Fraud Red Flags Every Merchant Should Watch For

Most transactions your business processes are completely legitimate — but a small percentage of fraudulent attempts can cause outsized damage, both in direct losses and in the chargebacks and fees that follow. Fraudsters tend to leave patterns, and merchants who know what to look for can catch a meaningful share of attempts before they become a costly chargeback. Here are the signals worth training your team to recognize.

Why catching fraud early matters more than fighting it later

Once a fraudulent transaction ships or completes, your options narrow considerably — you're now dealing with a chargeback, a lost product or service, and the fee that comes with disputing it, win or lose. Catching the signs before fulfilling an order is far more effective than trying to win a dispute after the fact, which is why fraud prevention is fundamentally about pattern recognition at the point of sale, not after.

Red flags in online and card-not-present transactions

Mismatched billing and shipping addresses

A single mismatch isn't necessarily suspicious — people ship gifts to other addresses all the time. But a mismatch combined with other flags below (especially a rush shipping request) is a much stronger signal.

Unusually large orders from a first-time customer

A brand-new customer placing an order well above your typical average ticket size, especially for easily resold items (electronics, gift cards, luxury goods), is a classic fraud pattern.

Rush or expedited shipping on a large order

Fraudsters want the goods before the real cardholder notices the unauthorized charge and disputes it. A first-time, high-value order paired with a request for the fastest possible shipping is worth a second look.

Multiple failed card attempts followed by a successful one

This pattern often indicates card testing — a fraudster trying stolen card numbers in sequence until one goes through. If your checkout allows several failed attempts before a success on the same order, treat the eventual success with caution rather than automatic relief.

Orders placed from an IP address or region inconsistent with the billing address

A customer whose billing address is domestic but whose order originates from an IP address in another country (visible in most e-commerce fraud tools) is a commonly flagged combination, though it's not conclusive on its own — legitimate customers travel and use VPNs too.

Requests to change shipping details after the order is placed

A customer contacting you shortly after checkout to redirect an order to a different address than what was on file is a frequently seen fraud tactic, since it lets the fraudster place the order with valid-looking information and reroute it afterward.

Multiple orders from the same card in a short window

Rapid repeat orders on the same card, especially with slightly varied shipping details each time, can indicate a fraudster testing how much a stolen card can absorb before it's declined or reported.

Red flags in card-present (in-person) transactions

A card that requires manual key entry rather than a chip or tap

Chip and contactless payments carry built-in cryptographic protections that make counterfeit cards far harder to use successfully. A card that consistently fails to read and needs to be manually keyed in carries more risk and less liability protection for the merchant if it turns out to be fraudulent.

A customer who seems unfamiliar with the card they're using

Hesitation entering a PIN, an unclear signature, or a name on the card that doesn't match how the customer refers to themselves can be minor tells worth a polite ID check, especially on larger transactions.

Unusual urgency or pressure to complete a large transaction quickly

Fraud attempts, particularly in person, often come with pressure to move fast — a customer eager to complete a purchase before you can look closely at the card or ask questions.

How to respond to red flags without alienating legitimate customers

The goal isn't to decline every transaction with a warning sign — most flagged transactions are completely legitimate, and overly aggressive fraud screening frustrates real customers and costs sales. Instead:

• Look for combinations of flags rather than acting on any single signal alone.
• Use address verification (AVS) and card verification value (CVV) checks as a baseline filter for online orders.
• For higher-risk orders, consider a manual review or a quick verification call before fulfilling, rather than an automatic decline.
• Set a reasonable velocity limit (e.g., flagging multiple orders from the same card within a short window) rather than blocking repeat customers outright.

What to do if you suspect a transaction is fraudulent

If a transaction looks suspicious before you've fulfilled it, it's almost always better to pause and verify than to process it and deal with a chargeback later. Contact the customer through the information on file (not information provided with the suspicious order itself) to confirm the purchase, or hold the order for manual review. If you do process an order that later turns out to be fraudulent, document everything — order details, communication, and any verification steps you took — since this evidence matters if a chargeback follows.

How Harbour helps merchants catch fraud earlier

Every Harbour account includes real-time fraud monitoring that automatically screens transactions for patterns like the ones above — unusual velocity, mismatched location data, and card testing behavior — flagging higher-risk transactions for review before they're finalized. This gives merchants a meaningful head start on catching fraud before it becomes a dispute, without needing to build detection rules from scratch.

Frequently asked questions

Does address verification (AVS) stop all fraud?

No single tool catches everything — AVS is one layer among several (alongside CVV checks, velocity monitoring, and manual review) that together reduce fraud risk meaningfully, without eliminating it entirely.

Should I decline every order with a mismatched shipping address?

No — mismatched addresses are extremely common for legitimate reasons like gift orders. Treat it as one data point, not a reason to decline on its own.

How quickly should I respond to a suspicious order?

As soon as possible, ideally before shipping or fulfilling the order — verifying before fulfillment is far more effective than trying to reverse a fraudulent transaction afterward.