TL;DR: types of credit card fraud
- Eight distinct patterns, eight different detection signals. Treating fraud as one problem is why merchants under-invest in the signals that catch what they actually see.
- Friendly fraud is the single biggest bucket in card-not-present e-commerce at 60-80% of chargebacks, and it looks nothing like criminal fraud at the transaction moment.
- Device intelligence catches four of the eight with one signal: card testing, account takeover, refund abuse, and friendly-fraud CE 3.0 evidence.
The 8 types
1. Friendly fraud
The legitimate cardholder disputes a charge they actually made. Not a criminal. Not a stolen card. Just a cardholder wanting the money back.
Signal: the cardholder's own device made the transaction. Prior undisputed orders from the same device to the same address. Requires Visa CE 3.0 evidence to fight.
Details: see our full friendly fraud guide.
2. Card testing (BIN attack)
A criminal uses stolen or generated card numbers to attempt small transactions to verify which cards work. Typically 1 to 5 USD, hundreds of attempts per hour, targeted at merchants with low fraud filters.
Signal: a burst of low value transactions from a small number of devices or IPs attempting many different cards. Rate limiting per IP misses this because attackers rotate IPs. Device fingerprint or behavioral pattern catches it.
3. Account takeover fraud
A criminal gains access to the customer's account on your platform and uses the saved payment method to make unauthorized purchases.
Signal: the transaction succeeds from a device the account has never used before, from an unusual geographic origin, or with a new shipping address. See account takeover fraud prevention for the full detection stack.
4. Card not present (CNP) fraud with stolen card
A criminal has the card number, expiration, CVV, and billing address (from a breach or dark market purchase) and uses them at your merchant without additional authentication.
Signal: the transaction succeeds from a device inconsistent with the cardholder's usual pattern, or from a device with a history of prior fraud on other merchants. Cross merchant device intelligence catches it.
5. Skimming fraud (from a Magecart or checkout skimmer)
The card number is stolen from a compromised checkout page via a Magecart style skimmer, then used at a different merchant or on the dark market.
Signal: on the victim side, the compromised checkout is only detectable through in session monitoring of what scripts are reading form fields. See Magecart attacks explained and online card skimming.
6. Refund fraud
The customer buys the product, requests a refund with a false pretext (item not received, item defective), and either keeps the item or resells it while pocketing the refund.
Signal: device continuity from a customer who has requested refunds on multiple prior orders. Refund fraud is rarely a one off. Fraud rings execute it across dozens of accounts.
7. Triangulation fraud
A criminal sets up a fake e commerce storefront selling stolen goods at a discount. Customers buy from the fake store using their real cards. The criminal uses stolen cards to buy the same items from legitimate retailers and ship them to the customers. The customers are happy. The stolen card owners file chargebacks. The legitimate merchants absorb the loss.
Signal: the shipping address on your transaction is a private residence but the cardholder's billing address is elsewhere; the buyer refuses phone contact; the purchase pattern is high value items with limited fingerprinting metadata.
8. Refund abuse (subscription cancellation gaming)
The customer signs up for a subscription trial, uses the service, and cancels within the refund window, sometimes cycling through multiple email addresses to abuse the free trial repeatedly.
Signal: device fingerprint continuity across accounts. The same device signing up for the same trial with three different email addresses over six weeks is not three customers.
The device intelligence overlap
Four of the eight types (friendly fraud, card testing, account takeover, refund abuse) are caught by the same underlying signal: is this device the same one that has legitimately interacted with this account or this merchant before.
That is why device intelligence is the highest ROI fraud investment for most merchants. One signal, four fraud types. Compare against:
- Card BIN blocklists: catches type 4 (stolen card) partially. Nothing else.
- IP reputation: catches type 2 (card testing) partially, until the attacker uses residential proxies.
- CVV validation: catches type 4 (stolen card) until the CVV is included in the breach data (increasingly common).
- 3D Secure: shifts liability for type 4 to the issuer but frustrates legitimate customers and does nothing for types 1, 3, or 8.
The right fraud stack for a modern e commerce merchant is: device intelligence at every transaction, behavioral analysis at high risk moments (login, checkout, refund request), CE 3.0 evidence collection for the friendly fraud fight, and traditional card checks (BIN, CVV, 3DS) as the fallback for type 4.
Related reading
- Friendly fraud in 2026: why the customer wins the chargeback
- Account takeover fraud prevention: the complete 2026 guide
- Chargeback fraud prevention: how device evidence wins disputes in 2026
- Magecart attacks explained: how web skimming works
- Browser fingerprinting for fraud prevention: how it works and why it matters
