What happens when merchants do not verify identity before high-risk online transactions?

When identity is not verified before a high-risk online transaction, merchants face more first-party misuse, account takeover, and card-not-present fraud. That can lead to chargebacks, dispute costs, shipping losses, and customer support burden. The merchant may also damage customer trust if legitimate buyers encounter weak controls or if fraudulent activity is not caught early enough to prevent loss.

Why This Matters for Security Teams

When merchants skip identity verification before a high-risk online transaction, they are not just accepting more fraud loss. They are making it easier for stolen accounts, synthetic identities, and first-party misuse to move through checkout with little friction. That creates a direct path to chargebacks, fulfillment loss, and account recovery work, while also weakening trust for legitimate buyers who expect proportionate controls.

NHI Management Group’s research on Ultimate Guide to NHIs shows why identity assurance matters in security programs more broadly: 80% of identity breaches involved compromised non-human identities such as service accounts and API keys. While that statistic is about NHIs rather than customer checkout, the lesson carries over. Weak identity assurance at any trust boundary becomes an easy place for abuse to scale.

Practitioners also need to avoid treating “more verification” as the goal by itself. The real issue is matching identity assurance to transaction risk, because verification that is too light fails under attack and verification that is too heavy can push legitimate customers away. In practice, many merchants discover that weakness only after fraud losses and disputes have already accumulated.

How It Works in Practice

For high-risk transactions, identity verification should be layered into the decision flow before authorisation, fulfilment, or account changes. The exact threshold varies by merchant risk tolerance, but current guidance suggests using stronger checks when the transaction is unusual, high-value, high-velocity, or tied to a change in shipping, payment, or account credentials. NIST’s Cybersecurity Framework 2.0 and SP 800-207 Zero Trust Architecture both reinforce the same operational idea: trust should be earned at the point of access, not assumed because a session already exists.

In practice, merchants often combine several controls rather than relying on a single “identity verified” flag:

• Step-up authentication for risky checkout events, such as one-time passcodes or multi-factor checks.
• Device and session signals to identify account takeover patterns or impossible travel.
• Address, payment, and behavioural consistency checks to catch first-party misuse.
• Manual review for edge cases where automated signals are ambiguous.
• Velocity limits and transaction holds when the risk score crosses a defined threshold.

Identity verification should also be tied to downstream actions. If the merchant is authorising digital goods, high-value physical shipment, or account recovery, the control threshold should be higher than for routine purchases. That is where policy-as-code and real-time risk evaluation matter: the decision should change when the context changes, not after the transaction is completed. The most useful operational model is to make the merchant prove enough confidence in the buyer before the risky action is allowed. These controls tend to break down when merchants run a single checkout policy across all geographies, payment methods, and product categories because the risk signals are too different to treat uniformly.

Common Variations and Edge Cases

Tighter identity checks often increase checkout friction, so organisations have to balance fraud reduction against abandonment and support cost. There is no universal standard for this yet, especially across consumer retail, digital services, and marketplace platforms. Best practice is evolving toward risk-based verification rather than a blanket requirement for every transaction.

Some merchants should verify identity even when the order amount is modest. That includes cases involving gift cards, resaleable electronics, account recovery, shipping-address changes, or repeated failed login and checkout attempts. Other cases justify lighter controls, especially for low-value repeat purchases from a long-standing customer with stable device and payment history. The right answer depends on where the merchant is most exposed.

Two NHIMG resources are useful for framing that tradeoff: 52 NHI Breaches Analysis shows how quickly weak trust assumptions are exploited in the real world, and Top 10 NHI Issues helps security teams think in terms of identity governance gaps rather than isolated fraud events. The parallel is straightforward: once identity assurance is too weak at the decision point, the rest of the control stack has to absorb the loss.

Merchants also need to watch for legitimate customer friction that looks like fraud. Step-up verification can fail for travellers, shared devices, or customers with poor mobile access. That is why exception handling, fallback review, and clear communication matter as much as the initial control design. In practice, the hardest failures are the ones where fraud controls work technically but still lose revenue because they are too blunt for the actual customer mix.

Related resources from NHI Mgmt Group

• How should organisations evaluate identity assurance before allowing high-risk transactions or access?
• Why do stolen credentials create such high risk in cloud identity attacks against SaaS and IdPs?
• How should security teams build recovery for identity tenant configuration before an incident happens?
• How should financial institutions reduce deepfake risk across onboarding and high-value transactions?