Online merchants pay for fraud twice: once in chargebacks and lost goods, and again in good orders declined by over-cautious screening, yet fraud tools are usually bought on a demo and a promised approval rate. The rules around those tools have also tightened. Visa's consolidated Visa Acquirer Monitoring Program (VAMP) counts both reported fraud and disputes against card-not-present sales, with the merchant "excessive" threshold in the US, EU, Canada and Asia Pacific falling to 1.5% from 1 April 2026, and card networks now offer specific evidence routes against friendly fraud. This vendor-neutral buyer's guide is written for ecommerce, payments and risk leads at merchants and marketplaces. It covers order scoring, chargeback guarantee models, 3-D Secure, friendly fraud and dispute automation. Banks and large enterprises buying a full fraud platform should read the Fraud Prevention Platform Buyer's Guide.
Key takeaways
- Know your VAMP ratio before you buy. Visa divides fraud reports (TC40) plus disputes (TC15) by settled card-not-present transactions; a tool that cuts fraud but leaves friendly fraud disputes untouched may not move the number that matters.
- Price the whole outcome. Compare tools on chargebacks, false declines, manual review cost and fees together, not on fraud caught alone.
- Treat a chargeback guarantee as insurance with conditions. Read which dispute reason codes it covers, what happens to declined orders and who owns the data.
- Use 3-D Secure selectively. Authentication can shift fraud liability to the issuer, and in Europe strong customer authentication rules decide when it is required, but challenges cost conversions.
- Collect evidence at checkout, not after the dispute. Visa Compelling Evidence 3.0 and Mastercard First-Party Trust depend on device, IP, account and delivery data captured at the time of the order.
Define requirements
- Baseline numbers: monthly card-not-present volume, fraud chargebacks, non-fraud disputes, VAMP ratio as your acquirer reports it, manual review rate and an estimate of false declines.
- Fraud mix: stolen card use, card testing, account takeover, refund and returns abuse, reseller and promotion abuse, and first-party (friendly) fraud. See the First-Party Fraud Guide and the Card Testing and Carding Attacks Defence Guide.
- Markets and regulation: whether you sell into the EEA or UK, where strong customer authentication applies, and which exemptions your acquirer supports.
- Platform and payments stack: your ecommerce platform, payment service providers and acquirers, and whether the tool must work across more than one of them.
- Decision speed: real-time approve or decline at checkout, or post-authorisation review before fulfilment.
- Operating model: whether you have analysts to tune rules and review orders, or need a managed or guaranteed service.
- Data handling: what personal and device data the tool collects, where it is processed, and how it fits your privacy notices and PCI DSS scope. See the PCI DSS for E-commerce Payment Page Scripts Guide for scripts on payment pages.
Capability areas
| Capability | What it does | What to check |
|---|---|---|
| Order scoring | Scores each order using device, IP, identity, address, behaviour and network signals; approve, decline or review | Explainable reasons, configurable thresholds, cross-merchant signals, latency |
| Chargeback guarantee | Provider decides on orders and reimburses approved orders that later become fraud chargebacks, usually for a fee per approved order or a share of sales | Covered reason codes, exclusions, caps, approval rate commitments, exit terms |
| 3-D Secure orchestration | Decides when to request EMV 3-D Secure authentication or an exemption, based on risk | Support for EMV 3DS 2.2 or higher, app and browser flows, exemption handling, challenge rate reporting |
| Account and promotion protection | Detects account takeover, fake accounts and promotion or loyalty abuse | Login and sign-up coverage, bot detection, link analysis. See the Account Takeover Protection Buyer's Guide |
| Refund and returns abuse | Flags customers and patterns behind serial refund claims | Integration with order management and customer service. See the Refund and Returns Fraud Guide |
| Pre-dispute and dispute automation | Uses network pre-dispute services to resolve claims before they become chargebacks, and assembles evidence for representment | Network programme support, Compelling Evidence 3.0 matching, win-rate reporting, fees per case |
| Card testing defence | Detects rapid small authorisation attempts and blocks enumeration | Velocity controls, bot detection, alerts tied to Visa's enumeration metrics |
Rules that shape the buying decision
- Visa VAMP: Visa's 2025 fact sheet defines the ratio as fraud (TC40) plus disputes (TC15) over settled transactions (TC05) for card-not-present sales. Merchants are "excessive" at 220 basis points and 1,500 monthly fraud and disputes in Asia Pacific, Canada, the EU and the US, falling to 150 basis points from 1 April 2026; thresholds differ in Latin America and CEMEA. Disputes resolved through pre-dispute solutions and fraud qualified for Compelling Evidence 3.0 are excluded. Acquirers must also keep merchants below enumeration thresholds of 20% of authorisations or 300,000 enumerated transactions.
- Visa Compelling Evidence 3.0: effective 15 April 2023 for reason code 10.4 card-absent fraud disputes. The merchant shows at least two prior undisputed transactions on the same card, settled 120 to 365 days before the dispute, sharing at least two data elements with the disputed order (user ID, IP address, delivery address, device ID), one of which must be the IP address or device ID, as described in processor documentation.
- Mastercard First-Party Trust: announced for expansion on 25 June 2025, it lets merchants share purchase history, device, delivery, identity and location data at authorisation or during a dispute, with chargeback protection where the data-sharing requirements are met.
- EU strong customer authentication: Delegated Regulation (EU) 2018/389 allows a transaction risk analysis exemption for remote card payments up to EUR 100, 250 or 500 where the payment provider's fraud rate stays within 0.13%, 0.06% or 0.01% respectively, and a low-value exemption up to EUR 30 (with cumulative limits of EUR 100 or five transactions since the last authentication).
Evaluation criteria
| Criterion | What good looks like |
|---|---|
| Fraud reduction | Fraud chargeback rate measured on your traffic in a holdout test, not a vendor average |
| Approval rate and false declines | Approval rate shown alongside fraud rate; method for estimating good orders declined |
| Effect on VAMP ratio | Reports both TC40 fraud and dispute counts; supports pre-dispute and Compelling Evidence 3.0 so qualifying cases are excluded |
| Friendly fraud handling | Captures evidence at checkout; distinguishes first-party from third-party fraud; supports network data-sharing programmes |
| 3-D Secure and exemptions | Risk-based authentication, exemption requests, challenge and abandonment reporting by issuer and market |
| Transparency and control | Reason codes per decision, rule editing, audit trail of changes, data export |
| Commercial model | Clear fees per order, per review or per dispute; guarantee terms in writing; no lock-in on your historical data |
| Integration and operations | Platform and payment provider connectors, latency under your checkout budget, case management, uptime commitments |
| Privacy and security | Data minimisation, processing locations, retention, SSO and role-based access for the console, scripts that do not widen PCI DSS scope |
Questions to ask vendors
- Will you run a holdout test on our traffic, and how will you measure false declines as well as fraud?
- Which dispute reason codes does your guarantee cover, which does it exclude, and what are the caps?
- If you decline an order under a guarantee, can we override it, and who carries the risk if we do?
- How do you reduce our VAMP ratio, not just fraud chargebacks, and do you support pre-dispute resolution?
- Do you capture the data elements needed for Compelling Evidence 3.0 and Mastercard First-Party Trust at checkout, and submit them automatically?
- How do you decide between requesting 3-D Secure, an exemption or neither, and what challenge rates do you see by market?
- What does your script or SDK collect on our checkout and payment pages, and how does it affect our PCI DSS obligations?
- Who owns the decision and dispute data if we leave, and in what format do we get it?
Red flags
- Fraud reduction quoted without approval rate or false decline data.
- Guarantees that quietly exclude friendly fraud, item-not-received or high-risk categories that make up most of your disputes.
- Black-box decisions with no reason codes and no way to adjust rules.
- Blanket 3-D Secure on every order with no challenge or abandonment reporting.
- Dispute services paid per case regardless of outcome, with no win-rate reporting.
- Contract terms that keep your historical order data or block a parallel test.
Proof of concept
- Pull 90 days of baseline data: orders, declines, chargebacks by reason code, disputes, VAMP ratio and review time.
- Run each shortlisted tool in shadow mode on live traffic, scoring without acting, then compare its decisions with known outcomes as chargebacks mature.
- Move to a split test with a holdout group, measuring fraud chargebacks, approval rate, manual review volume and checkout conversion.
- Test 3-D Secure decisioning by market and issuer, recording challenge and abandonment rates.
- Submit real disputes through the evidence workflow and track outcomes, including Compelling Evidence 3.0 eligibility.
- Calculate total cost per 1,000 orders, including fees, losses, declines and staff time, before signing.
How NHI Mgmt Group can help
We provide independent requirements and evaluation support for fraud prevention, account protection and customer identity programmes. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Fraud Prevention Platform Buyer's Guide · Payment Fraud Guide · First-Party Fraud Guide · Cybersecurity for Retail and Ecommerce Guide