The Current State and Challenges of Payment Fraud
According to LexisNexis's 2025 Digital Commerce Fraud Report, global fraud losses in e-commerce and digital payments are projected to exceed $50 billion by 2026. Payment fraud methods are becoming increasingly diverse—from traditional credit card theft to account takeover (ATO), synthetic identity fraud, and friendly fraud. Attackers leverage AI tools to generate realistic fake identities and transaction behaviors, making traditional rule-based engines increasingly inadequate.
For independent website operators, SaaS platforms, and cross-border e-commerce sellers, payment fraud not only causes direct financial losses but also leads to hefty chargeback penalties, payment gateway account freezes, and even being blacklisted by the industry. Therefore, building a multi-layered payment risk control system has become a necessity for online businesses.
Common Types of Payment Fraud
Credit Card Testing (Card Testing)
Attackers use automated scripts to batch-test stolen credit card numbers. Characteristics include a large number of small transactions in a short period, frequent card number changes from the same IP address, and high transaction failure rates. Stripe reported in 2025 that its platform blocks over 200,000 card testing attacks daily.
Account Takeover (ATO)
Attackers obtain user login credentials through credential stuffing, social engineering, or data breaches, then take over accounts to make purchases using saved payment methods. ATO attacks surged by 40% in 2026, primarily due to the continuous growth of bulk leaked credentials on the dark web.
Friendly Fraud
Consumers purchase goods or services and then file false disputes with their issuing bank, claiming unauthorized transactions. This type accounts for 60-80% of all chargebacks and is difficult for traditional risk control rules to detect since it involves genuine cardholders.
Synthetic Identity Fraud
Attackers combine real personal information (such as Social Security numbers) with fabricated identity details to create entirely new fake identities for opening accounts and conducting transactions. This is the fastest-growing fraud type, causing over $3 billion in losses to U.S. financial institutions in 2025.
Core Risk Control Strategies
Multi-Layered Rule Engine
Modern payment risk control systems typically use a layered architecture to address different types of threats:
| Risk Layer | Detection Target | Typical Rules |
|---|---|---|
| Layer 1 — Device Fingerprinting | Device spoofing, emulators | TLS fingerprint, Canvas fingerprint, screen resolution detection |
| Layer 2 — Behavioral Analysis | Bots, automated scripts | Mouse trajectory, keystroke rhythm, page dwell time |
| Layer 3 — Transaction Scoring | Fraudulent transactions | Amount anomalies, frequency anomalies, address matching |
| Layer 4 — Identity Verification | Account takeover | Login IP geography changes, device changes, behavioral anomalies |
| Layer 5 — Manual Review | High-risk transactions | Manual verification calls, KYC document review |
3D Secure 2.0/3.0
3D Secure is the EMVCo cardholder authentication protocol. Version 2.0 changed the verification flow from redirect-based to embedded (when the device supports it), significantly improving user experience and conversion rates. Version 3.0, released in 2026, introduced a frictionless flow that leverages machine learning models to complete identity assessment without interrupting the user.
Mainstream payment gateway support for 3DS:
| Gateway | 3DS Version | Adaptive Rules | Exemption Management |
|---|---|---|---|
| Stripe | 3DS 2.0/3.0 | ✓ | ✓ |
| Adyen | 3DS 2.0/3.0 | ✓ | ✓ |
| PayPal | 3DS 2.0 | Partial | Partial |
| Square | 3DS 2.0 | Limited | Limited |
Device Fingerprinting and Behavioral Biometrics
Device fingerprinting technology generates a unique identifier by collecting browser/device characteristic parameters (User-Agent, font list, WebGL rendering information, timezone, language preferences, etc.). Behavioral biometrics analyze the user's interaction patterns with the interface—the curvature of mouse movement trajectories, the interval distribution of keystrokes, the swipe pressure on touchscreens. These subtle features are difficult for bots to replicate.
Address Verification Service (AVS) and CVC Verification
AVS compares the billing address against the address on file with the issuing bank, while CVC verification requires entering the security code from the back of the card. Although these are basic verification methods, combining them can effectively reduce fraud risk in Card-Not-Present (CNP) transactions.
Implementation Path for Risk Control Systems
Deployment Phases
- Cold Start Phase: Use pre-trained models from third-party risk control services (such as Sift, Forter, Riskified) to quickly establish a baseline defense.
- Data Accumulation Phase: Collect at least 3-6 months of transaction data, including labels for both approved and declined transactions.
- Model Customization Phase: Train customized machine learning models based on your own data to optimize threshold accuracy.
- Continuous Optimization Phase: Regularly review false positive and false negative cases to iterate on rules.
Balancing Conversion Rate and Security
Overly strict risk control will drive away legitimate users. Industry benchmarks suggest that typical e-commerce 3DS challenge rates should be controlled at 5-10%, with decline rates between 1-3%. A tiered strategy is recommended—low-risk transactions pass through directly, medium-risk transactions trigger 3DS verification, and high-risk transactions enter manual review.
Special Considerations for Cross-Border Transactions
Cross-border transactions face significantly increased risk control difficulty due to the lack of information sharing mechanisms between issuing banks. Additional considerations include:
- Assessing the合理性 of mismatches between IP geolocation and billing country
- Controlling the frequency of small-value rapid cross-border transactions
- Understanding risk差异 of local payment methods (e.g., iDEAL in Europe has a much lower fraud rate than credit cards)
Comparison of Major Risk Control Tools
| Tool/Service | Core Capability | Deployment | Pricing | Best For |
|---|---|---|---|---|
| Sift | Device fingerprinting + behavioral analysis + manual review | API/SaaS | Per transaction volume | Mid-to-large e-commerce |
| Forter | Fully automated decision-making, zero false positive commitment | API | Per successful transaction | High-ticket merchants |
| Riskified | Chargeback guarantee | API | % of transaction value | Fashion/luxury |
| Signifyd | Guarantee + risk control integrated | API | % of transaction value | General purpose |
| Stripe Radar | Native Stripe risk control | Built-in | $0.02-0.05 per transaction | Stripe users |
| Custom Rule Engine | Full controllability | Self-built | Development & maintenance cost | Very high transaction volume |
Conclusion
Payment fraud is an ongoing battle with no one-size-fits-all solution. An effective payment risk control system should combine the certainty of rule engines, the predictive power of machine learning, and the flexibility of manual review to form multi-layered defense. In implementation, it is essential to balance security with user experience—overly strict risk control can actually increase customer acquisition costs and damage brand reputation.
As AI-generated content becomes more prevalent, synthetic identity and deepfake attacks will pose greater challenges to traditional risk control models. Adopting next-generation identity verification methods such as behavioral biometrics and real-time device fingerprinting will be a key trend for 2026-2027.