Kavra LabPOST /checkoutVerifyNew device on a loyal account, big basket
- First time seen on this account
- Shipping address changed today
- Real browser, home broadband
Risk64
Solution
Payment fraud prevention that sees who is behind the card
Payment fraud is any purchase made with payment details or an account the buyer has no right to use, usually stolen cards or a hijacked customer account, and it ends in chargebacks, lost goods and fees. Kavra adds device, network and behavior evidence to your processor's card checks, so you approve good orders and step up the risky ones.
- Who it hits
- E-commerce, travel, ticketing, digital goods, fintech
- What it costs
- Chargebacks, lost goods, fees, processor trust
- Tools used
- Stolen card data, hijacked accounts, proxies
- Where to stop it
- Before authorization, at checkout
What is payment fraud?
Payment fraud is an online purchase paid with a card, wallet or stored payment method that the person at the keyboard is not entitled to use. The genuine cardholder sees a charge they never made, disputes it with their bank, and the money comes back out of the merchant's account as a chargeback, plus a fee. The goods, tickets or credits are already gone.
Two patterns dominate. In stolen card fraud, criminals buy card numbers from breaches, phishing kits or skimming, then check out as a new customer. In account-based payment fraud, they log in to a real customer's account after account takeover and pay with the card already saved there, which often skips the checks a new card would face.
How stolen card fraud reaches your checkout
- 01
Buy the data
Card numbers, expiry dates, security codes and often the owner's name and address are bought in bulk on criminal marketplaces, a practice known as carding.
- 02
Check which cards work
Before spending, fraudsters run card testing with small charges on weakly protected sites to find the live cards.
- 03
Look like the cardholder
They pick a residential proxy near the billing address, set the browser language and timezone to match, and sometimes use an antidetect browser so each card gets its own clean device.
- 04
Buy what resells
Electronics, gift cards, tickets, travel and digital goods are favorites because they ship fast or deliver instantly and resell easily.
- 05
Disappear before the dispute
Goods go to drop addresses or are resold. Weeks later the cardholder disputes the charge, and the merchant absorbs the loss.
What payment fraud really costs
The lost order is only the start. Every fraudulent sale can bring several costs at once:
- The chargeback: the full order value is reversed, and the merchant usually pays a dispute fee on top.
- The goods: physical items are gone, and digital goods or tickets cannot be recalled.
- Processor standing: card networks and processors monitor dispute and fraud ratios. Merchants who cross their thresholds face higher fees, reserves and, eventually, account termination.
- False declines: tight rules to cut fraud also turn away real customers, often the ones with the biggest baskets.
- Review work: manual order review delays shipping and costs analyst time on orders that were fine.
What your processor sees and what it misses
Payment processors and issuers already score each transaction. Their view starts at the payment details. The device and session behind them are yours to add.
| Evidence | Processor and issuer | Kavra at your checkout |
|---|---|---|
| Card, BIN and issuing country | Yes | Not needed |
| Address and security code match | Yes | Not needed |
| Cardholder's spending history | Yes, across merchants | No |
| The real device behind the browser | Limited | Yes, including spoofed and emulated devices |
| Proxy, VPN or data center connection | Partial, IP only | Yes, measured against real proxy exits |
| Automation and scripted checkout | No | Yes |
| This account's usual devices and networks | No | Yes, trusted devices per account |
| One actor behind many cards or accounts | Limited | Yes, linked across visits |
Warning signs at checkout
Each sign alone has an innocent explanation. Several together rarely do.
Location that does not fit
Billing address in one city, connection through a proxy exit that only pretends to be nearby, device timezone somewhere else.
Many cards, one device
The same device tries several cards, names or billing addresses, often after earlier declines.
Account changes before purchase
A new device logs in, changes the email, phone or shipping address, then buys high-value items with the saved card.
Checkout at machine speed
Card details pasted in one go, no hesitation, no browsing before the cart, identical timing across orders.
Resale-friendly baskets
Gift cards, top models and multiple units of the same item, rushed to express shipping or a freight forwarder.
A device that hides itself
Antidetect browser, emulator or virtual machine, or a fingerprint that changed since the last visit from the same actor.
Why rules and processor checks alone are not enough
Address and security code checks confirm that the fraudster has the full card record, which they usually do. IP geolocation is fooled by a proxy in the right city. Velocity rules on card or email are dodged by rotating both. And a checkout from a hijacked account carries the account's good history with it, so it can look safer than a brand new customer.
Blocking harder is not the answer either. Every false decline is a lost sale and a customer who may not come back. The goal is to find the few orders where the person does not match the payment, and add friction only there.
Step up with 3-D Secure, only when it counts
3-D Secure asks the card issuer to authenticate the buyer, usually in the banking app or with a one-time code. For authenticated transactions, liability for fraud chargebacks generally shifts from the merchant to the issuer. It also adds friction and some abandonment, so sending every order through it is a costly default.
Device and network evidence decides who needs it. Orders from a known device on the customer's usual network go through without interruption. Orders with mixed evidence are stepped up to 3-D Secure. Orders from automation or an actor already linked to fraud are stopped before the authorization request is ever sent.
How to prevent payment fraud: a checklist
Start with the checks that cost real customers nothing, and add friction only where evidence is mixed.
- Assess every checkout before you send the authorization, and pass the verdict into your payment flow.
- Compare the device and network with the account's own history, not only with global rules.
- Treat account changes followed by a purchase as one sequence, and check them together.
- Recognize proxies, VPNs, emulators and antidetect browsers by what they are, not by where they claim to be.
- Link cards, accounts and devices to actors, so one fraudster with ten cards is seen as one.
- Use 3-D Secure as a targeted step-up, not a blanket rule.
- Feed chargeback outcomes back by marking sessions and devices as bad.
Sources
How Kavra helps
How Kavra stops payment fraud
Kavra assesses every checkout with 3,000+ data points and returns an explained recommendation your backend uses before it calls the processor.
Trusted devices per account
Each checkout is compared with the account's own devices and networks, so a new device, new network or impossible travel stands out.
Proxy intelligence
Real exit IPs of commercial residential and mobile proxy networks are measured directly, so a proxy near the billing address is still seen as a proxy.
Cards linked to actors
Returning devices are recognized across visits, so one fraudster trying many cards or accounts shows up as one actor.
Disguises exposed
Antidetect browsers, emulators and scripted checkouts are caught by contradictions between layers.
Step-up where it matters
A clear allow, verify or block recommendation tells you which orders to send to 3-D Secure and which to approve without friction.
Learns from your chargebacks
Mark sessions and devices as bad through the API when a dispute arrives, and revoke trusted devices when an account is compromised.
FAQ
Frequently asked questions
Something else? Talk to our team.
What is the difference between payment fraud and friendly fraud?
In payment fraud, someone uses a card or account without the owner's permission, and the real cardholder disputes the charge. In friendly fraud, the real cardholder made the purchase and later disputes it anyway, claiming it was unauthorized or never arrived. Device history helps with both: it shows whether the order came from the customer's usual device.
Does 3-D Secure stop all payment fraud?
No. It moves liability for fraud chargebacks to the issuer on authenticated transactions in most cases, and stops many stolen card attempts. But it adds friction, not every issuer or region applies it the same way, and fraudsters who control a victim's phone or account can pass it. Use it as a targeted step-up.
Doesn't my payment processor already handle fraud?
It handles part of it. Processors score the card and transaction using data from many merchants. They see little of the session on your site: the real device, proxy use, automation, or whether this account normally buys from this device. Kavra adds that view, and the two work best together.
How do I reduce chargebacks without declining good customers?
Replace blanket rules with evidence per order. Approve orders from known devices and consistent networks without friction, step up the uncertain ones to 3-D Secure, and block only when evidence is strong. Then feed chargeback outcomes back, so the same device or actor is recognized next time.
What is account-based payment fraud?
It is fraud committed through a real customer's account instead of a new card. After taking over the account, the fraudster pays with the saved card, uses stored balance or loyalty points, or changes the delivery address. Because the account has good history, it can pass checks built for new customers, which is why comparing the device with the account's history matters.
See who is really on your site.
Run Kavra on your own traffic in observe-only mode. No risk to your customers, and a clear report of the fraud it finds.