Every fraud control is a trade between losses and lost sales. Turn the dials too far one way and you bleed chargebacks; too far the other and you decline paying customers. Here’s what the main card-not-present tools actually do — and what each one costs you.
3-D Secure: the liability shift
3-D Secure adds an authentication step between the customer and their issuing bank. The important part isn’t the friction — it’s that on a successfully authenticated transaction, liability for fraud chargebacks generally shifts from you to the issuer. For high-ticket or high-fraud categories, that shift alone can justify it.
Modern implementations are far lighter than the old full-page redirects: most transactions pass invisibly on risk data alone, and only the questionable ones get challenged. If your memory of 3-D Secure is customers abandoning at a clunky bank page, that impression is a decade out of date — but test your own checkout before believing any vendor’s claim about it.
AVS and CVV: cheap, blunt, still useful
Address and security-code verification cost nothing extra and catch straightforward card-not-present fraud. The mistake is treating them as pass/fail. A partial address match on a legitimate customer who moved last month is not fraud — it’s a customer. Decide which mismatch combinations you’ll decline, which you’ll accept, and which deserve a manual look, and revisit that decision when your fraud pattern changes. Left at defaults, these rules quietly decline real revenue, as covered in why cards get declined at checkout.
Velocity rules
Limits on attempts per card, per IP, per device over a time window. These are your defense against card testing — the automated probing that runs thousands of stolen numbers through any checkout that will take them. Card testing is worth blocking for its own sake: it wrecks your approval rate, triggers processor reviews, and can get an account frozen even when almost every attempt fails.
The right order to turn things on
- Velocity limits first. Cheap, invisible to genuine customers, and stops the worst-case scenario.
- Sensible AVS/CVV rules second. Tuned to your actual fraud pattern, not the default.
- 3-D Secure third, applied selectively — high tickets, risky geographies, first-time customers.
- Manual review last, for the narrow band of orders worth a human minute.
Measure what it costs you
Fraud tooling has a failure mode nobody reports: sales that never happened. Track approval rate and fraud rate together, and treat a rule that cuts fraud by a little while cutting approvals by a lot as the loss it is.
Configured for how you actually sell
At Creditcard Payment Services, gateways come configured with fraud controls matched to your risk profile rather than a generic default — part of placing high-risk merchant accounts that stay open. Since 2009.
Fighting fraud and declines at the same time? Apply online or call 1-800-475-6011. No cost to apply.
Ready to find out where you stand?
Most approvals come back in 2–3 business days — and there’s no cost to apply and no obligation.
Apply onlineor call 1-800-475-6011