An auditor reviewing an EU payment provider asks whether strong customer authentication ran on its online card payments; Regulation (EU) 2018/389 has independent auditors check those measures (Article 3). The EBA and ECB 2025 report on payment fraud shows why: card fraud rates were about seventeen times higher when the counterpart was outside the EEA, where SCA may not be required, than on domestic payments (pp. 6 to 7).
What does an e-commerce fraud case study look like?
Picture a cycling parts shop that sells a wheelset for EUR 400 (illustrative). A fake web shop lists it at EUR 250, and a buyer pays there by card. The fake shop orders the wheelset from the real shop with a stolen card and the buyer's delivery address. The buyer gets a real wheelset. She leaves a good review.
Weeks later the card owner's bank raises a fraud dispute under Dispute Condition 10.4 of the Visa Rules, and the shop loses the wheelset and the EUR 400. The fake shop gained by deceiving two parties, the mark of what fraud is, and the scheme is called triangulation fraud.
From Burçak Aydın, author of this entry: "Triangulation fraud is the one e-commerce fraud where the customer is happy: the fake shop delivers a real product bought with a stolen card and even asks for a good review, and the loss only lands on the real merchant when the card owner's bank raises a fraud dispute, which Visa allows up to 120 days after processing."
What exactly counts as e-commerce fraud?
Visa's definition: "eCommerce fraud occurs when online payment systems or shopping platforms are exploited to gain money, goods or sensitive information through deception or error" (Visa, eCommerce fraud). People also type it as ecommerce fraud or call it online retail fraud.
Visa's FAQ makes the buyer the fraudster and files a seller who takes payment and delivers nothing under merchant fraud; both happen at the same checkout, so both are here. Older guides equated e-commerce fraud with payment fraud or identity theft. Identity theft is the stealing of personal details, though, and EBA and ECB payment fraud figures also cover credit transfers. A shopper who falsely claims a parcel never arrived commits e-commerce fraud with no stolen data.
Is e-commerce fraud the same as card not present fraud?
They overlap. Card not present fraud covers card payments made without the physical card, online, by phone or by mail order, which Visa handles as card absent fraud under Dispute Condition 10.4 (Visa Dispute Management Guide for Merchants, October 2026, p. 22). Visa puts most e-commerce fraud there, but refund abuse and fake affiliate sign ups need no card.
What is the difference between friendly fraud and chargeback fraud?
Visa uses friendly fraud for a cardholder disputing a legitimate purchase that they or someone in their household made, sometimes by accident (Visa, friendly fraud). Chargeback fraud is the deliberate version: the buyer keeps the goods and claims the money back.
Visa also calls friendly fraud first party misuse, which 64 percent of merchants saw rise (2026 Global eCommerce Payments & Fraud Report, March 2026, p. 9).
Which e-commerce fraud red flags show up in an order?
Fraudsters leave six red flags in order data, visible before any dispute arrives.
- Several cards on one account or IP address. Cycling cards is a sign of card testing.
- City and zip code that do not match. A Singapore IP with a US billing address suggests stolen card data.
- Unusual behavior for the customer. An order far above the usual spend can mean a taken over account.
- Orders in quick succession. Several attempts within minutes, again card testing.
- An unusual location. A customer who always buys from Japan orders from Portugal: travel, or account takeover.
- Many shipping addresses on one card. One card and billing address shipping to several places fits triangulation fraud.
What do the nine common types of e-commerce fraud look like?
Table 1. Nine common types of e-commerce fraud, the five classic types first.
| Type | What happens | Signal in the order data | Who loses first |
|---|---|---|---|
| Payment fraud with stolen card data | A criminal pays with card details stolen elsewhere | New account; billing and IP countries differ | The merchant, if the issuer's fraud dispute succeeds |
| Friendly fraud | The real cardholder buys, then disputes the payment as unauthorized or not received | Delivery confirmed; earlier disputes on the same card | The merchant |
| Affiliate fraud | Fake clicks, sign ups or orders inflate a partner's traffic to earn commission | Traffic spikes from one partner with few repeat buyers | The merchant, through commissions paid |
| Clean fraud | Stolen card data plus the owner's real details, so the order passes checks | Few: details match, so device and velocity checks matter | The merchant |
| Triangulation fraud | A fake shop takes the buyer's money and orders from a real merchant with a stolen card | Shipping name differs from the cardholder | The real merchant and the card owner |
| Card testing | Bots send many small payments to see whether stolen card details work (Visa) | Bursts of low value attempts and declines from one device or IP | Whoever accepts the card once it is confirmed |
| Account takeover and new account (application) fraud | A criminal takes over a shopper's account or opens one with stolen or invented details | Password reset, then a new address; new accounts sharing one device | The shopper and the merchant |
| Refund and policy abuse | False claims that goods never arrived, or returns of used or wrong items (2026 report, p. 37) | Repeat claims from one customer on tracked deliveries | The merchant |
| Merchant fraud and transaction laundering | A seller takes payment and delivers nothing, or processes payments for an undeclared business | Sales outside the declared business; sudden volume | Buyers, then the acquirer |
Row 1 is the online side of credit card fraud; older lists called it identity theft, though a stolen card number is enough. According to the 2026 report, 98 percent of merchants faced at least one fraud attack in the past 12 months, even as incidence fell for a second year. The five most common were refund and policy abuse, real time payment fraud, phishing, first party misuse and card testing (p. 25), and 61 percent of merchants saw refund and policy abuse rise (p. 9).
How does triangulation fraud work?
Visa describes four steps, and the buyer's goods really arrive (Biannual Threats Report, December 2023, p. 26):
- Criminals set up a fake merchant and website with bargains.
- The fake merchant charges the buyer's card for the order.
- It fulfills the order through "an unassociated, legitimate merchant", paying with "stolen payment account information".
- It asks the buyer for a positive rating, which lifts it in search results.
Which laws and card scheme rules govern an online card payment?
Table 2. Rules for online card payments in the EU, UK and US, with the card scheme rules and the industry standard.
| Jurisdiction | Rule | What it requires or covers | Who it binds |
|---|---|---|---|
| EU | PSD2, Article 97 | Strong customer authentication for electronic payments; for remote ones, elements that dynamically link the payment to the amount and the payee | Payment service providers |
| EU | Regulation (EU) 2018/389, Articles 16 and 18 | Exemptions: remote payments up to EUR 30 (until EUR 100 in total or five in a row since the last SCA) and transaction risk analysis up to EUR 500 at a 0.01% card fraud rate | Payment service providers |
| UK | Payment Services Regulations 2017, regulation 100 | The same SCA duty, with dynamic linking for remote payments | Payment service providers |
| England, Wales and Northern Ireland | Fraud Act 2006, section 2 and section 1 | Fraud by false representation; a representation counts when "submitted in any form to any system or device" (s2(5)); on indictment, a prison term of up to 10 years, a fine or both (s1(3)) | Anyone |
| US | 18 U.S.C. 1029 | Access device fraud, such as using unauthorized card numbers to obtain $1,000 or more in one year ((a)(2)); a fine or up to 10 years, or both, for that offense, up to 15 years for (a)(4), (5), (8) and (9), and up to 20 after an earlier conviction under the section | Anyone |
| US | 18 U.S.C. 1343 | Wire fraud; a fine, a prison term of up to 20 years or both, and where a financial institution is affected, up to $1,000,000, 30 years or both | Anyone |
| US | Regulation Z, 12 CFR 1026.12(b) | Caps a cardholder's liability for unauthorized credit card use at the lesser of $50 or the amount obtained before notice | Credit card issuers |
| Card scheme | Visa Rules, Dispute Condition 10.4 and VAMP | Card absent fraud disputes within 120 calendar days of the processing date; VAMP identifies acquirers that meet requirements set in its own program guide | Visa issuers, acquirers and their merchants |
| Industry standard | PCI DSS | Security requirements for "environments where payment account data is stored, processed, or transmitted" | Entities that store, process or transmit card data |
Neither Visa's rules nor PCI DSS is law, yet Visa's dispute rules decide who pays for a disputed order. The laws single out remote payments, and the 2024 data show why: their card fraud rate was 13 times the non remote rate by value (EBA and ECB, p. 19). Payment service users bore 38 percent of EEA card fraud losses in 2024; the report calls the outlook stable (p. 7).
How to prevent e-commerce fraud: what do merchants, acquirers and issuers each do?
Each of the three runs different controls, and each fraud detection, protection or management solution that prevention companies sell is built for one of them.
- Merchants. Use a secure payment gateway and keep records for disputes. Check that billing and shipping data match, and send risky orders through 3DS. Payment fraud detection scores each payment at authorization and shows, per rule, the fraud it stopped and the good customers it declined. Only 19 percent of merchants had a plan and solutions in place to accept agentic AI payments, which AI assistants start for a consumer (2026 report, p. 6).
- Acquirers. Vet each merchant before onboarding and watch it afterwards. Merchant monitoring measures every merchant's transactions against its declared business. Hepsiburada, a Turkish marketplace, chose complead, formerly Sanction Scanner, in October 2026 to screen merchants at onboarding and daily.
- Issuers. Authenticate cardholders under SCA in the EEA and UK, and raise fraud disputes within the scheme's time limits.
complead is an AI native platform where fraud checks share one engine with onboarding, screening, monitoring and investigation, so each customer carries a single risk score for fraud and AML. For the checks themselves, read how fraud detection works; how fraud and money laundering differ picks up once the stolen money moves.
Visa puts most e-commerce fraud in card not present transactions, so the next question is how stolen card details reach a checkout at all; the card not present fraud entry follows them from theft to dispute.
Related terms
- Credit card fraud. Unauthorized use of a card or its details.
- Chargeback fraud. Disputing your own purchase to keep the goods and the money.
- Account takeover fraud. Taking over a real customer's account.
- Transaction laundering. Putting an undeclared business's payments through another merchant.
- Card not present fraud. Card fraud online, by phone or by mail.
- Identity fraud. Using another person's details to get money or goods.
