What it means
In a shop, the chip and the PIN prove that the real card and the real cardholder are present. Online there is no card to read, only numbers that can be stolen, bought or guessed, so the merchant is relying on data rather than on physical evidence.
That difference is why liability for a disputed remote transaction normally sits with the seller. The cost to a business is larger than the fraudulent sale itself.
The merchant loses the goods, refunds the transaction, pays a chargeback fee and, if the dispute rate climbs too high, faces higher processing charges or removal from card scheme programmes. Fraud is therefore a margin issue and an operational risk, not just a security matter.
Merchants manage it with layered controls: address and security code checks, device and behaviour scoring, velocity rules that flag many attempts from one source and strong customer authentication that pushes liability back to the issuer. Each control catches some fraud and also rejects some genuine customers, which is the real trade-off.
False declines frequently cost more revenue than the fraud they prevent. The nuance worth remembering is that fraud rate should be measured in basis points of sales value, not in raw incidents.
A rising incident count on rapidly growing revenue may be perfectly normal, while a stable count on flat revenue can hide a serious change in the mix of attacks.
In practice
Real-world examples.
Example
An electronics retailer sees a burst of small orders for the same phone accessory, each shipped to a different address in one postcode. The pattern is a card testing attack, where criminals check stolen numbers with cheap purchases before attempting larger ones elsewhere.
Example
A subscription software company finds that 2% of new sign-ups are fraudulent, all created with free email addresses and paid on cards issued in one country. It adds a verification step at sign-up rather than at payment, and the attack moves elsewhere within a week.
Example
A ticketing platform tightens its fraud rules before a major event and cuts losses by half, but the finance team then measures a 3% drop in approved orders. The revenue lost to declined genuine customers exceeds the fraud saved, so the rules are relaxed and replaced with risk scoring.
Formula
Calculation
Fraud rate = value of fraudulent transactions / total card sales value, often quoted in basis points where one basis point is 0.01%. Total fraud cost = fraud value + chargeback fees + cost of goods lost.
An online retailer processes $6,000,000 of card sales in a quarter and confirms $18,000 of card-not-present fraud. Fraud rate = $18,000 / $6,000,000 = 0.30%, or 30 basis points. The fraud came through 400 orders averaging $18,000 / 400 = $45 each, and the acquirer charges $20 for every chargeback, adding 400 x $20 = $8,000. Total quarterly cost = $18,000 + $8,000 = $26,000. A screening service costing $10,000 a quarter that stops 60% of this activity saves 0.60 x $26,000 = $15,600, a net gain of $15,600 - $10,000 = $5,600.Case study
Seen in the real world.
Brightpath Outdoors is a fictional, illustrative online retailer of camping equipment turning over about $24,000,000 a year. After launching a next day delivery option its fraud rate rose from 12 basis points to 34 within two quarters, because fast shipping gave the business no time to review suspicious orders before they left the warehouse.
The illustrative response was not to switch the service off. Brightpath introduced a scoring model that only held the riskiest 2% of orders for manual review, added strong customer authentication for orders above $300, and moved high value dispatches to a courier requiring signature on delivery.
Within two quarters the fraud rate settled at 15 basis points while approval rates for genuine customers stayed flat. The fictional finance director's summary was that fraud control had to be tuned like a pricing decision, since the goal was maximum net revenue rather than minimum fraud.
Watch out
Common mistakes.
- Measuring success purely by fraud caught, while ignoring the genuine orders declined by the same rules.
- Assuming the bank absorbs the loss on a disputed remote transaction, when the merchant usually carries it.
- Treating a matching security code as proof of legitimacy, when that code is often stolen along with the card number.
Questions
People also ask.
What is a chargeback?
It is the forced reversal of a card payment initiated by the cardholder's bank, and it takes the money back from the merchant along with a fee.
Does strong customer authentication remove the risk?
It shifts liability for many transactions to the card issuer and blocks a large share of attacks, but it adds friction and does not cover every payment type.
What fraud rate is acceptable?
Most card schemes expect merchants to stay well below roughly 50 to 100 basis points, and businesses persistently above that face monitoring or penalties.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related