Chargebacks and Payment Fraud: The Defence Most Stores Set Up Too Late

Chargebacks and payment fraud are the risk that turns a "sale" into a loss after you've already shipped the goods, and most stores only build a real defence after the first painful wave has hit. Two very different problems hide under the single word "fraud": criminal fraud, where someone uses a stolen card, and "friendly" fraud, where a real customer disputes a charge they actually made. They need different responses. And the hardest part isn't stopping fraud at all; it's stopping it without blocking the legitimate customers that an over-aggressive defence quietly turns away.

This is a core of the Payments pillar, the detail behind the fourth job the cornerstone named: risk. A chargeback is where that risk bites, and how you handle it is where a lot of stores either over-react or under-prepare, both of which cost more than the fraud itself.

What a chargeback actually costs you

Start with the mechanics, because they explain the stakes. A chargeback is when a customer's bank reverses a payment, usually after a dispute. For the merchant, that's rarely just the lost sale. You typically lose the money, you've often already shipped the goods so you lose those too, and you usually pay a chargeback fee on top. So a single disputed order can cost you well more than the order was ever worth. And there's a compounding danger: too many chargebacks, as a share of your transactions, can threaten your ability to process payments at all, because the payment networks treat a high chargeback rate as a sign of a problem merchant. So this isn't just a line-item loss; left unmanaged, it's an existential one.

That's the risk dimension of payments made concrete. The question is how to defend against it without the defence costing you more than the thing it's defending against.

Two different problems wearing one word

The biggest mistake in fraud defence is treating "fraud" as one thing, because the two main kinds need almost opposite responses.

Criminal, third-party fraud is what most people picture: someone uses stolen card details to buy from you. The real cardholder never authorised it, and when they notice the charge, it becomes a chargeback you almost always lose. The defence here is detection: spotting the fraudulent transaction before you fulfil it, so you never ship goods you won't be paid for. This is where fraud-scoring, verification, and risk rules earn their place.

Friendly, first-party fraud is the one stores underestimate, and it's often not even malicious. A genuine customer disputes a charge they really did make. Sometimes it's deliberate ("I'll claim it never arrived"), but very often it's honest confusion: they didn't recognise the billing descriptor on their statement, they forgot the purchase, a family member used the card, or the order genuinely went missing. The defence for this isn't fraud-scoring at all, because the transaction was legitimate. It's clarity and good service: a billing descriptor they'll recognise, clear records of what they ordered and when, responsive support, and solid delivery tracking. A large share of "fraud" is preventable confusion, and you fix it with communication, not a risk engine.

Confuse the two and you mis-spend your defence: you let criminal fraud through while aggressively fighting confused-but-genuine customers, which is the worst of both worlds.

The false-positive trap

Here's the trap almost every store falls into once fraud has hurt them: they crank prevention up to maximum. It feels responsible, who wants to be the soft target, but it ignores the cost on the other side of the dial. Every fraud filter produces false positives: legitimate customers wrongly flagged and blocked. Turn the defence up high enough and you start rejecting good customers in numbers that dwarf what you were losing to fraud, and each one you block is not just a lost sale but a lost lifetime of sales, plus the trust of a customer who got told their perfectly normal order looked suspicious.

The cruel part is that this cost is invisible. Fraud losses show up clearly on a report. The good customers you wrongly turned away don't appear anywhere; they just quietly don't come back, and you congratulate yourself on a low fraud rate while bleeding far more out of a wound you can't see. Over-defence is its own expense, and it's the one stores routinely fail to count.

That's why zero fraud is the wrong target. A defence tuned to stop every last fraudulent order will block so many real customers that it costs you more than the fraud ever would. The right target is the lowest total cost, fraud losses, plus the cost of prevention, plus the value of the good customers your prevention scares off, minimised together. Some fraud is genuinely cheaper to absorb than to prevent, and accepting that is a sign of a mature defence, not a weak one.

Building a proportionate defence

The fix for both the under-prepared start and the over-corrected response is the same: a defence proportionate to your actual risk, built before you're hit rather than in a panic after. A few durable principles:

• Match the defence to the risk. A high-ticket or high-fraud-category store needs more protection than a low-ticket, low-risk one. Applying a fortress to a low-risk store just generates false positives; under-protecting a high-risk one invites the wave. Calibrate to your reality, not to a worst-case story.
• Keep a human on the ambiguous, high-value cases. Don't auto-reject or auto-fulfil the risky edge cases. This is the human-in-the-loop principle from automation applied to payments: the irreversible, high-stakes decision (ship to a flagged order, or reject a possibly-good customer) is exactly the kind that should keep a human gate rather than running fully automatically.
• Attack friendly fraud with non-fraud tools. Since much of it is confusion, the highest-return fixes aren't fraud tools at all: a clear billing descriptor, unambiguous order records, responsive service, and good tracking prevent disputes before they start.
• Use your provider's tools, but understand the liability. The payment networks have rules about who bears the loss in different scenarios, and certain authentication steps can shift that liability. You don't need to be an expert, but you carry the risk, so it's worth knowing roughly where it sits rather than assuming the provider has it covered.

What this comes down to

Fraud defence is risk management, not a moral crusade to stop every bad actor. The goal isn't zero fraud; it's the lowest total cost once you count fraud losses, prevention, and the good customers an over-tight defence scares away. Build that defence before the first wave rather than after, keep a human on the ambiguous high-value cases, and remember that a large share of disputes are confused customers you can win back with clarity rather than block with a risk engine.

The expensive mistake isn't absorbing a bit of fraud. It's building a fortress that turns away the legitimate customers you spent everything to acquire, while you admire your low fraud rate, because the customers that fortress blocks don't file a complaint. They just never come back.

A few common questions

What does a chargeback actually cost a merchant? Usually far more than the order. You typically lose the payment, you've often already shipped the goods so you lose those too, and you usually pay a chargeback fee on top. Worse, a high chargeback rate as a share of your transactions can threaten your ability to process payments at all, because the networks treat it as a sign of a problem merchant. So it's not just a line-item loss; left unmanaged it becomes an existential one.

What's the difference between criminal and friendly fraud? Criminal (third-party) fraud is someone using stolen card details, where the defence is detecting the bad transaction before you fulfil it. Friendly (first-party) fraud is a real customer disputing a charge they actually made, often from honest confusion (an unrecognised billing descriptor, a forgotten purchase, a family member). That one isn't solved by fraud-scoring, because the transaction was legitimate; it's solved by clarity, recognisable descriptors, good records, responsive service, and tracking. Confusing the two means you fight genuine customers while letting real fraud through.

Why is maximum fraud prevention a bad idea? Because every filter has false positives, and cranking prevention to maximum blocks legitimate customers in numbers that can dwarf the fraud you stop. Each blocked good customer is a lost lifetime of sales plus lost trust, and that cost is invisible, it never shows on a report, unlike fraud losses, so you congratulate yourself on a low fraud rate while bleeding more from a wound you can't see. Zero fraud is the wrong target; the lowest total cost is.

How should a store set its fraud defence? Proportionately, and before the first wave. Match the defence to your actual risk (high-ticket or high-fraud categories need more; low-risk stores need less), keep a human reviewing ambiguous high-value cases rather than auto-deciding them, attack friendly fraud with non-fraud tools like clear billing descriptors and good service, and understand roughly where payment-network liability sits rather than assuming your provider covers it. The aim is calibration, not maximisation.