eCommerce fraud is a huge problem for online merchants. With global online sales hitting nearly $5.2 trillion worldwide in 2021, forecasts report a 56% growth over the coming years, reaching $8.1 trillion by 2026. Unsurprisingly, eCommerce fraud is also growing — with losses hitting $41 billion in 2022 to an estimated $48 billion this year.
Online Fraud Doubled Between 2021 and 2023
As consumers complete more transactions online and alternative payment methods like BNPL (Buy Now Pay Later) and digital wallets have gone mainstream, new fraud risks are surfacing. It’s more important than ever that online merchants line up defenses against any gaps that make them or their customers vulnerable to cybersecurity attacks. Here are the latest best practices to consider as you protect your shop.
Tap Into Fraud Detection Tools
Fraud detection tools help online businesses detect and prevent fraudulent activity. While many limited solutions exist that handle only some essential fraud prevention processes, there are also more robust solutions that can manage multiple layers of detecting fraud. Software solutions like NoFraud use powerful artificial intelligence (AI) models to analyze hundreds of data points per transaction to identify potential fraud in real-time.
Online merchants today need a variety of tools in their toolkit to fight fraud. For an effective eCommerce fraud protection solution, be sure to look for tools that can provide:
- Identity verification verifies the identity of customers and helps prevent identity theft.
- Chargeback management helps businesses manage chargebacks and disputes by automating the process of gathering evidence and responding to chargeback requests.
- IP address geolocation tracking identifies the location of customers based on their IP address, which can help flag risky transactions.
- Payment fraud prevention helps prevent payment fraud by analyzing transaction data and identifying potential fraud.
Use a Secure Payment Gateway
A secure payment gateway is essential to protecting sensitive financial information during online transactions. A payment gateway is a service that processes online payments, allowing merchants to accept credit card payments from customers (e.g., Stripe, Square).
A secure payment gateway uses encryption and other security measures to protect the customer’s sensitive financial information like their credit card number, expiration date, and security code. This information is encrypted during the transaction and is not stored on the merchant’s servers, reducing the risk of a data breach.
Great payment gateways include the following features: SSL (Secure Sockets Layer) encryption, PCI (Payment Card Industry) compliance, fraud detection, tokenization, and two-factor authentication (2FA).
Protect Your Website
A secure website protects both your business and customers’ sensitive information. The goal is to not make it easy for hackers to gain access into your systems. Use HTTPS (Hypertext Transfer Protocol Secure) to encrypt all data transmitted between the customer’s browser and your server. This will protect sensitive information — like passwords, credit card numbers, and personal information — from interception by fraudsters. Additionally, be sure to limit the types of files that can be uploaded and scan them for malware before they are stored on your server.
Encourage all users to create strong passwords. From customers creating accounts to internal staff and site administrators using tools in your tech stack, a weak password can welcome a data breach.
Another way to protect your website is to regularly check for software updates and backup your website’s data. Having the latest software updates across your website tools — content management, plugins, third-party applications — will help reduce security vulnerabilities.
Lastly, monitor website traffic. Any unusual activity, such as changes to files and traffic spikes can be signs of a security breach.
Verify Customer Identity
When it comes to verifying customer identity, it’s a delicate balance between taking the proper security measures and maintaining that frictionless experience your customers love. 2FA is an effective, additional layer of security that requires the customer to provide two forms of identification, such as a password and a one-time code sent to their mobile phone. This can help prevent unauthorized access to customer accounts.
You can also request additional information or leverage an identity verification service to help with verification by checking their government-issued ID, passport, or driver’s license.
Monitor Transactions & Set Limits
It’s important to monitor transactions in real-time. Real-time monitoring allows you to identify and respond to fraudulent activity as soon as it happens, reducing the risk of financial loss. Setting transaction limits can help prevent large transactions that may be fraudulent. For example, you can set a daily transaction limit or a limit on the amount that can be charged to a single credit card without requiring additional verification.
For high-value transactions, setup additional verification methods like email confirmation to ensure the cardholder is making the purchase. And if you notice a spike in chargeback rates, it’s time to investigate because it can be a sign of fraudulent activity.
Use Device Intelligence
Last, but most important, is device intelligence. Device intelligence is the use of data and analytics to gain insights into the devices used by your customers. If you’re using NoFraud, over 99.5% of decisions are made instantaneously using powerful algorithms that combine customer inputs (including device intelligence) with third-party sources to produce thousands of data points. These data points are then analyzed in real-time to provide clear pass/fail decisions.
By analyzing device data — across computers, smartphones, and tablets — you can identify potential fraud and authenticate legitimate transactions. To protect your shop from eCommerce fraud, look at:
- Device fingerprints: Device fingerprints are unique identifiers that can be used to identify individual devices. By analyzing device fingerprints, you can detect anomalies, such as multiple accounts being accessed from the same device, which may indicate fraudulent activity.
- Geolocation data: Geolocation data can be used to verify the location of a customer’s device and compare it to their billing and shipping address. This can help detect fraudulent transactions, such as those made using stolen credit card information.
- Device attributes: Device attributes — the device model, operating system, and browser — can be used to identify potentially fraudulent activity. For example, if a customer is using an outdated operating system or browser, they may be more susceptible to malware and other forms of cybercrime.
It’s also important to set device-based rules that are based on device characteristics, e.g., the number of transactions allowed from a single device or the type of device used for a transaction. The benefits of using device intelligence go beyond fraud prevention; it also helps you understand the intricacies of the customer experience, allowing you to make improvements.
Privacy concerns? Device intelligence is considered personal data under GDPR, but is not considered PII because it’s anonymous and cannot be used on its own to identify a person.
Don’t Leave Money on the Table
While it’s important to protect your shop from fraud, it’s equally important to do so in a way that doesn’t create friction for customers. As many as 67% of declined orders are legitimate. And even worse, up to 40% of those rejected — but legitimate — customers may choose to never shop with you again. The only true way to effectively block fraudulent orders and approve legitimate purchases is to add a human layer to your fraud detection stack.
If you’re using a full-service fraud prevention solution like NoFraud, proactive analyst review is built into the process. Unlike other solutions that rely too heavily on automation for decision-making, NoFraud’s Proactive Review process leverages automation to put transactions on a low-high fraud risk scale.
Any orders falling in the middle of this continuum are automatically escalated to our analyst team for proactive review. Our goal is to approve the highest number of legitimate orders possible. In fact, merchants who switch to NoFraud have reported a 50% reduction in order declines — all without increasing the number of chargebacks. The human layer is key!
