Prepaid Card Fraud: Risk Signals, Liability, and Chargeback Exposure

Prepaid card fraud is the misuse of prepaid payment cards, through counterfeit cards, stolen cards, unauthorized reloads, or account takeover, to make purchases that leave merchants holding the loss and, often, a chargeback.

Prepaid cards are popular precisely because they are less tied to a verified identity than a credit or debit card. That same anonymity that makes them convenient for consumers is what fraudsters exploit. Prepaid card fraud is a specialized form of payment fraud built around stored-value accounts rather than a line of credit.

The FTC reported $12.5 billion in total consumer fraud losses for 2024, a 25% jump from 2023, and prepaid and gift card payment methods remain a preferred laundering channel precisely because they move value without the paper trail a bank transfer leaves. This guide covers how the fraud works, how to tell true third-party fraud from first-party misuse, and how to close the loop between a fraud signal and the dispute it eventually produces.

Comprendre la fraude liée aux cartes prépayées

To combat prepaid card fraud, you need to know its main patterns. The table below summarizes them, with detail in the sections that follow.

1. Cartes prépayées contrefaites

Fraudsters create counterfeit prepaid cards convincing enough that merchants unknowingly accept them as valid payment, then use them to complete fraudulent transactions.

2. Cartes prépayées volées

Fraudsters acquire prepaid cards through theft or illegal means and use the stolen details to make unauthorized purchases, causing financial loss to both the cardholder and the merchant.

3. Recharges non autorisées

Fraudsters exploit weak security or system loopholes to add funds to prepaid cards without legitimate authorization, then use that manufactured balance for fraudulent transactions.

4. Piratage de compte

Fraudsters gain unauthorized access to a cardholder's prepaid account, often through leaked or reused credentials, and use that control to drain funds or make fraudulent purchases before the real cardholder notices.

Trace the Attack: From Account or Checkout to Fulfillment and Dispute

Most prepaid fraud follows a similar path, and knowing where you are in it tells you which control actually applies. It typically runs: credential or card data obtained (breach, phishing, or card cracking), a small test transaction to confirm the card or account is live, a larger purchase or reload once the card clears testing, order fulfillment before the fraud is detected, and finally a dispute filed either by the real cardholder discovering the misuse or by the fraudster themselves attempting to extract a refund on top of the stolen goods.

Each stage produces a different signal. A cluster of small failed or approved transactions across many cards from one IP is a testing pattern. A sudden reload followed by an immediate high-value purchase is a reload-and-drain pattern. A shipping address that does not match the billing profile at all is a fulfillment-stage red flag. Catching the pattern before fulfillment is the only stage where you avoid the loss entirely.

Les tactiques utilisées par les fraudeurs

Fraudsters use several tactics to run prepaid card fraud, and detection depends on recognizing each:

1. Card Cracking: fraudsters recruit individuals to supply their prepaid card information, promising a cut of the proceeds, then use the collected details to run fraudulent transactions against those cards.
2. Card Testing: fraudsters test stolen card details with small transactions. If those go unnoticed, they move to larger unauthorized purchases while minimizing the chance of detection.
3. Triangulation Fraud: fraudsters pose as legitimate sellers on ecommerce platforms, take payment for products they never deliver or replace with counterfeits, deceiving both the customer and the merchant whose brand gets associated with the scam.
4. Phishing and Social Engineering: fraudsters send deceptive messages or calls impersonating trusted entities to trick people into revealing prepaid card information, often by manufacturing urgency.

Recognizing these patterns lets merchants build real prevention measures to safeguard their eCommerce businesses instead of reacting case by case after the loss is already booked.

Separate True Third-Party Fraud From First-Party Misuse

Not every prepaid dispute is a stranger stealing a card. First-party misuse, a legitimate cardholder claiming they never made a purchase they actually made, or claiming non-delivery on an item they received, shows up in the same dispute queue as genuine theft and needs a different response.

Signals that point toward first-party misuse rather than stolen-card fraud include: the shipping address matches the cardholder's known address, the device and login pattern match the account's normal history, and there is no other fraud activity on that card or account. When those signals are present, the fight is a friendly-fraud representment case built on delivery and communication evidence, not a fraud-prevention gap. Chargeflow's guide to friendly fraud covers how to build that case.

Map Signals, Controls, False-Positive Risk, and Liability

Every control you add to catch prepaid fraud has a false-positive cost, a legitimate customer who gets blocked or delayed. Balancing detection against friction is the actual job here, not maximizing either one in isolation.

• Velocity checks (many transactions in a short window) catch card testing well but can flag a legitimate customer buying multiple gift cards at once.
• Address verification and IP geolocation catch mismatched shipping and billing patterns but produce false positives for customers shipping to a workplace or a gift recipient.
• 3D Secure authentication can support liability shift for eligible card-not-present fraud disputes. Successful authentication does not guarantee authorization or liability shift, and it does not resolve claims such as non-delivery or credit not processed.
• Device fingerprinting catches account takeover well but needs a real incident history to tune, or it over-flags shared devices and family accounts.

Check the dispute reason and the recorded authentication outcome before assigning liability. Eligible card-not-present fraud disputes can qualify for issuer liability under 3D Secure or a qualifying equivalent; non-fraud claims and network exceptions remain separate. Stripe's 3D Secure guidance identifies exceptions, including some stored-value card purchases or loads. The card network's reason-specific evidence requirements should guide your chargeback fraud prevention workflow.

Conséquences pour les commerçants en ligne

Prepaid card fraud creates real consequences beyond the immediate loss:

1. Financial Losses: fraudsters exploit payment system vulnerabilities, resulting in unauthorized transactions and chargebacks. Reimbursing customers, investigating cases, and running prevention measures all cut into margin.

2. Damaged Reputation: when customers experience fraudulent transactions, they lose trust in a merchant's ability to run secure checkout, and negative reviews discourage new customers from engaging at all.

3. Increased Chargebacks and Disputes: prepaid fraud drives up dispute volume, and a high volume of chargebacks strains relationships with payment processors and acquiring banks, sometimes pushing a merchant toward a card network's monitoring program.

4. Operational Disruptions: fraud-related manual reviews and additional security checks slow order processing and add friction for legitimate customers.

5. PCI DSS Compliance: establish the PCI DSS requirements that apply to your payment-data environment with your acquirer. PCI SSC's compliance FAQ explains that individual payment brands manage their own compliance programs and may impose financial or operational consequences; PCI SSC itself does not impose penalties.

Specify Evidence to Retain Before and After Fulfillment

Winning a prepaid fraud dispute, or correctly conceding one you cannot win, depends on evidence captured at two distinct points.

Before fulfillment: the authorization result, any 3D Secure or address verification outcome, device and IP data at checkout, and the shipping address entered. After fulfillment: proof of delivery, any customer communication about the order, and the account or session activity between purchase and delivery. Retaining both halves is what separates a fast, evidence-backed representment from a merchant reconstructing the transaction from memory after a chargeback notice arrives, often well after the chargeback time limit for a full response has already started running.

Prepaid Card Fraud and Disputes/Chargebacks

Prepaid card fraud threatens merchants both through direct losses and the disputes and chargebacks that follow. Fraudsters exploit the dispute process itself, using stolen or counterfeit prepaid cards to make purchases that look legitimate until the real cardholder or card issuer catches the misuse.

Once fraud is discovered, cardholders file disputes to reclaim their money, and the merchant bears the financial burden even though it acted on what looked like a valid transaction. The resulting disputes carry the same reputational cost as the fraud itself: lost customer trust and, over time, lost business.

Investing in real-time fraud screening to catch suspicious prepaid transactions matters, but so does pairing that screening with automated chargeback protection and chargeback prevention alerts that intercept disputes early and automate evidence-based responses.

Address verification and IP geolocation analysis add further signal on prepaid purchase legitimacy, and working with payment service providers who offer real-time fraud monitoring and 3D Secure authentication adds another layer of protection.

Training staff to recognize red flags is just as important, since merchants can minimize the risk of falling victim to fraudsters simply by knowing what a testing pattern or a triangulation scheme looks like before it drains an afternoon of support time. Clear, proactive customer communication about secure practices builds the same trust that keeps a confused customer from reaching for a dispute instead of your support inbox.

Close the Loop Using Dispute Results and Reason Codes

Every prepaid fraud dispute resolves under a specific card network reason code, and that code is the single best data point for improving your controls going forward. A pattern of disputes landing under a fraud-specific code, rather than a service or delivery code, tells you the loss is a chargeback fraud problem to solve at the authorization stage, not a fulfillment problem to solve at the warehouse.

Feed dispute outcomes back into your fraud rules on a regular cadence: which velocity thresholds actually caught fraud versus just added friction, which shipping-mismatch flags were false positives, and which accounts showed a takeover pattern before the dispute ever landed. As checkout increasingly runs through AI-assisted and agentic commerce chargebacks flows, this feedback loop matters even more, since AI agent chargeback liability is still being worked out case by case, and a clean evidence trail is what protects a merchant either way. Building this discipline into a broader ecommerce fraud prevention program is what turns isolated fraud incidents into a system that gets better over time.

Treat Prepaid Fraud As a Liability Problem, Not Just a Fraud Problem

Prepaid card fraud is a real and growing threat, but the merchants who manage it well treat it as two connected problems: stopping the fraud at authorization, and building the evidence trail that wins or correctly resolves the dispute that follows anyway.

Layer fraud screening, address verification, and 3D Secure at the front end, retain evidence at every stage from checkout to delivery, and feed dispute outcomes back into your controls. That loop, not any single tool, is what keeps prepaid fraud from quietly eating into margin month after month.

Foire aux questions

Qu'est-ce que la fraude aux cartes prépayées ?

It is the misuse of prepaid payment cards to make fraudulent purchases, through counterfeit cards, stolen card details, unauthorized reloads, or account takeover, leaving merchants with losses and chargebacks.

Pourquoi les cartes prépayées attirent-elles les fraudeurs ?

Les cartes prépayées sont souvent moins liées à une identité vérifiée que les cartes de crédit, ce qui facilite leur obtention de manière anonyme et rend leur traçabilité plus difficile ; les fraudeurs exploitent cette situation pour mettre en place des stratagèmes de test de cartes et de triangulation.

Comment les commerçants peuvent-ils détecter les fraudes liées aux cartes prépayées ?

Use real-time fraud screening, address verification (AVS), IP geolocation, device fingerprinting, and velocity checks. Many small test transactions or mismatched location data are common red flags.

Do chargebacks apply to prepaid cards?

Yes. Many prepaid cards are branded by card networks, so disputes and chargebacks follow similar rules, meaning merchants can still lose funds and pay chargeback fees on fraudulent prepaid transactions.

Who is liable when a prepaid card transaction turns out to be fraudulent?

For a card-not-present fraud dispute, check whether the actual transaction qualifies for issuer liability under 3D Secure or an equivalent authentication. Success alone is not a guarantee. Non-fraud claims, stored-value purchase/load exceptions and the applicable network rules still require separate handling.

What's the best way to prevent prepaid card fraud losses?

Mettez en place un système de détection des fraudes à plusieurs niveaux, comprenant le protocole 3D Secure, une formation approfondie du personnel et des clients, ainsi qu’une protection automatisée contre les rétrofacturations et des alertes préventives, afin que les transactions suspectes soient signalées et que les litiges soient traités avant qu’ils ne se transforment en pertes.

See how Chargeflow Prevent screens prepaid transactions before checkout and recovers the disputes that get through anyway.