Payments, Security, and Fraud Prevention
Money movement and risk
Know the chain: the customer's issuing bank, the card network, the gateway (technical connection), the processor, and the acquirer or merchant account that settles funds. Authorization reserves funds; capture claims them; settlement moves money; a void cancels before capture; a refund reverses after. Authorization-to-capture timing is a favorite trap - capturing late can let the hold expire, capturing early can outrun fulfillment.
Security: PCI DSS applies to any organization that stores, processes, or transmits cardholder data, and to systems that could affect it. Tokenization and hosted payment fields shrink scope but do not eliminate it. Strong Customer Authentication and 3-D Secure can shift chargeback liability in some cases, at the cost of added friction - so they are applied selectively by risk score and region.
Fraud signals: AVS and CVV mismatch, velocity across cards or addresses, IP-to-geography mismatch, mismatched bill-to and ship-to, unusually large or expedited orders, disposable email domains. Tune rules against a labeled sample; false declines are as costly as fraud and often invisible in reporting because those customers simply leave.
Traps: conflating chargebacks with refunds; equating HTTPS with PCI compliance; treating 3-D Secure as free; ignoring alternative payment methods and local currency.
Rule of thumb: judge a fraud program on total cost = fraud losses + chargeback fees + lost margin from false declines, not on fraud loss alone.
Worked example: 1,000 orders averaging $100 at 35% margin. Eight fraud orders cost $800; twelve false declines cost $1,200 of revenue, or $420 of margin. A rule that halves fraud but doubles false declines is a net loss.