Online Store Fraud: Fake Orders, Card Testing and How to Stop Them
Practice4 minInnovialabs editorial team
In short
Most attacks on a store follow repeatable patterns, so they are stopped with rate limits, velocity rules, phone verification and a manual review queue for risky orders.
How to stop fake orders
Online store fraud almost always leaves a pattern: many attempts in a short time, the same devices, odd addresses, brand-new accounts. Defense works in layers:
- Rate limits on checkout, login and promo code redemption.
- Velocity rules — caps on actions per card, phone, IP, device and address.
- Phone verification via SMS or Telegram for risky orders.
- A manual review queue for orders with a suspicious risk score.
- 3-D Secure and your payment provider's fraud tools — turn them on instead of rebuilding them.
The goal is not to catch everyone but to make attacks slow and expensive without getting in the way of honest buyers.
Common fraud patterns
| Pattern | What it looks like | Damage |
|---|---|---|
| Card testing | Hundreds of small payments with different card numbers | Fees, chargebacks, merchant account risk |
| Bot orders | Mass orders for scarce products | Stock goes to resellers |
| Cash-on-delivery refusals | COD orders nobody picks up | Shipping and return costs |
| Promo abuse | New accounts created for a first-order discount | Discounts reach the wrong people |
| Account takeover | Logging in with leaked passwords | Purchases with bonuses and saved cards |
Card testing deserves special attention: fraudsters check stolen cards with tiny amounts. Signs include a spike in failed authorizations, the same cheap product, and repeated names or random-looking emails.
Practical defenses
Limits and velocity rules
Count events in a sliding window and block or add friction when a threshold is exceeded:
- no more than N payment attempts per IP or device in 10 minutes;
- no more than N different cards per account per day;
- no more than N unpaid COD orders per phone number;
- one "first order" discount per phone, not per email.
Redis counters with a TTL work well:
key = f"pay_attempts:{ip}"
count = redis.incr(key)
if count == 1:
redis.expire(key, 600)
if count > 5:
require_captcha_or_block()
Phone verification
For cash on delivery and first orders, verifying the number sharply reduces empty orders. Tie promo codes and pickup history to a verified phone — it is harder to replace than an email.
Scoring and manual review
You don't need machine learning on day one. Start with a simple risk score:
- new account — add points;
- shipping country differs from card country — add points;
- several failed payments before a success — add points;
- large quantities of an expensive item — add points.
Orders above the threshold go to a manual review queue, where an operator calls the customer or asks for confirmation. Give the queue an SLA, or honest customers end up waiting.
Account protection
- Login attempt limits and alerts for new-device logins.
- Re-authentication when changing address or phone, or when paying with bonuses.
- Checking passwords against breach lists at sign-up.
Common mistakes
- Blocking on a single signal. A foreign IP may just be an honest customer's VPN. Combine signals.
- Ignoring failed payments. Card testing shows up in declines, not successful orders.
- Hardcoding rules. Thresholds change often — move them to config or an admin panel.
- Not logging decisions. Without logs you can't explain why an order was rejected or handle a complaint.
- Punishing everyone. CAPTCHA and SMS on every step hurt conversion; add friction only when risk is high.
How to choose your level of protection
Start with the basics: limits on checkout and login, 3-D Secure, and phone verification for COD. Add scoring and manual review once chargeback and non-pickup reports show real losses. Dedicated fraud services make sense at high volume and with international payments.