Brazilian e-commerce is one of the fastest growing in the world, but it carries a heavy burden: it is also one of the champions in fraud attempts. For a company that sells online, fraud is not a possibility; it's a certainty. The question is not "if" you will suffer an attempted coup, but "when" and "how" you will defend yourself.
Fraud impacts profits twice: you lose the product (which was sent) and you lose the money (the bank reverses the sale via Chargeback). Additionally, you pay fines for card brands.
This step-by-step guide was designed for companies that need to structure or audit their anti-fraud strategy, balancing security with approval rate.
Step 1: Understand the Enemy (Types of Fraud)
You can't fight what you don't know.
- Effective Fraud (Cloned Card): The fraudster buys leaked card data on the deep web, makes purchases on his website and has it delivered to an "orange" address. The actual card owner disputes the purchase weeks later. It is the most common type.
- Self-fraud (Friendly Fraud): The customer makes the purchase himself, receives the product and then calls the bank saying that he does not recognize the transaction in order to keep the money and the product.
- Account Takeover (ATO): The fraudster steals the login and password of a legitimate customer on your website and makes purchases using the cards saved in the account.
Step 2: Layers of Protection (The Onion Strategy)
No tool alone solves 100%. You need layers.
Layer 1: Basic Validation (Frontend)
- Require CVV (security code) in all transactions.
- Use AVS (Address Verification Service) if available, to check whether the zip code on the invoice matches the bank registration.
- Implement CPF and email validators at checkout to block clearly false data (e.g.
111.111.111-11).
Layer 2: Automatic Anti-Fraud Tool (Required)
Hire a market solution (ClearSale, Konduto, CyberSource, Forter). They use Artificial Intelligence and "Device Fingerprint".
- They know if that computer has already been used in fraud in other stores.
- They analyze behavior: Did the customer type the card number too quickly (copy-paste)? The IP is from Russia but the delivery address is Osasco?
- The tool gives a risk "Score". If it is low, approve it. If it is too high, it automatically denies.
Layer 3: Manual Review (The Human Factor)
For requests in the "gray zone" (medium risk), don't deny it directly (you could be denying a good customer). Submit to an analysis desk.
- A human analyst looks at the data, searches for the customer on social media, or even calls to confirm the purchase. "Hello So-and-so, confirming the purchase of a TV for delivery to X street".
Step 3: Calibrating the Motor (False Positives)
The biggest mistake companies make is being too restrictive. If your anti-fraud denies 20% of sales, you are probably losing more money rejecting good customers (False Positives) than you would lose to fraud.
- Practical Step: Monitor your approval rate. If it drops below 85-90%, your filter is too aggressive. Recalibrate the anti-fraud tool rules.
- Tip: On commemorative dates (Black Friday), purchasing behavior changes (early morning shopping, high prices). Let your anti-fraud agent know so they don't block everything.
Step 4: Chargeback Protection
Even with all this, chargebacks can happen.
- Save Documentation: Invoice, proof of delivery signed by the carrier, IP logs and transaction data.
- Dispute: Some gateways allow you to dispute the chargeback by sending this evidence to the issuing bank, although victory is difficult in actual fraud.
Step 5: Password and Login Management (Against ATO)
To prevent customer accounts from being hacked:
- Implement CAPTCHA at login to prevent brute force attacks (robots testing passwords).
- Notify the customer by email whenever there is a new login or change of address/password.
- If possible, use 2FA (Two-Factor Authentication) to exchange sensitive data or very non-standard purchases.
Conclusion: The Fine Balance
Anti-fraud is not about eliminating fraud (this is impossible without stopping sales). It's about managing risk.
The objective is to keep fraud below 1% of revenue (healthy rate) while maintaining the approval rate above 95%. Implement these layers, monitor numbers weekly, and treat security as part of the customer experience, not a barrier.
A secure company sells more, as it conveys confidence and guarantees its long-term financial sustainability.