Payment Fraud: Types, Who Commits Them, and Who Bears the Loss

Payment fraud is any intentional deception or unauthorized activity that moves money through a payment, refund, or transfer. Who absorbs the loss depends on the fraud type and the payment rail, not on the fraud label alone.

A suspicious signal is a reason to investigate, not a finding of fraud, and a chargeback reason code records the disputed condition rather than proving who acted dishonestly. Classify each case by the person behind it, the rail it used, and the rule that decides who pays.

Types of Payment Fraud and Who Pays for Each

Each pattern has its own mechanics and controls. Read the card-not-present fraud guide for remote card payments, account takeover fraud for compromised customer accounts, card testing fraud for automated validation attempts (including BIN attacks), promo abuse for discount exploitation, and refund fraud for policy abuse after delivery. A control built for one pattern can leave another open, so keep ownership clear across payments, security, support, and fulfillment. For the full set of controls across the order lifecycle, see ecommerce fraud prevention. Automated and AI-assisted abuse is covered in AI payment fraud.

Types of Chargeback Fraud by Who Commits It

Types of chargeback fraud fall into three groups, based on who stands behind the transaction.

A fourth group is not fraud at all: billing errors, service failures, and genuine nonreceipt claims also arrive as chargebacks. Count them separately so they do not inflate your fraud rate or get answered with the wrong evidence.

Who Bears the Loss Depends on the Payment Rail

The Federal Reserve’s 2023 data on covered US debit card issuers shows how unevenly losses fall: merchants bore 49.9 percent of fraud losses, issuers 28.3 percent, and cardholders 21.8 percent, with card-not-present fraud accounting for 54.3 percent of overall debit card fraud (Federal Reserve, Regulation II report). The rule that moves a loss off the merchant differs by rail.

These protections mostly stop at the border. The UK reimbursement scheme excludes international payments, and a US remittance error claim does not cover a transfer the sender was tricked into making, so the card chargeback is often the only formal way back. See how cross-border money exchange fraud disputes work on each rail.

Read 3D Secure 2 for how authentication affects liability and evidence. The same question of who authorized the payment now arises when an AI shopping agent places the order, which AI agent chargeback liability covers, while AI agent fraud covers attacks that use automated agents to commit fraud.

Use Fraud Statistics With Their Original Scope

Sources: FTC testimony, March 2026; FBI IC3 2025 Internet Crime Report; Mastercard, What is the true cost of a chargeback for businesses? (updated June 2026, research by Datos Insights).

The FTC figure covers 3 million consumer fraud reports and is up from the $12.5 billion consumers reported in 2024. The IC3 totals come from about 1 million complaints, of which 24,768 were business email compromise. Mastercard’s forecast covers all chargebacks to merchants.

Each source measures a different population: reported consumer scams, reported cybercrime complaints, and card disputes. Do not turn consumer scam losses into a merchant loss rate or describe a forecast as an observed result. Compare your own fraud-coded disputes, declines, and refunds on consistent definitions and reporting periods instead.

Detect Suspicious Activity Without Blocking Good Customers

Look for combinations of unusual account changes, payment attempts, purchase values, destination changes, and confirmed customer reports. Shared addresses, new devices, and international travel can be legitimate, so define which combinations require review and give staff a way to resolve exceptions. The most common fraud red flags work as inputs to that review, not as automatic declines.

Card testing deserves its own monitoring because failed attempts matter as much as completed ones. The Stripe card-testing guidance describes spikes in failed payments and the need for layered integration controls. Protect both payment and card-setup paths where applicable, and involve the team that maintains the integration.

For triangulation fraud, distinguish the delivery recipient from the cardholder. A package reaching an innocent buyer does not establish authorization for the separate payment that funded fulfillment, so shipping success is not a fraud-clearance signal.

Choose the Action Based on the Payment Stage

The state matters as much as the suspected fraud type. Canceling an uncaptured payment differs from refunding a settled charge, and a dispute debit differs from a voluntary credit. Use the refund and chargeback reconciliation workflow when those processes overlap.

For payment-instruction changes, verify through an established independent channel before moving funds. Do not rely on a message asking you to update a payout destination or issue a refund somewhere new. Document approval and use the provider’s supported process for the actual transaction.

Build Evidence Around the Claim

Start with the chargeback reason code and the factual question it raises. Delivery records address fulfillment, cancellation history addresses later billing, and authentication and account records may be relevant to authorization. No single attachment proves every element of a disputed purchase.

Distinguish suspected friendly fraud from genuine confusion and valid service complaints, and investigate the facts before assigning intent. If the merchant made an error, correcting it is part of fraud and dispute operations, not a failure of the recovery team.

Use the evidence standardization workflow to create readable submissions and the dispute workflow audit to identify missed handoffs. Keep final submission status visible so an uploaded draft is not mistaken for a completed response.

Measure Net Outcomes and Improve the Weakest Step

Track confirmed fraud losses, good-customer declines, review delays, refund errors, response completion, and recovery outcomes separately. Record definitions and reporting periods so teams do not compare unlike measures, and include accepted valid claims in reporting rather than hiding them to improve an apparent win rate. Assign each metric an owner as part of your merchant fraud protection program.

After a rule change, review both prevented exposure and legitimate customer impact. After a lost case, identify whether the issue was missing evidence, an unsupported challenge, a deadline failure, or a real service problem, because each leads to a different fix.

Chargeflow complements payment and commerce infrastructure with Prevent for post-checkout order screening, Alerts for catching disputes before they become chargebacks, and automated chargeback recovery for evidence and submission. Confirm the data coverage that fits your workflow. For example, merchants using Stripe can connect supported dispute operations while keeping clear ownership of security, fulfillment, and customer resolution. When you choose a payment service provider, check how its agreement allocates fraud and dispute losses.

Frequently Asked Questions

What is payment fraud?

Payment fraud is any intentional deception or unauthorized activity that moves money through a payment, refund, or transfer. It includes stolen-card purchases, account takeover, card testing, impersonation scams, and deliberate dispute or refund abuse.

What are the main types of payment fraud?

The main types of payment fraud are stolen-card use, card testing, account takeover, triangulation, friendly fraud and chargeback fraud, refund and promo abuse, business email compromise, and authorized push payment scams. They differ by who commits them and by which rule decides who bears the loss.

What are the types of chargeback fraud?

Types of chargeback fraud are grouped by the person behind the transaction. Third-party fraud uses stolen credentials, first-party fraud is a genuine cardholder disputing a purchase they made, and second-party fraud involves someone the cardholder knows or an accomplice sharing credentials.

What is authorized push payment fraud?

Authorized push payment fraud is a scam in which the victim is manipulated into sending a transfer to the fraudster. Because the victim authorizes the payment, card-style liability rules do not apply, and reimbursement exists only where a scheme requires it, as in the UK since October 2024.

Is every chargeback payment fraud?

No. A chargeback can arise from unauthorized activity, customer confusion, nonreceipt, cancellation, or a processing error. Investigate the actual condition before classifying a chargeback as payment fraud.

Who bears the loss from a fraudulent payment?

Loss allocation for a fraudulent payment depends on the payment method, the transaction facts, applicable rules, authentication eligibility, and the provider agreement. For card-not-present fraud the merchant typically bears the loss unless 3D Secure authentication shifted liability to the issuer.

Can payment fraud be eliminated completely?

No single control eliminates payment fraud. Layered prevention, accurate operations, and timely case handling reduce exposure while keeping legitimate customers able to pay.