How can merchants decide whether a suspicious order is fraud, friendly fraud, or a legitimate multi-card purchase?

Merchants should look at the full customer context before taking action. Multiple cards from one IP can indicate a fraudster, a reshipping scheme, family sharing, or a busy office network. Review billing relationships, shipping consistency, account age, and prior activity. A decision based on one signal alone is too blunt and can damage customer trust.

How to tell fraud from friendly fraud or a legitimate multi-card purchase

A suspicious order should be judged as a pattern, not a single red flag. One customer using several cards can be theft, chargeback abuse, family or office spending, or an otherwise legitimate buying habit. The safest decision comes from reconciling payment behaviour with shipping, account, and historical context before you block, cancel, or escalate.

What to check before deciding

Start with whether the order fits the customer’s broader profile. Billing names, addresses, and issuing regions should line up with prior activity, and the shipping destination should make sense for the account age and purchase history. A long-standing customer buying for a household or small business can look unusual at the transaction level while still being legitimate.

Then compare the payment pattern with the fulfilment pattern. Repeated card use from the same IP, especially with mismatched billing data, can indicate card testing, account takeover, or a reshipping operation. But the same pattern can also come from a shared office connection, a travel-heavy customer, or someone splitting payment across cards. The context has to explain the pattern, not just the pattern itself.

When the case is ambiguous, the key question is whether the order shows coherence across identity, payment, and delivery signals. A coherent customer story usually has stable account behaviour, repeat shipping relationships, and a plausible reason for the payment mix. A fraudulent order often has rushed behaviour, weak account history, inconsistent addresses, or other signs that the customer is trying to minimise friction and maximise approval chances.

When the pattern is suspicious enough to escalate

Escalate when the order combines several weak signals rather than relying on one headline indicator. For example, multiple cards from one IP become more concerning when the account is new, the shipping address is unusual, the billing details do not align, and prior activity is absent. That combination suggests deliberate abuse more than ordinary customer behaviour.

Legitimate multi-card purchases tend to explain themselves through business logic or household behaviour. Fraud and friendly fraud tend to leave gaps, such as inconsistent purchaser identity, repeated attempts after declines, or shipping choices that do not fit the account narrative. The more the order depends on a single high-risk signal, the more careful the review needs to be before action is taken.

Risk and Threat Considerations

Misclassifying these orders creates two different risks: approving real fraud or harming a legitimate customer with an unnecessary decline. The first increases chargeback losses and can expose the merchant to further abuse; the second damages conversion, trust, and customer lifetime value.

Failure mechanism: Teams over-weight one signal, such as multiple cards from one IP, and ignore the rest of the customer context. That produces false positives on shared networks and family or business purchases, while also letting coordinated fraud slip through when the surrounding signals are not checked.

Impact: The merchant either ships to an attacker or blocks a real buyer, and both outcomes create cost. Poor judgement also weakens future reviews because analysts stop trusting the alerting pattern when it is used too broadly.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Supports limiting order-review access and action authority to reduce abuse of suspicious-order workflows.
	AU-6 — Audit Record Review, Analysis, and Reporting	Fits review of suspicious-order evidence and analyst decisions for later fraud investigation.
	IA-5 — Authenticator Management	Applies where suspicious orders are tied to account takeover or credential abuse signals.
Recommendation — Restrict approval, override, and refund actions to the minimum necessary reviewers. Review and retain order-review logs so fraud decisions are traceable and contestable. Protect and rotate customer and admin credentials that affect order approval and account access.
NIST CSF 2.0	ID.RA-01 — Cybersecurity Risk Assessment	Matches the need to assess multiple weak signals together before concluding fraud or legitimacy.
	PR.AA-05 — Managed Access Permissions	Relevant when analysts or systems need controlled authority over order cancellation and review actions.
Recommendation — Assess the full signal set before treating an order as confirmed fraud. Limit who can cancel, hold, or override suspicious orders.

Practitioner Guidance

What to prioritise: Give the highest weight to account age, prior purchase behaviour, shipping consistency, and the relationship between billing and delivery data. Those signals usually separate ordinary multi-card activity from cases that deserve manual review.

Decision rule: If the order is explainable only by one isolated signal, treat it as unconfirmed and review it manually rather than auto-declining it. If several independent signals line up, move from review to escalation faster.

What to verify: Check whether the payment pattern matches a believable customer story, such as a family account, shared office network, or known repeat purchaser. If you cannot explain the pattern with stable history, assume the case needs human review before fulfilment.

Practitioner takeaway: The best decision comes from requiring a coherent story across payment, account, and delivery data, not from treating any single fraud indicator as decisive.