How should retailers reduce fraud without making checkout too slow?

Why This Matters for Security Teams

Retail checkout sits at the point where friction becomes measurable revenue loss, but it is also where fraud teams finally get enough context to act. The challenge is not blocking every suspicious event. It is deciding when to ask for more proof without turning routine purchases into an abandonment trigger. NIST guidance on control selection in NIST SP 800-53 Rev 5 Security and Privacy Controls supports this risk-based approach: controls should be matched to impact, not applied uniformly.

For retailers, that means step-up checks belong where loss potential is highest: account recovery, payment instrument enrolment, high-value orders, gift card abuse, and suspicious shipping changes. Low-risk browsing and simple sign-in flows should stay fast. The operational mistake is to treat checkout as a single binary gate, then layer on broad CAPTCHA, repeated MFA prompts, or extra form fields that slow legitimate buyers before any fraud signal exists. In practice, many security teams encounter conversion loss only after checkout friction has already been introduced broadly, rather than through intentional risk-tiered design.

How It Works in Practice

Progressive verification works best when fraud controls are driven by real-time context, not static rules. The core idea is to assign more assurance only when behaviour, transaction value, or device signals justify it. That can include step-up authentication, one-time passcodes, delegated approval, or identity proofing at the moment a user tries to add a new card or change fulfillment details. The security decision should be tied to the action, not the session as a whole.

This is consistent with current NIST thinking on layered controls and with retailer fraud operations that separate low-risk discovery from high-risk monetisation events. It also aligns with NHIMG’s broader guidance that risk should be anchored to the point of highest exposure, not forced into every interaction. For example, the DeepSeek breach shows how exposed credentials and backend access can cascade quickly once an attacker gets a foothold. Retail fraud is different in shape, but the lesson is similar: once trust is granted, abuse can move faster than manual review can respond.

• Use lightweight signals first: device reputation, velocity, basket value, and account age.
• Step up only on high-loss actions: payment enrolment, account recovery, address changes, refunds, and order rerouting.
• Prefer friction that fits the risk: silent scoring, then challenge, then manual review only when necessary.
• Measure both fraud loss and abandonment together so the control does not optimise one at the expense of the other.

Retailers should also keep verification tokens and session assertions short-lived so that a passed check does not become blanket trust for the rest of the shopping journey. These controls tend to break down in flash-sale, marketplace, and guest-checkout environments because fraud spikes, identity data is sparse, and legitimate users tolerate less friction.

Common Variations and Edge Cases

Tighter verification often increases abandonment and support workload, requiring organisations to balance fraud reduction against checkout speed and conversion. That tradeoff is especially sharp in retail because even small delays can affect completion rates. Current guidance suggests tailoring the control to the channel and risk profile rather than forcing a uniform step-up pattern across web, app, and in-store pickup flows.

There is no universal standard for exactly which trigger should prompt step-up verification. High-ticket electronics, digital goods, and first-party loyalty abuse usually warrant more aggressive checks than low-value replenishment items. Returning customers with stable devices may deserve a lighter path than new accounts using anonymised networks. The best practice is evolving toward adaptive policies that combine transaction risk, user history, and device integrity into one decision at runtime.

Retailers also need to watch for edge cases where fraud risk looks low until settlement, such as split shipments, marketplace sellers, refund abuse, and buy-online-pick-up-in-store fraud. In those scenarios, the control point may need to move away from checkout and into fulfilment or returns. NHIMG’s analysis of secret leakage and exposure timing in the State of Secrets in AppSec underscores a broader principle: weakly governed trust expands attack windows, while short-lived, context-aware controls narrow them.

Related resources from NHI Mgmt Group

• How should telecom teams reduce SIM registration fraud without blocking legitimate users?
• How should dating platforms reduce fraud without making signup unusable?
• How can IAM teams reduce fraud without making onboarding unusable?
• How should organisations reduce identity fraud without storing too much personal data centrally?