September 14, 2026
Here is the whole topic in one view before we go deeper. Each row maps a core idea to why it changes what you do next.
Merchant fraud prevention is the set of controls a payment company uses to stop fraud tied to the merchants in its portfolio before that fraud turns into a chargeback (a payment the cardholder's bank reverses), a fine, or a lost processing license. It runs on two fronts at once, protecting honest merchants from criminals and catching merchants who are the criminals.
It helps to picture how a card payment moves. When a shopper pays, money flows from the shopper's bank (the issuer), through a card scheme like Visa or Mastercard, to the merchant's provider (the acquirer or payment facilitator), which then pays the merchant in a step called settlement.
If that payment later turns out to be fraudulent and gets reversed, the cost lands on the acquirer's side, not the shopper. That is why these firms, not the merchants themselves, carry the risk and do the work of merchant fraud prevention.
So the work rarely sits with the shop at the checkout. It belongs to the businesses that stand behind the merchant and carry that financial risk, meaning acquiring banks, payment facilitators, independent sales organizations (ISOs), marketplaces, and processors.
When a merchant vanishes with settled funds or breaches a card scheme threshold, these firms pay the price. Many of them start by comparing AI Transaction Monitoring Software to handle this at scale.
Three terms get used as if they mean the same thing, and a newcomer deserves to know the difference:
A working program does all three, because detection you can't act on still leaves you paying the bill.
Merchant fraud is easier to defend once you see that it arrives from two directions, and most guides only describe one of them. If you carry merchant liability, you have to cover both.
The first direction is what most vendors mean by merchant fraud. The second is where acquirers and payment facilitators lose the most money, because the loss is already settled by the time it surfaces in a report. A guide that only covers one side leaves half your exposure unmanaged.
Each scheme below leaves a different signature, and the dangerous ones are built to look ordinary while they run. For every type, here is what it is, how it plays out in a real portfolio, the red flags that give it away, and the control that stops it.
Card-not-present fraud is any fraud where the card is not physically swiped or tapped, which covers almost every online payment. Card testing is the setup phase, where fraudsters check whether stolen card numbers still work by running tiny charges before they spend big.
How it plays out: a fraudster buys a batch of stolen card numbers and pushes hundreds of small charges through one of your merchants' checkouts. The declines don't matter to them, since they only need the approvals, which reveal the live cards. Within hours, they escalate to high-value orders across several of your merchants, and the chargebacks land days later on your books.
Red flags: a burst of small transactions with a high decline rate followed by sudden approvals, many different card numbers from one device or IP, and a spike in orders for easily resold or digital goods.
Prevention: score every transaction at the point of authorization, the instant a payment is approved or declined, so the testing pattern is caught before the escalation. Velocity checks that count attempts per card, device, and IP, paired with AI that reads the full context, stop the attack while it is still cheap to stop.
Chargeback fraud, often called friendly or first-party fraud, happens when a real cardholder disputes a purchase they actually made. Some do it to keep the goods and get their money back, others simply forget a charge. Either way, the acquirer and merchant absorb the dispute fee and often the loss.
How it plays out: a customer buys a product, receives it, then tells their bank they never authorized the charge. The bank reverses the payment, the merchant loses the item and the revenue, and you absorb a dispute fee that can run from tens to over a hundred dollars. Across many buyers, the merchant's dispute ratio climbs toward card scheme limits, which drags penalties onto you.
Red flags: dispute rates rising above a merchant's peer group, repeat disputes from similar buyer profiles, and refund or delivery patterns that don't match the stated business.
Prevention: track dispute and refund ratios at the merchant level over time, not per transaction, and flag merchants drifting toward scheme thresholds early. Clear delivery evidence and pre-dispute alerts help you recover or deflect disputes before they harden into chargebacks.
Bust-out fraud is the classic merchant-initiated scheme. A fraudster sets up a business that looks real, processes honestly for a while to earn trust and higher limits, then runs a sudden flood of fraudulent charges and disappears before anyone can claw the money back.
How it plays out: a new merchant onboards through your digital flow as a modest online store. For six weeks, it processes believable volume, builds a clean history, and earns a higher processing limit. Then, over a single weekend, when your investigation team is thin, it runs a large batch of high-value transactions on stolen cards, requests settlement, and shuts down. The chargebacks arrive two to three weeks later, and because the merchant is gone, the loss is yours.
Red flags: a clean history that suddenly surges in volume, average ticket, or refunds; settlement requests out of proportion to the stated business; and behavior that diverges sharply from similar merchants in the same category.
Prevention: watch each merchant as an entity from the first transaction, compare it against its peer group, and hold settlement automatically when a high-confidence alert fires. Timing decides everything here, since around 3% of newly onboarded digital merchants turn out to be fraudsters, and the anomaly is usually visible weeks before the chargebacks.
Transaction laundering happens when a merchant processes payments for a business you never approved, usually to hide high-risk or illegal activity behind a legitimate-looking account. The account on file might say online tutoring, while the real charges are for something the card schemes prohibit.
How it plays out: a merchant is approved as a low-risk digital services seller, and its recorded transactions match that story, so nothing looks wrong at the volume level. In reality, it is funneling payments for an undisclosed third party. When a scheme audit uncovers it, you face fines for processing prohibited transactions and a possible regulatory investigation.
Red flags: transaction patterns that don't fit the stated category, unexplained shifts in volume or geography, and refund or dispute behavior inconsistent with the business on file.
Prevention: monitor behavioral consistency over time rather than raw volume, since the numbers are designed to look normal. Laundering sits where merchant fraud meets money laundering, so it often runs alongside an anti-money laundering platform, and the funds it generates frequently move through a money mule detection solution before they clear.
Account takeover on the merchant side happens when a fraudster seizes control of a legitimate merchant's dashboard or settlement details. Because the activity comes from a trusted, verified account, checks that only confirm the account is real tend to miss it.
How it plays out: an attacker phishes a merchant's login or resets it through a compromised email, then quietly changes the payout bank details. The next settlement runs to the fraudster's account instead of the merchant's, and the theft only surfaces when the real merchant asks where their money went.
Red flags: changes to payout or contact details shortly before a withdrawal, logins from unfamiliar devices or geographies, and account behavior that breaks the merchant's established pattern.
Prevention: baseline each merchant account's normal behavior and alert on high-risk changes, especially edits to bank or contact details paired with an unusual login. Catching the change before the payout runs is what keeps the funds in the right hands.
Knowing the fraud types is one thing; knowing where to stop each one is another. Merchant risk is not a single checkpoint; it is a lifecycle, and strong programs place controls at every stage instead of betting everything on the moment a merchant signs up.
Risk starts before the first transaction. Underwriting is where you verify who the merchant is, what they sell, and who owns the business, using know-your-business checks, document review, and risk scoring by category. Tight onboarding screens out obvious bad actors, but it can't catch the ones who plan to behave first and cheat later, which is exactly why onboarding alone is never enough.
Most merchant-initiated fraud shows up after approval, not during it. Bust-out and laundering schemes are built to pass underwriting, then turn once they have earned trust. Continuous monitoring watches each merchant's behavior against its own history and its peers for as long as it processes with you, which is the only way to catch a merchant that was honest on day one and fraudulent on day forty. Since around 3% of newly onboarded digital merchants turn out to be fraudsters, this stage carries most of the load.
The decisive moment is settlement, because once funds reach a departing fraudster, they are rarely recovered. Holding or delaying settlement on a flagged merchant, or withholding a single suspicious payout, turns a detected risk into money you keep. This is why prevention and response have to reach the settlement layer, not just the authorization layer.
When a merchant is confirmed as fraudulent, clean offboarding limits the damage. You freeze processing, withhold outstanding settlement, document the case, and record the identifiers so the same operator can't re-onboard under a fresh name. Good offboarding also feeds your models, so the next attempt is easier to catch.
The cost of getting merchant fraud wrong reaches far past the stolen funds. It compounds across fines, lost customers, and, in the worst case, your right to process at all.
Card fraud losses worldwide reached $33.41 billion in 2024, according to the Nilson Report, even after a small dip. For the businesses that carry the liability, the true cost runs higher still, with US merchants losing an average of $4.61 for every $1 of fraud once fines, fees, and recovery work are counted, per the LexisNexis True Cost of Fraud study.
In plain terms, if too many of your merchants generate fraud and chargebacks, you pay, so keeping them below those thresholds is a direct financial goal.
The exposure keeps growing while defenses lag. In 2025, 76% of US organizations faced attempted or actual payment fraud, yet only 17% use AI to fight it, per the AFP. And the quieter cost is false declines. Blunt rules that block anything risky also block real customers, and a rejected buyer rarely comes back, which often drains more revenue than the fraud itself.
The goal is not to block more; it is to block precisely. You want fraud stopped and good customers waved through, and risk-based decisioning is how you get both at once.
Done well, this keeps you under the card scheme fraud thresholds that trigger mandatory authentication, without taxing the customers who drive your volume.
Knowing the threats is only half the job; this section covers how to act on them. Modern fraud detection blends several methods, and the strongest programs run them together rather than picking one.
The risk-based balance from the previous section runs on one engine in particular. You connect your payment flow to a model that scores each transaction at authorization and returns a decision in milliseconds. In practice, this shows up as a score, where a tool such as Fraudio's Payment Fraud Detection assigns each transaction a value between 0 and 1 and maps it to a clear action, so low scores are approved, mid scores get review or step-up authentication, and high scores are blocked. Supervised learning catches known fraud patterns while unsupervised learning flags anomalies that no rule has seen yet.
Event scoring tells you whether one transaction looks off; entity monitoring tells you whether the merchant behind it has been drifting for weeks. Profiling each merchant against its own history and its peer group is what exposes bust-out and laundering that clean transactions hide. Good entity tools also rank alerts by severity, flagging the clearest cases for an automatic block, the serious ones for a settlement hold while you investigate, and the borderline ones for closer watch, so your team spends time where it counts.
A model that only learns from your data starts every new fraud trend from scratch. There is also a legal limit that many teams hit, since a firm that processes only one side of a payment, such as issuing, generally can't combine that data with the acquiring side to see the full picture. Pooling transactions across many payment firms into one shared dataset gets around both problems, letting the AI recognize a scheme it has already seen elsewhere and catch it in your portfolio weeks earlier. Fraudio reports this networked approach performs up to 30 times better than models trained on a single company's data.
Static rules decay, and a rule that worked six months ago now over-blocks or misses new variants. Keep reviewing your fraud-to-sales ratio, let self-learning models retrain on confirmed outcomes, and make sure your team can deploy a new rule in minutes without waiting on an engineering release.
Run together, these methods form the backbone of a strong program. You score every event in real time, profile every merchant over time, train the models on shared data, and keep tuning as the threats shift. No single method catches everything, so layering them rather than picking one is the real best practice.
Detecting a bad merchant or transaction is the start, not the finish. How fast you act decides whether a flag becomes money saved or a loss you document after the fact. Work these five steps in order.
Not every tool that claims to stop merchant fraud does the same job, and the wrong choice leaves gaps that a fraudster will find. If you are evaluating options, these are the questions worth asking, because the answers separate a real merchant fraud prevention tool from a basic rule engine.
Many tools only score individual payments, which misses merchant-initiated fraud entirely. You want a tool that profiles each merchant as an entity over time and compares it against peers, so bust-out and laundering surface before settlement. Ask whether it runs both an event view and an entity view, since you genuinely need both.
A model trained only on your history is blind to any scheme it has not personally seen and slow to learn the rest. Ask whether the AI draws on transactions across many payment firms, because networked data spots emerging fraud patterns far earlier than a siloed model. This is also how a tool can protect you from your very first transaction, instead of after a long training period.
Older systems can take months to over a year to integrate, which is months of exposure you can't afford during a fraud spike. Ask for realistic timelines, and favor tools that integrate in days to weeks and start scoring straight away. Speed to value matters as much as raw detection depth.
Some vendors charge setup fees, per-rule fees, and long minimums that price out smaller acquirers and penalize growth. Ask how pricing behaves as your volume rises, and favor usage-based models with no charge per rule, so you can build the controls you need without watching a meter. A lower total cost of ownership keeps the tool within reach as you scale.
If you operate in regions with data-residency rules, a tool that can't host locally is a non-starter. Ask where it can be deployed and how quickly, since some tools stand up compliant deployments in restricted territories within days while others simply can't. This is easy to overlook until a regulator makes it urgent.
The best way to judge a fraud tool is on your own data, not a sales deck. Ask whether you can run a test on your historical transactions, in parallel with your current setup and with no commitment, to see what it would have caught. A vendor confident in its results will offer this.
Fraudio gives payment firms merchant fraud protection that works on both fronts, catching fraud run through your merchants and merchants running fraud themselves, without a year-long rollout.
Its Merchant Initiated Fraud Detection product profiles every merchant as an entity, using anomaly detection and machine learning trained on billions of transactions across 188 countries to flag bust-out and laundering behavior an average of three weeks before chargebacks arrive. It ranks alerts by severity, automatically blocking the clearest cases, withholding settlement on serious ones while you investigate, and monitoring the borderline ones, so funds stay put, and your team works the cases that matter.
Alongside it, Payment Fraud Detection scores each transaction between 0 and 1 in real time and triggers step-up authentication only when the risk warrants it, which keeps approval rates high for the legitimate customers who drive your volume.
The engine behind both is patent-pending network-effect AI that learns across many payment firms at once, not just your own history, so you spot new merchant fraud patterns earlier than a siloed model can. Integration takes days rather than months, pricing is pay-per-use with no setup or per-rule fees, and you can run a proof of results on your own historical data before committing.
Customers like Viva Wallet have seen 8x ROI, a 600% increase in fraud team efficiency, and fraud caught three weeks earlier than with their previous setup.
If you take one table away from this guide, make it this one.
Merchant fraud doesn't wait for your next reporting cycle. Bust-out operators and launderers settle their losses before the chargebacks land, false declines quietly bleed off good revenue, and card scheme fines climb while static rules fall behind.
Fraudio is built for the acquirers, payment facilitators, and processors that carry merchant liability and can't afford a year-long rollout. Its patent-pending network-effect AI catches merchant fraud earlier than siloed tools, its entity-level monitoring flags bad merchants weeks before chargebacks, and its pay-per-use pricing means no setup fees and value in days.
You can even see what it would catch on your own historical data before you commit. Book a consultation with our team and put networked AI to work on your portfolio.
Merchant fraud prevention is the set of controls payment firms use to stop fraud tied to the merchants in their portfolio, covering both fraud run through merchants and fraud committed by merchants. It combines real-time transaction scoring, entity-level merchant monitoring, and instant rule changes so acquirers and payment facilitators can block bad activity before settlement. A strong program also protects approval rates, since false declines often cost more than the fraud itself. Around 3% of newly onboarded digital merchants turn out to be fraudsters, which is why continuous monitoring matters.
Merchant fraud detection finds suspicious activity as it moves through your payment flows, while merchant fraud protection covers the wider job of stopping it and limiting your liability. Detection scores transactions and flags merchants; protection adds blocking, settlement holds, rule management, and reporting. Payment firms need both because spotting fraud without acting on it fast still leaves you holding the loss.
Merchant fraud is the broad category of fraud tied to merchants, while chargeback fraud is one type within it where a real cardholder disputes a purchase they actually made. Chargeback fraud, also called friendly or first-party fraud, costs acquirers dispute fees that can run from tens to over a hundred dollars each and pushes merchants toward card scheme penalties. Merchant fraud also covers stolen-card abuse and merchant-initiated schemes like bust-out, which chargeback fraud does not. So every chargeback fraud is a form of merchant fraud, but not the reverse.
You prevent bust-out merchant fraud by monitoring each merchant as an entity over time, not just by scoring individual transactions. Bust-out schemes build a clean history, then process a burst of stolen-card volume and disappear before chargebacks arrive, so peer-group comparison and behavioral baselines catch the anomaly early. Entity-level monitoring can flag this pattern an average of three weeks before chargebacks land, and high-confidence alerts can trigger automatic settlement holds. That gap is the difference between a blocked payout and a six-figure loss.
Payment firms reduce false declines by using risk-based authentication that applies friction only to medium-risk transactions instead of blocking broadly. Real-time AI scoring sorts payments into approve, review, and block, so low-risk customers pass without interruption and only borderline cases see extra verification. This keeps approval rates high while still stopping fraud, which matters because rejected good customers rarely return. Balancing both sides is the core of modern merchant fraud prevention.
The most common types of merchant fraud include card testing and card-not-present fraud, chargeback or friendly fraud, bust-out merchant fraud, transaction laundering, and account takeover of merchant accounts. Each targets a different layer, from the authorization point through merchant settlement. Card fraud alone reached $33.41 billion worldwide in 2024. Payment firms that map each type to a specific control catch more of them before funds move.
Merchant fraud costs the card industry billions each year, with global card fraud losses reaching $33.41 billion in 2024 even after a small dip. For the businesses that carry the liability, it runs higher still, with US merchants losing an average of $4.61 for every $1 of fraud once fines, fees, and recovery work are counted. In 2025, 76% of US organizations faced attempted or actual payment fraud, yet only 17% use AI to fight it. The gap between exposure and modern tooling is where most preventable losses sit.
Transaction laundering happens when a merchant processes payments for undisclosed third parties, often for high-risk or illegal goods, through a legitimate-looking account. The recorded transactions match the stated business, but the real goods or services differ, which exposes the acquirer to scheme fines and regulatory action. Detecting it means watching for mismatches between a merchant's stated model and its actual behavior over time. It sits at the overlap of merchant fraud and money laundering, so it usually needs both fraud and AML controls.
The pillars of merchant fraud management are underwriting merchants at onboarding, monitoring them continuously afterward, controlling settlement and payouts, and responding fast when fraud is confirmed. Each pillar covers a stage where risk appears, since a merchant can pass onboarding and turn fraudulent weeks later. Real-time transaction scoring and entity-level monitoring support the middle pillars, while settlement holds and clean offboarding limit the loss. Together, they cover a merchant's full lifecycle rather than a single checkpoint.
Merchant fraud prevention is worth it for smaller acquirers, and modern tools no longer require the long, costly rollouts that priced them out before. Usage-based pricing and integration in days rather than months mean a smaller firm can protect its portfolio without a large IT project. Because around 3% of newly onboarded digital merchants are fraudsters, even a modest portfolio carries real exposure. Fraudio customers such as Viva Wallet have seen 8x ROI, which shows the math works below enterprise scale.
How about trying our solution and experiencing the next generation for yourself?
