Payment fraud is a growing risk for Indian merchants accepting international card payments. Unlike domestic UPI (which has robust bank-side authentication), international cards are more susceptible to fraudulent use. Understanding the types of fraud, how to prevent them, and what to do when fraud occurs protects your revenue and your merchant account.
Types of Payment Fraud Indian Merchants Face
1. Card-Not-Present (CNP) Fraud
The most common type for online businesses. A fraudster uses stolen card details to make purchases online. The true cardholder didn't authorize the transaction.
Impact: Chargeback from true cardholder. You lose the transaction amount + pay $15-30 dispute fee.
2. Friendly Fraud (Chargeback Fraud)
A legitimate customer who actually received the goods/service files a chargeback claiming they didn't. "I didn't order this" when they did.
Impact: 20-40% of chargebacks in digital goods category are friendly fraud. Difficult to fight without delivery evidence.
3. Card Testing (BIN Attacks)
Fraudsters use your checkout to test stolen card numbers in bulk, making small transactions to see which cards are active. Suddenly your merchant account shows 100s of small transactions in minutes.
Impact: High decline rate (triggers fraud alerts at card networks), processing fee on each attempted transaction, merchant account flagged.
4. Account Takeover
A fraudster gains access to a legitimate customer's account on your platform and makes purchases.
Impact: Chargebacks from the compromised customer, reputational damage.
5. Refund Fraud
A fraudster makes a legitimate purchase, requests a refund to a different payment method (common in some platforms), then disputes the original charge. Double-refund.
Your Fraud Prevention Stack
Layer 1: 3DS Authentication
3D Secure shifts liability for fraud chargebacks from you to the issuing bank when authentication completes successfully.
3DS 2.0 (current standard): Risk-based. Low-risk transactions pass frictionlessly. Higher-risk trigger OTP.
Enable for: All international card transactions. Non-negotiable for EU customers (SCA required).
Playto Pay implements 3DS 2.0 by default for international card acceptance.
Layer 2: Velocity Checks
Flag or block:
- Multiple transactions from the same IP in a short window
- Multiple card numbers tried from same IP (card testing signal)
- Unusual transaction size vs your typical order value
- Same card used across multiple accounts Playto Pay's fraud scoring applies velocity rules automatically.
Layer 3: Address Verification (AVS)
For US cards, the Address Verification System checks that the billing address on the card matches what the customer provided. Mismatch is a fraud signal.
AVS result codes:
- Full match (address + zip): Low fraud risk
- Partial match (zip only): Moderate risk, proceed with caution
- No match: High fraud risk, consider declining or requiring additional verification
Layer 4: Transaction Monitoring
Review flagged transactions before processing:
- Orders from high-risk geographies (check your platform's list)
- First-time customers with large orders
- Multiple orders in quick succession to same delivery address with different card numbers
- Orders where billing and shipping addresses differ significantly
Layer 5: Merchant Descriptor Clarity
A recognizable merchant descriptor (the business name that appears on the customer's card statement) reduces "I don't recognize this charge" disputes.
Bad descriptor: PLAYSVCS or IND MERCH 7821
Good descriptor: Playto Pay - [Your Business Name]
Set your payment descriptor to match your brand name. Playto Pay allows custom descriptor configuration.
Layer 6: Refund Policy Clarity
Visible refund policy at checkout reduces chargebacks. Customers who know your policy have weaker grounds for disputing after the fact.
Document that refund policy was displayed at time of purchase (screenshot with timestamp — useful in chargeback disputes).
How to Respond When Fraud Occurs
If You Suspect Fraud Before Fulfilling:
- Hold the transaction
- Contact the customer via email (not phone — you want written record)
- Request additional verification (copy of ID, billing address confirmation)
- If you can't verify: refund and cancel the order
- Report the card details to your payment platform's fraud team
If You Receive a Fraud Chargeback:
- Check if 3DS completed — if yes, liability is with the issuing bank, not you
- If 3DS didn't complete: gather all available evidence (IP address, device fingerprint, login logs, delivery confirmation)
- Submit evidence within your platform's deadline (7-14 days)
- Flag the card number for future blocking
If You're Experiencing Card Testing:
- Immediately enable CAPTCHA on your checkout page
- Enable rate limiting on payment attempts (max 3 per IP per hour)
- Contact your payment platform to flag the BIN attack pattern
- Consider temporary IP blocking for the attack source
Chargeback Rate Monitoring
Track this monthly: Chargebacks ÷ Prior month transactions = Chargeback rate
| Rate | Status | Action |
|---|---|---|
| Below 0.5% | Healthy | Monitor monthly |
| 0.5-1% | Caution zone | Investigate and prevent |
| Above 1% | Visa/MC monitoring | Immediate action required |
| Above 1.5% | High risk | Account at risk of termination |
How Playto Pay Handles Fraud
Playto Pay includes:
- 3DS 2.0 for international card acceptance
- Fraud scoring with velocity checks
- Transaction monitoring with flagging
- Chargeback dispute management dashboard
- Merchant descriptor customization
FAQ
What is the most common fraud type for Indian merchants accepting international cards? Friendly fraud (chargebacks from legitimate customers claiming they didn't receive service) is most common in digital goods. Card-not-present fraud (stolen card details) is most common in physical e-commerce.
Does 3DS protect against all fraud? 3DS shifts liability for fraud chargebacks to the issuing bank when authentication completes. It doesn't prevent all fraud (friendly fraud isn't covered by 3DS liability shift) but eliminates your liability for genuine card fraud when 3DS is used.
How do I stop card testing attacks? Enable CAPTCHA on checkout, implement rate limiting (max attempts per IP), contact payment platform to flag the attack, consider temporary IP blocking.
What chargeback rate triggers monitoring programs? Visa: 0.65% early warning, 0.9% standard threshold, 1.8% excessive. Mastercard: 1.0% threshold. Keep below 0.5% to stay comfortable.
Does Playto Pay provide fraud protection? Yes. Playto Pay implements 3DS 2.0, fraud scoring, velocity checks, and chargeback dispute management for Indian merchants accepting international cards.