Chargebacks above programme threshold after entering two new markets
An online electronics-accessory retailer processes about 42,000 orders a month, 61% by card, average order value $86. Six weeks ago it launched localized checkout pages for Brazil and Nigeria. Chargebacks are now 1.42% of orders against a card-network programme threshold of 0.90%, and fraud losses were $61,000 last month. Meanwhile the manual review queue has grown to 3,100 orders a day and 6.2% of apparently legitimate orders are being declined. 3-D Secure is enforced only for EU cardholders, the fraud rules were last tuned 14 months ago, and they include blanket blocks on all orders from five countries and on any order above $250. Fulfilment ships within 24 hours, so most fraudulent orders leave the warehouse before review completes.
1. Where is the loss actually coming from, and what should be fixed first?
Read the worked answer
Split the metric before acting. A blended 1.42% says nothing about where to intervene. Re-cut the last 60 days by market, payment method (card vs wallet vs BNPL), order value band, new vs returning account, and BIN country. If Brazil and Nigeria are ~8% of volume but carry most chargebacks, the base business may already sit under 0.90% and the fix is market-specific rather than a global tightening.
Compare both cost pools
- Fraud loss: $61,000/month.
- False declines: 42,000 × 61% = 25,620 card orders; 6.2% = ~1,588 declined; × $86 = ~$136,600 revenue; at ~35% contribution ≈ $47,800 of margin lost per month, before counting churn on declined loyal customers.
Priority order
- Contain the two new markets with targeted controls instead of blanket country blocks - the existing blocks already pushed attackers elsewhere and cost good customers.
- Close the 24-hour ship window for high-risk orders so review happens before dispatch, not after.
- Re-tune the 14-month-old rules once the segment picture is clear.
A rule set that halves fraud while doubling declines is not an improvement: the two pools are the same order of magnitude, so both belong in the objective.
2. What control set would you put in place for the new markets, and what would you remove?
Read the worked answer
Layered controls, ordered by cost to the good customer
- Risk-based 3-D Secure. Trigger on new-market orders above a value threshold, first-time buyers, BIN/billing geography mismatch, and device/IP-country mismatch - not on an entire country. Successful authentication shifts chargeback liability, which attacks the 1.42% directly; the cost is challenge abandonment, so keep it off low-risk traffic.
- Fulfilment hold by risk score. Hold above a score threshold for 12–24 hours and auto-release on clean signals (AVS + CVV match, prior good order, recognised device). Cheaper than declining, faster than manual review.
- Tiered manual review. Auto-approve the clean tail and auto-decline only the extreme tail; review the middle band. A 3,100-order daily queue is what reviewing the wrong band looks like.
- Velocity and identity signals. Limits per email, device and BIN; block disposable domains; require email/phone verification in new markets.
- Replace the $250 order cap with order-count and cumulative-value limits per account per day plus step-up verification above the cap.
Remove: the blanket country blocks (visible to fraud rings, expensive in good customers) and the flat value cap that declines high-value legitimate buyers.
3. How would you measure whether the new controls are working, and where would you set the thresholds?
Read the worked answer
Define the objective first: minimise fraud losses + chargeback fees + lost contribution from false declines + review cost. Set thresholds where the marginal dollar of fraud prevented equals the marginal dollar of good revenue declined.
Track weekly, by segment
- Chargeback rate per acquirer and per market - network programmes are assessed per acquirer, so a blended rate can hide a breach
- Fraud loss per 1,000 orders
- Approval rate, and false-decline rate measured via re-attempt outcomes, declined-order follow-up, or a small randomly-approved sample of declined orders
- Manual review: queue age, approval rate inside the queue, cost per reviewed order
- 3DS: challenge rate, abandonment at challenge, share of liability-shifted volume
Proving a change worked: move one control at a time, compare 30-day windows against a held-back slice of traffic left on the old rule, and report the net across all four cost pools. Target chargebacks comfortably under 0.90% (aim ≤0.65% for headroom) without letting false declines exceed roughly 2–3% of good orders.