Security and anti-fraud
Every transaction passes through several layers of checking before it is approved.
The aim is not to block everything suspicious. That kills conversion. The aim is rules tuned to your business, so risky transactions are stopped while normal ones pass without friction.
So rules are set by value, country, frequency and behaviour, and adjusted according to what your own statistics show.
What you get
PCI DSS Level 1
Card data is handled in a certified environment.
3-D Secure 2
Strong authentication with low-risk exemptions.
Risk rules
Velocity limits, geo filters and blacklists.
Chargeback handling
Alerts, deadlines and evidence preparation.
Monitoring
Decline and dispute rates tracked over time.
Manual review
A queue for borderline cases instead of an automatic decline.
How it works
Scoring
The transaction is scored against the rules for your profile.
Authentication
3-D Secure is triggered only where needed.
Decision
Approve, decline or send for manual review.
Monitoring
Statistics are watched and the rules retuned.
Fraud costs more than the amount stolen
When a fraudulent transaction goes through, you lose three things at once. The goods you have already shipped. The amount, which returns to the real cardholder. And a chargeback fee. If it repeats, a fourth appears: the schemes place you in a monitoring programme, which means higher fees and a real risk of losing processing altogether.
So fraud control is insurance, not overhead, and its goal is not zero fraud. The goal is for fraud to be small enough that the cost of stopping it does not exceed the damage. A rule that blocks one fraudulent hundred-euro payment and three genuine two-hundred-euro ones is a loss, however good the fraud statistics look.
How the judgement is made in a second
Every transaction is scored before it goes to the bank. Dozens of signals feed in: does the card country match the IP country, is the device known, how many orders has this email placed in the last hour, does the delivery address match the billing address, is the amount typical for this shop, how fast was the form filled in.
No single signal is enough on its own. A foreign IP is normal for a Bulgarian abroad. A new card is normal for a new customer. Five weak signals together, though, start to mean something.
The result is one of three actions: allow, request 3-D Secure authentication, or decline. The middle action is the most useful, because it shifts liability to the issuing bank without losing the customer.
Tuned to the business, not from a template
An electronics shop with next-day delivery has a completely different risk profile from a studio selling online courses. For the first, expensive portable goods to a new address is a classic signal. For the second, delivery is instant and there is nothing to steal but access.
That is why we start in monitoring mode rather than blocking. For the first weeks the rules run in report-only: you see what they would have stopped without losing sales. Then we tighten where the signal has proved itself.
Rules are revisited after the business changes too. A new delivery country, a new high-value product or a campaign bringing unusual traffic all shift what normal looks like, and old thresholds start getting it wrong.
Signals, and what each means on its own
No single row here justifies a decline. The combination is what counts.
| Signal | Could mean fraud | But equally means |
|---|---|---|
| IP in another country | A stolen card in use | A customer travelling or roaming |
| Delivery address unlike the card address | A redirected parcel | A gift, or delivery to an office |
| Several orders within minutes | Stolen cards being tested | A customer who split the basket |
| New card, large amount | A first try with someone else's card | A new customer with real intent |
| Form filled in very fast | An automated script | Details saved in the browser |
The rules combine signals into one score instead of looking at each alone. That is why one unusual fact does not block a genuine customer.
What you can do yourself this week
Part of the defence is organisational rather than technical.
- A recognisable company name on the customer's statement
- A confirmation email immediately after the order
- A trackable shipment number, uploaded to the panel
- A signature or photo on delivery of high-value goods
- A manual review rule above a certain amount
- Two-factor protection on access to your own admin
Questions about this
Who carries the loss on fraud?
It depends on authentication. With successful 3-D Secure, liability for an unauthorised transaction usually shifts to the issuing bank. Without authentication the loss stays with you. That is why exemptions are used with care.
Will fraud control get in my real customers' way?
If it is set from a generic template, yes. That is why we start in monitoring mode and tighten on real data from your shop rather than on assumptions.
What chargeback rate is normal?
The schemes track the ratio against turnover and have thresholds above which you enter a monitoring programme. If you approach them you will see it in the panel and we will call you before it becomes a problem.
Can I block an entire country?
You can, but it is rarely a good idea. A rule on a combination of signals is more accurate. Blocking a whole country also stops customers who are travelling.
What happens with a suspicious order?
Depending on the setting: flagged for manual review, challenged for authentication, or declined. On manual review you see every signal and decide yourself, usually in a minute.
How long does tuning the rules take?
An initial profile is in place at launch. Monitoring mode usually runs two to four weeks, long enough to gather sufficient transactions, after which the rules are tightened on real data.
Can I see exactly why a given order was stopped?
Yes. For every flagged transaction the panel shows which rules fired and with what weight. That matters, because it lets you judge whether a rule is earning its place or catching the wrong people.
Ready to start accepting payments?
Send us an enquiry and you will get a concrete quote with calculated fees for your business, usually within one business day.