Account Takeover Fraud Prevention at Checkout
A stolen login can cost you more than one order. Here is how to spot a takeover and stop it before the money moves.
A customer logs in, buys your best seller and the card goes through. Later the real owner of the account finds charges they never made. That is account takeover, and it lands on your store.
What account takeover is
Account takeover fraud is when a thief gets into a real customer's account and uses their saved card to buy things. The payment looks normal because the account is real. A fraudulent sale like this can later turn into a chargeback, and you lose the goods too.
Warning signs to watch
The takeover leaves tracks before the purchase. Watch for:
- Many failed logins in a row, then one that works
- A login from a new device or a country the customer has never used
- Login times that make no sense for that person
- Several accounts linked to a single device
Any one sign can have an innocent cause. Several together on one account is your cue to look closer.
Layer 1: watch logins and behavior
The first defense is monitoring. Stripe's guide says machine learning can detect account takeover attempts by watching for multiple failed logins or logins from new devices or locations. It can also watch logins and flag odd activity that may point to an attempt. The same models can spot multiple accounts linked to a single device.
Behavior matters too. Stripe says machine learning can watch how a user types or swipes. That helps check who they are and spot odd behavior.
For more on how these models work, see ai fraud detection. Stripe notes that machine learning can learn from large data. It also adapts as fraud changes.
Layer 2: verify connected accounts on a platform
If you run a platform with connected accounts, you can ask for proof. Stripe's documentation says Stripe Identity is available as an add-on and can help reduce fraud risk. You can ask a connected account to prove who they are. They send a photo of a government ID and a selfie.
When a connected account looks fraudulent
If you run a platform, Stripe's documentation lists actions for a connected account. Stripe's documentation says raising a review flags the account for manual investigation by your risk team. A person, not a rule, looks at the story.
While you investigate, you can hold the money. Stripe says pausing payouts holds the funds while you look into it. You can also stop the connected account from processing. Stripe says pausing payments stops the account from taking new sales.
Confirming fraud and acting
If the review confirms fraud, you can close the account. Stripe's documentation says rejecting the account permanently disables it if you confirm it is fraudulent.
Keep a record of what you did. Stripe says the Risk history section shows past reviews of the account. It also shows what your team did about them.
Build it in layers
No single tool stops every takeover. Stripe recommends using Radar's risk factors together with other risk factors to make holistic decisions. Login alerts catch the attempt. ID checks confirm who runs a connected account. A manual review makes the final call.
Fit the layers to your size. A small store can start with login alerts and a manual look at odd orders. As you grow, add automated account takeover fraud detection. For more ways to protect your store, see ecommerce fraud prevention.