Fraud Protection for High-Risk Merchants.

Merchant fraud protection is the set of checks and tools that stop stolen cards, bots and fake orders before you ship or capture the payment. For high-risk merchants it usually means AVS and CVV checks, 3D Secure, velocity rules, device data and a review queue for risky orders.

For online and phone merchants, the most common types are stolen credit card fraud, card testing, account takeovers, friendly fraud and refund abuse. Identity theft feeds most of them, since fraudsters buy stolen card data and login credentials in bulk.

Fraud protection stops payments made without the cardholder's permission. Chargeback prevention also covers disputes from real customers, like orders that didn't arrive or renewals they forgot. You need both to keep your Visa ratio down.

Fraudsters run large numbers of small payments, usually with bots, to find out which stolen cards still work. It can cost you authorization fees and get your account flagged. Velocity limits, CAPTCHA and attempt caps stop most of it.

A real cardholder disputing a purchase they made, whether they forgot it, didn't recognize the charge or regretted it. Fraud filters can't stop it, but clear descriptors, order confirmations and easy refunds prevent most of it.

A fraudster logs into a real customer's account and orders with their saved card. Device fingerprinting, login alerts and checks on changes to shipping addresses catch most of it.

AVS checks the billing address against the issuer's records, and CVV2 confirms the buyer has the code printed on the card. Both help catch stolen card numbers, but neither shifts fraud liability to the issuer.

Yes, for fraud disputes. When the issuer authenticates a Visa payment, it takes on fraud chargebacks on that order. The shift doesn't apply to non-reloadable prepaid cards, and merchants in Visa's Secure Excessive Fraud program lose it.

No. It covers fraud disputes only. Disputes about orders that didn't arrive, products not as described or cancelled subscriptions still count against you.

Less than it used to. With 3D Secure 2, the bank can approve many low-risk payments in the background without asking the buyer to do anything. You can also apply it only to riskier orders.

It identifies the device behind an order from details like the browser, operating system and network. It helps spot repeat fraudsters, and matching device or IP data on past orders is part of the evidence for Visa's Compelling Evidence 3.0.

Use rules that score risk instead of blocking whole countries or card types, send borderline orders to review, and use 3D Secure on risky orders instead of declining them. Review your declined orders regularly to spot good customers your rules are blocking.

No. PCI rules let you use the CVV to authorize a payment but never store it afterward, even encrypted, including for card-on-file and recurring payments.

Yes. Once the bank files a fraud report, it counts toward your Visa VAMP ratio even if you refund. Void suspicious orders before capture instead.

Visa adds your fraud reports and disputes together and divides them by your settled card-not-present sales. Since April 2026, merchants are flagged at 1.5% with at least 1,500 fraud reports and disputes in a month.

Visa's VAMP program flags merchants at a 1.5% fraud-and-dispute ratio with at least 1,500 disputes and fraud reports in a month, and Mastercard starts at 1.5% and 100 chargebacks. Banks act well before that, so aim to stay under 1%.

Often, yes. Many high-risk merchants come to us after a processor froze or closed their account over chargebacks or fraud. We look at why it happened and what's changed. We also work with merchants on the MATCH list.