The Modern Payment Fraud Playbook: Defending Against Attacks That Learn

Risk & Fraud · February 24, 2026 · 11 min read

Fraud teams are asked to solve an optimisation problem that is frequently framed as a moral one. The framing is “stop fraud.” The actual objective is to minimise total cost: fraud losses plus chargeback fees plus false-decline revenue loss plus review labour plus customer friction. A team that drives fraud to zero by declining aggressively has usually destroyed more value than the fraud would have.

Getting this right requires understanding that “fraud” describes at least five distinct attack types with almost nothing in common except the outcome.

Card testing and enumeration

Attackers generate or acquire card numbers and probe them with small transactions to identify valid, active credentials. Your checkout becomes free validation infrastructure for credentials that will be monetised elsewhere.

The tells are structural rather than behavioural: high attempt volume, low approval rates, tiny amounts, high velocity from small IP ranges or distributed proxy pools, and a distinctive pattern of sequential or algorithmically related card numbers.

Defences are mostly infrastructural. Rate limiting per IP, per device, per email, and per card fingerprint. Bot detection and challenge injection on payment endpoints. Blocking zero-value or trivially small authorization attempts where the business does not need them. Monitoring approval rate as a security signal, not merely a revenue metric — a sudden approval rate collapse on a single endpoint is usually an attack, not an issuer problem.

This attack type is worth prioritising because it is comparatively easy to stop and because networks now impose per-attempt fees and monitoring programme penalties that make it expensive to ignore.

Account takeover

An attacker gains control of a legitimate customer’s account and transacts using stored payment credentials, loyalty balances, or saved addresses. Because the account has history and the payment credential is genuine, transaction-level fraud scoring performs poorly.

The critical insight is that account takeover is an authentication problem that manifests as a payment problem. By the time the fraudulent transaction is scored, the compromise has already happened. Defences therefore concentrate before checkout: credential stuffing protection on login, breach-password screening, step-up authentication on sensitive changes rather than only on payments, and monitoring of the change events that precede fraud — new shipping address, new device, email or phone change, password reset, notification settings disabled.

The single highest-value control is treating a cluster of profile changes followed immediately by a high-value transaction as a distinct risk signal, separate from either event alone.

Synthetic identity

An attacker constructs an identity from a combination of real and fabricated elements, nurtures it into legitimacy over months by building a credit or transaction history, then extracts maximum value and disappears. There is no victim to report the fraud, because the person never existed, which is why synthetic identity fraud typically surfaces as unexplained credit loss rather than as reported fraud.

This is primarily a problem for issuers, lenders, and any platform extending credit or holding funds. Defences rely on cross-referencing identity elements for internal consistency, checking whether an identity’s history is plausible for its claimed age and profile, device and behavioural signals during onboarding, and consortium data that can reveal the same fabricated elements appearing across institutions.

Machine learning helps here more than in most fraud categories, because the signal is a subtle pattern across many weak features rather than any single red flag.

First-party and policy abuse

The customer is who they claim to be, made the purchase intentionally, and then disputes it — claiming non-receipt of a delivered item, filing a “did not authorise” chargeback on a legitimate purchase, or systematically abusing return and refund policies.

This category has grown substantially and is genuinely awkward, because the traditional fraud stack is designed to verify identity, and identity is not in question. Nothing about the transaction looks wrong at authorization time.

Defences are evidentiary and behavioural rather than preventive. Maintain delivery confirmation, device fingerprints tied to the session, authentication records, and usage logs proving the purchased service was consumed. Track dispute rates per customer, not just in aggregate, and identify repeat disputers. Use clear descriptors and proactive order communication to remove the honest confusion that generates a meaningful share of these disputes. And accept that some customers should be declined based on their own history regardless of how legitimate the individual transaction appears.

Authorized push payment scams

The customer is deceived into sending money voluntarily to a fraudster — impersonation scams, invoice redirection, romance fraud, fake investment schemes. Every technical control passes because the payment genuinely was authorised by the genuine account holder.

This is the fastest-growing fraud category in markets with instant payment rails, for the obvious reason that irrevocable settlement in seconds removes the recovery window that slower rails accidentally provided.

Regulatory attention has been intense, and in the United Kingdom reimbursement requirements now allocate liability between sending and receiving institutions, which fundamentally changes the economics. Where the sender bore the loss, banks had limited incentive to invest. Where they share liability, prevention becomes a business priority.

Effective controls are unusual in that they target the customer’s decision rather than the transaction. Confirmation of payee checks that flag name mismatches. Contextual warnings tailored to the detected scam type rather than generic notices everyone dismisses. Delays and cooling-off periods on first-time payments to new payees above a threshold. Receiving-side monitoring for mule account patterns, which is where the most tractable intervention actually sits — scam proceeds must land somewhere, and mule accounts have detectable behavioural signatures.

Building the stack

A functional fraud programme has layers that operate at different points in the lifecycle.

At onboarding, identity verification proportionate to risk, device and behavioural signals, and consortium checks.

Pre-transaction, device intelligence, session behaviour, velocity across every identifier you hold, and network-level bot detection.

At transaction, a risk score combining transaction attributes, customer history, and contextual signals, plus rules for known patterns that models handle poorly.

Post-transaction, monitoring for patterns visible only in aggregate, manual review queues sized to actual capacity, and feedback loops that return confirmed fraud outcomes to model training.

At dispute, structured evidence assembly and representment, with tracking of win rates by dispute reason to identify where evidence collection is inadequate.

Two architectural points matter disproportionately. First, rules and models are complements, not competitors. Models catch diffuse patterns and adapt; rules encode known-bad patterns, satisfy regulatory explainability requirements, and let you respond to a novel attack in an hour rather than a retraining cycle. Second, feedback quality determines model quality. Confirmed fraud labels arrive weeks after the transaction via chargebacks, and if the labelling pipeline is broken or slow, the model degrades regardless of its sophistication.

Measure the whole cost

The instrumentation that separates good programmes from expensive ones is straightforward and frequently absent.

Track fraud loss rate in basis points of volume. Track dispute rate and dispute win rate separately by reason code. Track false positive rate — of the transactions you declined for fraud, how many were legitimate, estimable through controlled release testing on a sample of borderline declines.

Track review efficiency: the fraud caught per hour of manual review, which usually reveals that a large share of review capacity is spent on transactions that were never going to be fraudulent.

And track approval rate alongside fraud rate as a single joint metric with one owner. The most common organisational failure in payments is a fraud team measured only on losses and a growth team measured only on conversion, each optimising against the other. Whoever owns the joint metric owns the actual business outcome.

Where this is heading

Attackers now use the same tooling defenders do. Generative models produce convincing scam scripts at scale, synthesise identity documents, and clone voices for social engineering, which has meaningfully degraded the reliability of document verification and voice authentication as standalone controls.

The defensive response is a shift in emphasis from verifying artefacts toward verifying behaviour and provenance: passkeys and cryptographic credentials that cannot be phished, device binding, behavioural biometrics, and signals derived from the customer’s actual interaction pattern rather than from something they present.

Simultaneously, consortium and network-level intelligence is becoming more valuable, because an attack pattern is usually visible across many institutions before it is statistically significant at any one of them.

None of this changes the underlying discipline. Fraud prevention is cost optimisation under uncertainty. The teams that do it well know precisely what their false declines cost, and they treat that number with the same seriousness as their fraud losses.