether an OTP was shown.
Risk-Based Authentication Beats Challenging Everyone
Requiring a challenge for every customer can damage conversion and user experience.
Modern authentication is designed to allow frictionless treatment for lower-risk activity while stepping up verification when risk is higher.
The merchant's fraud system can help determine when stronger authentication is appropriate, while issuer-side 3DS risk assessment contributes another independent layer.
The objective is not maximum friction; it is appropriate friction.
Device Context Can Reveal Anomalies
Device information can help distinguish familiar behavior from unusual activity.
Useful defensive context can include whether the device has been seen on the account before, whether device attributes change abruptly, whether many unrelated accounts appear from the same environment, and whether browser or application behavior is consistent with normal customers.
Device signals should be privacy-aware, lawfully collected, and combined with other evidence.
A new device alone is not fraud. Customers replace phones, clear cookies, use work computers, and travel.
Account History Is Often More Valuable Than a Single Order
An established customer account provides a behavioral baseline.
Merchants can compare the current transaction with previous order values, products, shipping patterns, payment methods, account age, login history, and prior disputes.
An abrupt change can justify additional verification.
But merchants should account for legitimate life events, seasonal purchases, gifts, and travel.
Risk systems should reward trustworthy history without treating new customers as automatically fraudulent.
Watch for Suspicious Account Changes Before Checkout
Fraud often begins before the payment request.
A criminal who takes over an account may change the password, email, phone number, shipping address, or saved payment method shortly before placing an order.
Merchants should treat sensitive account changes as events that can increase risk for subsequent transactions.
High-risk changes can trigger reauthentication, session review, or temporary restrictions.
This helps detect account-takeover fraud even when the card itself passes ordinary validation.
Velocity Monitoring Can Identify Automated or Repeated Abuse
Velocity refers to how frequently related events occur over a period of time.
Merchants can monitor unusual repetition across orders, accounts, cards, devices, addresses, or other internal risk entities.
The value comes from detecting behavior that is inconsistent with normal customer activity.
Exact velocity thresholds should remain private and adaptive because public static rules are easier to game.
Legitimate high-frequency customers should be handled through contextual scoring rather than blunt limits.
Repeated Declines Can Be a Warning Sign
A cluster of unsuccessful payment attempts can indicate normal user error, expired cards, issuer issues, or suspicious automated behavior.
Merchants should analyze repeated declines in context rather than simply allowing unlimited retries.
Controls can include sensible retry handling, session risk evaluation, account protections, and rate controls.
The system should avoid revealing detailed issuer or fraud-rule information back to the user beyond what is needed for a normal checkout experience.
Unusual Basket Composition Can Add Risk Context
Fraud risk is not determined by product category alone, but certain order patterns can differ sharply from a merchant's normal customer behavior.
A sudden shift in basket size, quantity, product mix, delivery urgency, or resale-oriented goods can contribute to a risk score.
Merchants should use their own historical data rather than copy generic “high-risk product” lists from the internet.
The goal is anomaly detection, not publishing a catalog of what criminals should target.
Shipping and Billing Inconsistencies Need Context
Different billing and shipping addresses are common for gifts, travel, business purchases, and customers who recently moved.
They should not trigger automatic decline by themselves.
But unusual address combinations can contribute to a broader risk assessment when combined with new-account status, device anomalies, authentication failure, unusual velocity, or other signals.
Merchants can also validate addresses for deliverability and consistency without treating every mismatch as fraud.
Expedited Fulfillment Can Increase Operational Risk
Fraudsters may prefer orders that leave little time for review, but legitimate customers also pay for urgent delivery.
Merchants can incorporate fulfillment urgency into risk scoring while preserving fast service for trusted customers.
Higher-risk orders can be held briefly for authentication or manual review instead of cancelling all expedited purchases.
Digital Goods Need Real-Time Controls
Digital fulfillment can occur instantly, leaving little opportunity to stop delivery after fraud is recognized.
Merchants selling digital products should therefore make pre-authorization and pre-fulfillment risk decisions quickly.
Account history, authentication, payment verification, device context, and velocity can be especially important.
The specific rules should remain internal and be tuned to the merchant's own fraud patterns.
New Accounts Deserve Context, Not Automatic Suspicion
New customers have less history, which creates uncertainty.
That does not mean they should be declined or challenged excessively.
Merchants can compensate for limited history by using payment verification, device signals, email/account verification, 3-D Secure, fulfillment controls, and external fraud intelligence where appropriate.
A good system distinguishes “unknown” from “bad.”
Guest Checkout Can Still Be Risk-Assessed
Requiring an account is not the only way to prevent fraud.
Guest transactions can still be evaluated using payment validation, authentication, device context, order characteristics, address information, and transaction history associated with internal risk entities.
Merchants should not force account creation solely as a fraud control if it harms legitimate conversion.
Email and Phone Signals Can Support Identity Consistency
Email addresses and phone numbers can provide contextual signals such as account tenure, verification status, consistency with previous transactions, and whether the customer can complete an independent verification step.
They should not be used as simplistic allowlists or blocklists.
Personal data should be collected and processed in accordance with privacy law and data-minimization principles.
Behavioral Signals Can Detect Session Anomalies
Behavioral analytics can compare how a checkout session unfolds with normal customer patterns.
Examples include unusual navigation sequences, automation-like interaction, abrupt changes in session context, or inconsistencies between login and checkout behavior.
These signals are strongest when combined with payment and identity context.
Merchants should avoid treating accessibility tools, unusual input patterns, or customer disabilities as fraud without appropriate safeguards.
Fraud Scoring Helps Combine Weak Signals
A risk score allows many small indicators to be evaluated together.
Scores can be generated through merchant rules, statistical models, machine learning, payment-provider tools, or combinations of these methods.
Mastercard describes transaction-fraud monitoring systems that provide risk scores before authorization, illustrating how real-time scoring can support payment decisions.
Merchants should evaluate model performance using both fraud capture and false-positive rates.
The score itself should not be exposed publicly because that can help attackers reverse-engineer controls.
AI and Machine Learning Can Help — but Need Governance
Machine learning can identify complex relationships that are difficult to express as static rules.
However, AI is not automatically accurate or fair.
Merchants should monitor model drift, false positives, data quality, explainability where appropriate, privacy, and operational impact.
Human oversight remains important for high-value or ambiguous cases.
Models should be retrained or recalibrated as customer behavior and fraud patterns change.
Use Manual Review for the Uncertain Middle
Fraud systems usually work best when they do not force every order into only “approve” or “decline.”
A medium-risk queue can be reviewed by trained staff using authorized internal information.
Reviewers can examine order history, account changes, authentication outcomes, issuer responses, fulfillment context, and prior support interactions.
Manual review should have clear service-level goals so legitimate customers are not left waiting indefinitely.
Review procedures should remain confidential and avoid contacting customers in ways that expose sensitive fraud rules.
Step-Up Verification Can Preserve Good Orders
When risk is elevated but not conclusive, merchants can request additional legitimate verification rather than immediately declining.
Examples include issuer authentication through EMV 3DS, secure account reauthentication, or other payment-provider verification mechanisms.
Do not ask customers to send full card details, passwords, or one-time codes through email or chat.
The verification method should be secure, proportionate, and supported by the payment ecosystem.
Post-Authorization Monitoring Still Matters
Fraud detection should not stop the moment the issuer approves the transaction.
Merchants can continue assessing risk until fulfillment and beyond.
New account changes, suspicious support contacts, address changes, repeated refund requests, or related fraudulent orders can emerge after authorization.
For physical goods, a high-risk order may be paused before shipment if the merchant's policies and customer commitments allow it.
Chargebacks Are Feedback, Not Just Losses
Confirmed fraud disputes can teach the merchant which signals were missed.
Merchants should link chargebacks back to the original order, account, device, fulfillment and authentication data.
Patterns across confirmed fraud can reveal gaps in controls.
At the same time, not every chargeback represents stolen-card fraud; friendly fraud and merchant-service disputes have different causes.
Fraud labels should therefore be accurate before they are used to train detection systems.
False Positives Need Their Own KPI
A fraud engine can look successful if it blocks many transactions, but excessive declines may quietly reject good customers.
Merchants should track approval rate, review rate, false-positive rate, fraud loss, chargeback rate, customer complaints, and conversion together.
The objective is profitable, safe acceptance — not the maximum possible number of declines.
Segment performance by channel, geography, product, customer type, and authentication flow so broad rules do not hide localized problems.
Do Not Publish Exact Fraud Thresholds
Fraud controls lose value when attackers know the exact boundaries.
Merchants should avoid public documentation that reveals precise velocity limits, score cutoffs, review triggers, amount thresholds, device rules, or combinations that guarantee approval.
Customer-facing error messages should remain helpful without disclosing internal decision logic.
Internal rules should also be access-controlled and changed when evidence shows they are being probed or gamed.
Protect the Fraud-Detection System Itself
Fraud tools contain sensitive logic, account data, device information and customer behavior.
Access should follow least privilege, strong authentication and logging.
Administrative changes to allowlists, blocklists, thresholds and models should be auditable.
A compromised fraud console can be as damaging as a weak checkout page because an attacker could weaken controls or suppress alerts.
PCI DSS Is the Security Foundation, Not a Fraud Engine
PCI DSS establishes baseline technical and operational requirements for protecting payment account data.
It is not a transaction-by-transaction fraud-scoring system.
Merchants need both: secure systems to prevent card-data compromise and fraud controls to identify suspicious use of credentials.
PCI SSC merchant resources emphasize people, process and technology as the foundation for protecting payment data.
Protect the Checkout Page From E-Skimming
A merchant can have excellent transaction scoring and still lose card data if the checkout page itself is compromised.
PCI DSS includes controls aimed at managing payment-page scripts and detecting unauthorized changes in e-commerce environments.
Merchants should inventory authorized scripts, control changes, protect administrative access, patch systems, and monitor payment pages for unexpected modification.
Preventing credential theft reduces the supply feeding future fraudulent transactions.
Use Tokenization to Reduce Stored-Card Risk
Tokenization replaces raw payment credentials with substitute values in supported environments.
This reduces the amount of reusable card information the merchant needs to handle.
Tokenization is primarily a data-protection control rather than a standalone fraud detector, but it reduces the consequences of certain compromises and can support safer card-on-file relationships.
Card-Present Merchants Need Different Signals
In-store fraud detection differs from e-commerce because EMV chip, contactless, terminal security, cardholder verification and physical context are available.
EMVCo says contact chip helps issuers and merchants improve in-store security and prevent card fraud.
Merchants should keep chip and contactless acceptance functioning correctly, protect terminals from tampering, and follow acquirer guidance for fallback transactions.
Do not rely on card-not-present signals such as browser device context for physical checkout.
Fallback Transactions Deserve Monitoring
Magnetic-stripe fallback can occur for legitimate technical reasons, but it bypasses some of the protection provided by chip acceptance.
Merchants should monitor unusual fallback patterns and maintain terminals so customers are not routinely forced into weaker methods.
Exact fallback fraud thresholds and rules should remain internal and aligned with acquirer and network guidance.
Omnichannel Merchants Should Link Risk Across Channels
Fraud can move between website, mobile app, call center, store pickup and physical locations.
A customer account may be compromised online and then used for buy-online-pickup-in-store, refunds, or support manipulation.
Merchants should share appropriate fraud intelligence across channels while respecting access controls and privacy requirements.
A fragmented view can allow suspicious activity to look normal within each channel separately.
Buy Online, Pick Up in Store Needs Identity and Fulfillment Controls
BOPIS combines online payment with rapid physical fulfillment.
Risk can be reduced by combining transaction scoring with appropriate pickup verification and account security.
Controls should not require employees to handle unnecessary sensitive card data.
The goal is to confirm the legitimate customer without creating excessive friction or exposing fraud rules.
Refund Fraud and Payment Fraud Can Intersect
A suspicious transaction may later be followed by attempts to redirect refunds, change payout destinations, or manipulate support staff.
Merchants should authenticate sensitive refund and account-change requests and return funds through appropriate original-payment or approved channels.
Support teams need fraud-awareness training because social engineering can bypass otherwise strong automated controls.
Train Customer Support as Part of Fraud Detection
Support agents often see signals that automated systems miss.
Customers may report an account takeover, unrecognized order, changed email, suspicious verification call, or stolen card.
Agents should have a clear path to escalate fraud concerns without asking customers to disclose full card credentials or one-time codes.
Support notes can become useful fraud context when handled securely and consistently.
Create a Clear Review Decision Framework
Manual reviewers need documented outcomes such as approve, decline, cancel, request secure verification, hold fulfillment, or escalate to a specialist.
The framework should define what evidence reviewers may use and what customer information they may request.
Avoid ad hoc decisions based on stereotypes, nationality, ethnicity, disability, or other inappropriate attributes.
Risk controls should focus on transaction and account evidence relevant to fraud.
Measure Fraud by Cohort and Channel
Overall fraud rate can hide important differences.
Merchants should compare performance across e-commerce, app, recurring, subscription, guest checkout, logged-in accounts, pickup, and other relevant channels.
They can also measure how 3DS, tokenization, account age, and different verification flows affect both fraud and approval rates.
This supports targeted improvements instead of overly broad rules.
Build Feedback From Issuers and Acquirers
Merchants should work with their acquirer, payment service provider and card networks rather than treating fraud detection as a completely isolated internal problem.
Payment partners may provide risk tools, dispute data, authentication services, authorization insights and program guidance.
They can also help merchants understand unusual declines or fraud trends without exposing proprietary issuer logic.
Incident Response: When Suspicious Transactions Become a Breach Signal
A sudden increase in suspicious orders can sometimes indicate more than external stolen-card use.
If patterns suggest that the merchant's own checkout, customer accounts, API keys or administrative systems may be compromised, activate incident response.
Preserve logs, contain affected systems, involve appropriate security and payment partners, and meet applicable PCI DSS and legal obligations.
Do not assume every fraud spike comes from criminals using cards stolen somewhere else.
Common Mistakes Merchants Make
Relying on one signal such as AVS or CVV as a complete fraud decision.
Challenging or declining every new customer.
Publishing exact fraud thresholds or detailed decline logic.
Allowing unlimited retries after repeated declines.
Ignoring account changes that occur immediately before checkout.
Treating issuer authorization as a guarantee that the order cannot be fraudulent.
Failing to feed chargebacks and confirmed fraud back into the model.
Optimizing only for fraud rate while ignoring false positives and conversion.
Storing sensitive authentication data unnecessarily.
Securing the transaction engine while neglecting checkout-page compromise and e-skimming.
Conclusion
Suspicious card-transaction detection is not about finding one field that tells a merchant “fraud” or “not fraud.”
The strongest systems combine independent payment, identity, device, account, behavioral and fulfillment signals, then choose the appropriate response for the level of risk.
AVS and CVV/CVC can add useful validation. EMV 3-D Secure can add issuer authentication and risk assessment. Fraud scoring can connect transaction patterns that humans would struggle to evaluate in real time. Manual review can protect legitimate customers when the automated evidence is uncertain.
Merchants should also remember that fraud prevention has two sides: detect suspicious use of payment credentials and prevent the merchant's own systems from leaking those credentials in the first place.
The practical goal is not to decline the most transactions. It is to approve as many genuine customers as possible while making fraudulent transactions difficult, detectable and economically unattractive.
