In-store fraud protection is a visibility problem, not a checkout problem

At a glance

What this is: Riskified says in-store fraud protection can mask risk until it is removed, at which point chargeback losses and operational strain surface quickly.

Why it matters: For identity and fraud practitioners, the lesson is that low visible fraud does not mean low underlying risk, especially where card-present controls and merchant workflows create a false sense of safety.

By the numbers:

• Brand B saw $800K+ in chargeback losses over six months after fraud protection was paused.
• Brand A reportedly achieved a 1600% ROI once fraud protection was reinstated.
• Brand B reportedly achieved a 600% ROI once fraud protection was reinstated.

Context

In-store fraud is often treated as a checkout issue, but the real problem is visibility. When fraud controls stop suspicious transactions before they complete, the absence of losses can be mistaken for the absence of risk, especially in leased register and luxury retail models where brands inherit store operations but still own the fraud exposure.

That matters for identity and fraud programmes because detection controls can suppress evidence without eliminating attacker behaviour. If teams only measure visible fraud, they can underweight the true cost of chargebacks, dispute handling, and customer impact when protection is removed. The article uses two brand examples to show that this is a structural governance problem, not a one-off checkout anomaly.

Key questions

Q: What breaks when in-store fraud review is turned off?

A: When in-store fraud review is turned off, the control stops absorbing suspicious transactions before they become losses. Merchants often see chargebacks, dispute workload, and operational friction rise quickly because the underlying fraud was never removed, only suppressed. The dangerous part is that visible fraud can look low right up until the review layer disappears.

Q: When should merchants prioritise fraud prevention over fraud detection in the checkout flow?

A: Prioritise prevention when you already understand the risk pattern and can stop it before damage occurs, such as repeated payment attempts, unsupported geographies, or account creation abuse. Prioritise detection when the fraud pattern is less certain and needs more context, such as unusual behaviour, linked identities, or coordinated activity that only becomes obvious after multiple signals are combined.

Q: What are the signs that in-store fraud controls are failing?

A: Common signs include rising chargeback costs, more dispute tickets, heavier workload for internal teams, and a gap between low visible fraud and poor financial results. A control can also be failing if opt-outs or review removals are followed by a fast increase in losses. Those patterns show the fraud was hidden, not absent.

Q: Who should own in-store fraud accountability in leased register models?

A: Ownership should sit with the party that can make the policy decision and bear the financial outcome, usually through a shared model between retailer and partner brand. If one side funds the control while the other absorbs the losses, opt-outs become more likely. Clear accountability is essential when register operations and brand economics are split.

Technical breakdown

Why suppressed fraud looks invisible

Fraud protection works by scoring or blocking risky transactions before they complete, which means the most useful evidence is often the evidence you never see. In-store environments intensify this problem because card-present controls, EMV, and processor protections create a perception that the risk is already handled. That can distort governance decisions: if reviews are paused, the underlying fraud pattern does not disappear, it simply becomes observable as chargebacks and support load. The mechanism is therefore one of hidden risk accumulation, not sudden risk creation.

Practical implication: Treat low observed fraud as a control outcome, not proof of low exposure.

Why leased register models complicate fraud accountability

A leased register model splits operational control from commercial accountability. The retailer runs the physical environment, but each brand may own its own fraud economics, staffing, and transaction risk. That separation can lead to ambiguous ownership for fraud reviews, especially when protection is funded centrally in one period and pushed to brands in the next. Once the control becomes optional, selection pressure works against it because the immediate cost is visible while the avoided loss is not. The result is uneven control adoption across the same store footprint.

Practical implication: Define who owns in-store fraud decisions and who pays for the resulting risk before changing the operating model.

How chargeback guarantees change the control boundary

A chargeback guarantee shifts part of the financial exposure from the merchant to the fraud provider, but it does not eliminate the need for governance. The guarantee is only meaningful if the merchant still understands what the model is blocking, what the residual risk is, and how dispute handling is triggered. In practice, the guarantee converts fraud decisioning into a financially accountable control, which is why pausing it produces such a sharp before-and-after comparison. The control boundary moves from prevention only to prevention plus loss absorption.

Practical implication: Measure fraud controls as both risk-reduction and loss-absorption mechanisms, not just approval-rate tools.

Threat narrative

Attacker objective: The objective is to turn permissive in-store payment flows into recurring fraudulent purchases that survive long enough to create chargebacks and cost.

1. Entry occurs when fraudsters test in-store payment workflows for weak transaction decisioning and low-friction approval paths.
2. Escalation follows when suspicious purchases are allowed through without fraud review, turning isolated attempts into repeatable chargeback activity.
3. Impact appears as rapid chargeback growth, dispute workload, and financial loss once the fraud control is paused.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

In-store fraud is a control visibility problem before it is a loss problem. When effective fraud review works, practitioners lose sight of the attacks it stops, and that can make the environment look safer than it is. This is a governance failure in measurement, not a failure of merchant intuition. Teams should therefore judge fraud programmes by suppressed loss and residual exposure, not by visible incident volume alone.

Chargeback guarantees turn fraud governance into an economic decision, not just a detection decision. Once a guarantee is withdrawn, the cost of skipping review becomes immediate and personally legible to the business. That is why these programmes often survive when the risk is made concrete with brand-level projections. Practitioners should treat financial accountability as part of control design, not as a downstream benefit.

Leased register retail creates distributed accountability that can weaken fraud control adoption. The merchant controls the experience, but partner brands may carry the economics, which encourages opt-outs when fraud is not immediately visible. That split mirrors a wider identity governance problem: when ownership and exposure are separated, controls become optional. Practitioners should align operational ownership, financial liability, and fraud policy before the first transaction is processed.

Hidden fraud is a standing-risk problem, not a checkout anomaly. The article's strongest lesson is that suppressed abuse does not equal resolved abuse, and the first visible signal may be a backlog of chargebacks and dispute work. That makes the control question one of governance durability. Practitioners should design for sustained prevention even when dashboards look clean.

In-store fraud protection belongs in the same governance conversation as identity verification and payment trust. The brand experience, the transaction decision, and the loss guarantee are all parts of one trust chain. If any part is made optional without clear ownership, fraud pressure shifts to the weakest path. Practitioners should manage in-store fraud as an identity and trust control, not a point-of-sale add-on.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

In-store fraud needs to be measured as suppressed loss, not just recorded loss. The operational danger is that teams can remove a control only to discover the true scale of exposure later, when chargebacks and dispute work spike. For practitioners, the right question is not whether fraud looks low today, but whether the control is still carrying measurable risk that would reappear if it were withdrawn.

Leased register retail makes fraud governance a shared-accountability problem. When brands control their own fraud decisions inside a retailer's footprint, the control model must define who funds prevention and who absorbs the cost of failure. That alignment matters as much as the fraud model itself, because optional controls tend to be the first ones removed when pressure to reduce costs rises.

For practitioners

• Baseline suppressed fraud, not just visible fraud Compare chargeback trends, declined transactions, and dispute volume against periods when fraud reviews were active so you can estimate the loss that the control is preventing.
• Assign clear ownership for leased register risk Document which party owns fraud policy, review funding, dispute handling, and financial liability across the retailer and partner brands before changing the control model.
• Test control removal before opting out Use brand-level projections, historical approval data, and prior fraud patterns to model the cost of pausing reviews before anyone makes the decision permanent.
• Keep chargeback guarantees tied to governance metrics Track approval rate, fraud loss, chargeback cost, and support workload together so finance teams do not judge the programme on a single happy-path metric.

Key takeaways

• The article shows that in-store fraud can remain hidden while controls are active, then surface quickly as chargebacks once review is paused.
• Two luxury brands in the example incurred $1.3M+ and $800K+ in six-month chargeback losses after pausing protection, then returned to near zero after reinstating it.
• The practical lesson is to govern fraud review as a standing control with assigned ownership, not as an optional checkout enhancement.

Key terms

• Chargeback: Chargeback is the allocation of technology costs back to the business unit, product, or service that incurred them. For AI workloads, it becomes a governance control when pricing and attribution are reliable enough that cost responsibility can influence design, usage, and prioritisation.
• Leased-Register Model: A leased-register model is a retail operating structure where partner brands run their own staffed checkout points inside a larger host location. It creates shared security and accountability boundaries because the host retailer, the brand, and the payment stack may each own different parts of the fraud response.
• Suppressed Fraud: Suppressed fraud is fraud that is actively blocked or filtered before it becomes visible in reports, disputes, or chargebacks. It can make a programme look quiet even when threat activity remains high, which is why control removal often reveals the true scale of the underlying risk.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.