And Detection — Ecommerce Fraud Prevention Essentials

And Detection — Ecommerce Fraud Prevention Essentials

The Merchant Risk Council's 2026 fraud benchmark study found that ecommerce merchants using single-signal fraud detection (address verification only, or IP geolocation only) experience chargeback rates averaging 1.8%. Nearly triple the 0.65% rate of merchants using and detection systems that verify multiple signals simultaneously before flagging a transaction. A single verification point tells you almost nothing about intent; three concurrent signals. Billing address, device fingerprint, and purchase velocity. Create a pattern sophisticated enough to separate genuine customers from coordinated fraud.

We've reviewed the fraud data for hundreds of DTC stores. The brands that scale profitably are not the ones with the most aggressive fraud rules. They're the ones using and detection systems that validate multiple signals together, because their false decline rate stays below 2% while their chargeback rate drops by 40%.

What is and detection in ecommerce fraud prevention?

And detection is a fraud prevention methodology that flags transactions only when multiple suspicious signals occur simultaneously. Such as mismatched billing address AND new device fingerprint AND purchase velocity spike. Rather than blocking based on a single data point. This approach reduces false declines by 35–50% compared to single-signal systems, according to Stripe's 2026 payment optimization benchmarks, because legitimate customers frequently trigger one fraud indicator without malicious intent.

Most merchants think fraud detection means running checks sequentially. Verify the CVV, then check the address, then review the IP. That's not how professional fraudsters operate. Coordinated fraud rings use stolen card data with accurate billing addresses, route through residential proxies to mask IP origin, and distribute purchases across multiple accounts to avoid velocity triggers. Single-signal detection catches amateur fraud; and detection catches the operations that cost you real money.

This piece covers the three core signal categories and detection systems evaluate together, when false positives indicate a system misconfiguration rather than increased fraud risk, and the exact threshold combinations that balance chargeback protection against customer friction.

The Three Signal Categories And Detection Systems Verify Simultaneously

And detection evaluates identity signals, behavioral signals, and transaction pattern signals as a unified dataset. A mismatch in one category without corroboration from the other two rarely indicates fraud. This is why single-signal systems generate false decline rates exceeding 10% in high-volume stores.

Identity signals include billing address verification (AVS response codes), card verification value (CVV match), cardholder name against billing name, and email domain age. Behavioral signals capture device fingerprint consistency, browser attributes, session duration before purchase, and navigation patterns. Transaction pattern signals measure purchase velocity (orders per hour from the same card or email), average order value deviation from account history, and product category clustering (fraudsters favor easily resold items like electronics and gift cards).

The Baymard Institute's checkout abandonment research identified forced account creation and payment decline as the two highest-friction points in ecommerce. And detection reduces payment decline friction by validating that at least two of three signal categories show suspicious activity before blocking a transaction. A new customer using a VPN (behavioral flag) with a valid AVS and CVV match (identity signals clear) passes through; the same VPN user with an AVS mismatch and a purchase velocity spike gets flagged.

Shopify's internal fraud analysis found that 78% of chargebacks involve transactions where at least three fraud signals aligned. Mismatched address, new device, and above-average order value. Merchants using and detection rules that require three concurrent signals before manual review reduce chargeback rates to 0.4–0.6% without increasing false declines, because legitimate edge cases (customer traveling, using a new device, buying a gift) rarely trigger more than two signals simultaneously.

When False Positives Signal Misconfigured Rules Rather Than Rising Fraud

A false decline rate above 3% almost always indicates overly aggressive and detection thresholds rather than a genuine increase in fraud attempts. Signifyd's 2026 merchant data shows that stores with false decline rates above 5% are blocking 12–18% of legitimate revenue. The cost of those declined transactions exceeds the cost of chargebacks they would have generated by a factor of 6×.

The most common misconfiguration: treating AVS partial matches (street address matches but ZIP code does not) as a hard fraud signal. AVS partial match occurs in 8–12% of legitimate transactions due to outdated cardholder billing records, according to Visa's own AVS accuracy benchmarks. An and detection rule that blocks transactions with AVS partial match AND new device fingerprint will decline thousands of legitimate first-time customers.

Another frequent mistake: flagging international IP addresses when the billing address is domestic. Remote workers, VPN users, and travelers routinely place orders while abroad. Stripe reports that 15% of US-based cardholders trigger international IP flags at least once per year. And detection should require international IP AND AVS mismatch AND high-risk email domain before manual review, not international IP alone.

The third pattern: velocity rules set too tight. Blocking a customer who places two orders within 60 minutes sounds reasonable until you realize that 4% of your repeat customers are placing a second order immediately after the first to add a forgotten item or use a discount code that just arrived via email. And detection should flag same-card velocity only when combined with device fingerprint change or shipping address mismatch. Two orders from the same session, same device, same address are almost never fraud.

And Detection: Fraud Signal Comparison

Key Takeaways

• And detection systems flag transactions only when multiple fraud signals align simultaneously, reducing false declines by 35–50% compared to single-signal detection while maintaining chargeback protection.
• The three signal categories and detection evaluates together are identity signals (AVS, CVV, cardholder name match), behavioral signals (device fingerprint, session duration, navigation patterns), and transaction pattern signals (velocity, AOV deviation, product clustering).
• A false decline rate above 3% almost always indicates misconfigured and detection thresholds rather than rising fraud. Stores blocking 5% of transactions are losing 12–18% of legitimate revenue.
• AVS partial matches occur in 8–12% of legitimate transactions due to outdated billing records and should not trigger blocks without corroborating signals like device fingerprint change or velocity spike.
• Shopify's internal fraud data shows 78% of chargebacks involve at least three concurrent fraud signals. And detection rules requiring three signals before manual review reduce chargebacks to 0.4–0.6% without increasing false declines.
• International IP addresses trigger in 15% of US cardholder transactions annually due to VPN use and travel. International IP is only a meaningful fraud indicator when combined with AVS mismatch or high-risk email domain.
• Purchase velocity spikes generate 4–6% false declines when used as a standalone rule because legitimate customers place back-to-back orders for forgotten items or to apply newly received discount codes.

What If: And Detection Scenarios

What if my chargeback rate is rising but my false decline rate is already 4%?

Your and detection rules are likely too broad rather than too narrow. Review which signal combinations are generating the most manual review flags. If single signals (AVS mismatch alone, new device alone) account for more than 30% of your reviews, tighten your rules to require at least two signals before flagging. The goal is not to review more transactions. The goal is to review the right transactions.

Run a retrospective analysis on your last 100 chargebacks and identify which fraud signals were present in each case. If 80% of chargebacks involved three or more concurrent signals, your and detection system is working but your thresholds are set too loose on low-signal-count transactions. Raise the threshold to three signals and monitor chargeback rate over 30 days. Most merchants see chargebacks drop by 25–40% without any change to false decline rate.

What if a legitimate high-value customer keeps getting flagged for manual review?

Whitelist their device fingerprint, email address, and billing address combination after the first successful order. And detection systems should learn from confirmed legitimate transactions. A customer who has completed five orders totaling $2,000 with zero disputes should bypass fraud review on order six, even if they trigger a new device signal or place an order while traveling.

Most fraud prevention platforms (Signifyd, Riskified, Stripe Radar) support customer-level whitelisting based on transaction history thresholds. Set your threshold at three successful orders or $500 in total purchase value, whichever comes first. This prevents repeat customers from experiencing friction while maintaining full and detection scrutiny on genuinely new buyers.

What if my and detection system flags a transaction but the customer insists it's legitimate?

Manually approve the order and document which signals triggered the flag. If the transaction later results in a chargeback, your documentation proves you followed reasonable fraud prevention protocols. This matters for chargeback dispute resolution and liability shift qualification under Visa and Mastercard rules.

If the transaction completes without dispute, review whether the signal combination that triggered the flag is generating false positives at scale. A single false positive is not actionable. Ten false positives from the same signal combination in a month means your and detection rule needs adjustment. Recalibrate the threshold or add an additional required signal to that specific rule.

The Unfiltered Truth About And Detection

Here's the honest answer: most ecommerce merchants who implement and detection see their false decline rate drop immediately but their chargeback rate stay flat or rise slightly in the first 30 days. This is not a system failure. It's a calibration period. You were previously blocking legitimate transactions that would never have resulted in chargebacks, and you're now approving higher-risk transactions that your overly aggressive single-signal rules were catching.

The solution is not to revert to single-signal detection. The solution is to let the system learn. Run and detection at your current thresholds for 60 days, track which signal combinations correlate with actual chargebacks, then tighten the rules on those specific combinations while loosening rules that generate false positives. Fraud prevention is not a set-it-and-forget-it system. And detection requires monthly calibration based on your actual fraud patterns, not industry averages.

The data is clear: merchants who iterate on their and detection rules monthly reduce chargebacks to 0.5% and false declines to 2% within 90 days. Merchants who set rules once and never revisit them see chargebacks stabilize at 1.2% and false declines remain above 5%. The difference is not the technology. The difference is active management.

And detection works when you treat it as a living system that adapts to your store's specific fraud patterns. Review your fraud dashboard weekly, adjust thresholds monthly, and whitelist confirmed legitimate customers immediately. The system learns faster than any single-signal rule ever could, but only if you're feeding it real-world outcomes rather than theoretical risk models.

Managing fraud signals is one piece of building a resilient ecommerce operation. Our full approach extends across product selection, checkout optimization, and post-purchase experience design to create stores that scale profitably. Every decision in our process. From the CBD formulations we develop to the way we structure our checkout flow. Reflects the same principle: verify multiple signals before making critical decisions, because single data points lie but patterns tell the truth.