Kavra LabPOST /checkoutAllowedVerified AI shopping agent, known buyer
- Signed agent, operator IP range
- Account's trusted device history
- Card used here before
Risk8
Industry
E-commerce fraud prevention that keeps checkout fast for real shoppers
E-commerce fraud covers the ways bots and bad actors take money or stock from online stores: stacked promo codes, scalping bots on limited drops, card testing, stolen-card orders, hijacked loyalty accounts and scraped catalogs. Kavra assesses every signup, login, cart and checkout invisibly and tells your backend who to allow, verify or block.
- Who it hits
- Online stores, brands, DTC and drop retailers
- What it costs
- Chargebacks, promo budget, stock, loyalty value
- Tools used
- Sneaker bots, card checkers, proxies, scrapers
- Where to stop it
- Signup, login, cart, checkout, promo redeem
What e-commerce fraud looks like now
Online retail loses money in more places than the payment step. A first-order discount claimed by the same shopper under forty emails, a sneaker drop bought out by bots in seconds, a checkout page used to test thousands of stolen cards, a loyalty balance spent by someone who guessed the password: each one has its own attacker, its own tools and its own point of attack.
What they share is that the attacker needs to look like many ordinary shoppers. Bots run in headless browsers and scripted clients, route through residential proxies so every request comes from a different home address, and rotate device fingerprints so the store sees new visitors. Stores that judge each request on its own see a crowd. Stores that link the evidence see a few operators.
The threats that hit online stores
Map each threat to the moment it strikes and what it costs you.
| Threat | Where it strikes | Business impact |
|---|---|---|
| Promo and coupon abuse | Signup, promo redeem, referral | Discounts and referral credit paid many times to one shopper |
| Scalping and inventory hoarding | Product page, add to cart, checkout of limited drops | Stock resold at a markup, angry fans, brand damage |
| Card testing | Checkout, card add, small-value products | Processor fees, authorization declines, risk flags from payment partners |
| Payment fraud and chargebacks | Checkout with stolen cards | Lost goods, chargeback fees, higher processing costs |
| Account takeover of loyalty balances | Login, password reset, address change | Points, gift cards and store credit drained, support load |
| Web scraping of prices and catalogs | Product, search and price endpoints | Undercut pricing, copied content, infrastructure cost |
| Fake reviews and fake accounts | Account creation, review forms | Rankings and trust manipulated |
Shopper journey touchpoints to protect
Put an assessment at each point where value or stock changes hands. Keep the pages that only browse fast and open.
- 01
Browse and search
Watch for price and stock scrapers pulling the catalog at machine speed. Let verified search crawlers and signed AI shopping agents through.
- 02
Account creation
Stop bulk signups made for first-order codes, referral credits and fake reviews. Link new accounts to existing actors.
- 03
Login
Compare the login with the account's trusted devices. Credential stuffing aimed at loyalty balances looks like many failed logins from many home IPs.
- 04
Add to cart
On limited drops, this is the race. Bots add stock in the first seconds and hold it. Assess before inventory is reserved.
- 05
Promo redeem and checkout
Check whether the actor has already used the offer under another account, and whether the card attempts look like testing.
- 06
Post-purchase changes
Address changes, gift card redemptions and loyalty transfers after a login from a new device deserve a second look.
Warning signs in retail traffic
Look for patterns across sessions and accounts, not for one bad request.
One shopper, many first orders
Different emails and addresses, the same device underneath, the same payment card or the same delivery point with small variations.
Drop-second traffic spikes
Thousands of add-to-cart calls in the first moments of a release, from fresh sessions that never viewed the product page like a person would.
Many cards, small amounts
Low-value orders or card saves with a rapid run of different card numbers and a high decline rate, typical of a card checker.
Rotating fingerprints
A returning visitor who shows up with a new device fingerprint on each attempt. Rotation itself is the signal. See fingerprint spoofing.
Catalog walked in order
Product IDs requested in sequence, no images or scripts loaded, steady request pacing across proxy IPs.
Reviews from linked accounts
New accounts posting reviews in bursts from shared devices or networks, often right after signup.
Chargebacks, payment rules and checkout friction
Card networks run monitoring programs that penalize merchants whose fraud and dispute rates stay high, and payment partners watch authorization declines closely. A single card-testing run can push a store's numbers in the wrong direction in one night. In Europe, strong customer authentication under PSD2 adds a 3-D Secure step to many payments, which shifts liability but also adds friction and abandoned carts.
That is the retail trade-off. Every extra field, puzzle or verification loses some real buyers. The stores that do this well put friction only where evidence points: an invisible check for everyone, a step-up for the few with mixed signals, and a hard block only for clear automation or known bad actors. Your payment fraud screening stays in place. Kavra adds what it cannot see: whether the session is a bot, a spoofed device or one actor behind many accounts.
A real shopper vs a retail bot
Real shopper
- Browses, compares, scrolls and reads
- Consistent device on home broadband or a carrier network
- One account, one card, a delivery history
- Occasional typos and hesitation at checkout
Retail bot or abuser
- Goes straight to cart or checkout endpoints
- Proxy exit, often a new IP per request
- Many accounts, cards or promo codes per actor
- Pasted values and identical timing on every attempt
What good e-commerce fraud protection looks like
Good protection is invisible on a normal day and firm on a drop day. It should also know the difference between a bad bot and a useful one, as more shoppers let AI agents compare prices and place orders for them.
- Every signup, login, add-to-cart and checkout assessed, including traffic from the native apps.
- Accounts linked by the device and network behind them, so promo limits apply per person.
- Card testing stopped by recognizing the automation, not only by counting declines.
- Limited drops protected before stock is reserved, with no CAPTCHA wall for fans.
- Verified crawlers and AI agents allowed or checked by your own policy; impostors blocked.
- Loyalty and gift card balances protected at login and at every change of address or payout.
- Clear reasons on every decision, so support can explain a hold to a real customer.
Sources
- Visa: Introducing the Visa Acquirer Monitoring Program
- EBA: Regulatory technical standards on strong customer authentication under PSD2
- OWASP Automated Threats: OAT-001 Carding
- OWASP Automated Threats: OAT-005 Scalping
- OWASP Automated Threats: OAT-019 Account Creation
- OWASP Automated Threats: OAT-011 Scraping
How Kavra helps
How Kavra protects online stores
One script and one server call give every visit an explained verdict. Kavra analyzes 3,000+ data points and recommends; your checkout decides.
Bots caught at the cart
Automation frameworks, headless browsers and scripted clients are flagged before they reserve stock or test a card.
Promo limits per person
New accounts are linked to the actor behind them, so a first-order code is used once per shopper, not once per inbox.
Proxy intelligence
Kavra measures real exit IPs of commercial residential and mobile proxy networks, so a drop-day swarm of home IPs is seen for what it is.
Loyalty accounts protected
Each login is compared with the account's trusted devices and history. Step up only on a new device, network or impossible travel.
Good agents let through
Verified crawlers and AI shopping agents are recognized by signature and operator IP ranges. You choose to allow, check or block them.
Observe first, then enforce
Run in observe-only mode before a big release, check the verdicts, then switch on blocking with a cautious, balanced or strict preset.
FAQ
Frequently asked questions
Something else? Talk to our team.
What is the most common fraud in e-commerce?
Payment fraud with stolen cards, followed by chargebacks, is the best known. Close behind are promo abuse through duplicate accounts, card testing on low-value products, account takeover of loyalty balances and bots buying limited stock. Most of these rely on automation and proxies, which is why checking the session behind the order matters as much as checking the card.
How do online stores stop coupon and promo code abuse?
By applying the limit per person instead of per email. That means linking new accounts to the device and network behind them, even when the shopper uses fresh inboxes, proxies and rotating fingerprints. When evidence is mixed, hold or verify the discount instead of blocking the signup, so real new customers still get their welcome offer.
How do you stop bots from buying limited-edition drops?
Assess each session before stock is reserved, not after payment. Scalping bots use automation frameworks, residential proxies and many accounts, so the useful signals are the automation itself, contradictions in the device and links between accounts. Kavra flags them invisibly, so fans are not forced through puzzles or queues built to slow bots.
Should an online store block AI shopping agents?
Not by default. Verified agents acting for a real customer can bring orders, and blocking them turns buyers away. The risk is scripts that claim to be an agent. Kavra verifies declared agents by cryptographic signature and their operator's published IP ranges, flags impostors, and lets you choose to allow, check or block each one.
How can I reduce chargebacks without adding checkout friction?
Stop the bad sessions early and let the good ones pass untouched. Many chargebacks start with a bot, a spoofed device or a hijacked account, all visible before payment. Use invisible assessment for everyone, step up only the risky few, and keep 3-D Secure for the cases where it adds real protection.
See who is really on your site.
Run Kavra on your own traffic in observe-only mode. No risk to your customers, and a clear report of the fraud it finds.