What should merchants do when fraud pressure rises but they still need to grow revenue?

Why Merchants Need to Treat Fraud Pressure as a Conversion Problem, Not Just a Rules Problem

When fraud pressure rises, the usual mistake is to respond with broader declines, harder step-up checks, and more manual review. That can reduce losses, but it also shifts friction onto legitimate customers at the exact moment the business needs to protect growth. Merchants need to think in terms of trust, approval quality, and customer experience together, because the fraud control that saves the most chargebacks is not always the control that preserves the most revenue.

That is why the answer is not simply to “tighten fraud settings.” Merchant teams should look at how pricing, incentives, shipping promises, and account protections interact with payment risk. A policy that is too strict can suppress good orders, while one that is too loose can invite abuse, refund pressure, and dispute losses. The right balance depends on where the business is losing value in the purchase flow. Guidance on layered control design is consistent with the control intent described in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where monitoring and response need to support business operations rather than interrupt them.

In practice, many merchants discover they have been solving fraud in isolation only after conversion has already dropped and manual review queues have started slowing down legitimate orders.

How Merchants Balance Fraud Controls with Revenue Growth in Practice

The practical task is to manage fraud as part of the commercial operating model, not as a separate gate at checkout. Merchants usually get better results when they tune several levers at once: how aggressively they score transactions, how much friction they add for uncertain orders, what thresholds trigger review, and which customer segments receive different treatment. That is especially important when promotions, fast shipping, or first-order discounts change the fraud profile of the business.

A useful way to think about this is that fraud controls should be calibrated to the value of the transaction and the confidence in the customer signal. Strong authentication or manual review may be justified for high-risk patterns, but applying the same response to every order creates avoidable drop-off. Merchants also need to separate “high risk” from “high loss.” Some orders are operationally suspicious but commercially worth saving if the downside is controlled. Others are cheap fraud attempts that should be blocked quickly because the processing effort outweighs the revenue at stake.

• Use approval, chargeback, refund, and manual-review data together instead of treating any one metric as the whole story.
• Test fraud rules alongside pricing and promotion changes, because an attractive offer can change attacker behaviour as well as customer behaviour.
• Automate low-confidence but low-impact decisions where repeated human review adds cost without improving accuracy.
• Escalate only the cases where the loss potential, dispute pattern, or account behaviour justifies slower handling.

Good practice also means maintaining feedback loops between fraud operations, ecommerce, payments, and customer support so that the policy reflects actual buying behaviour rather than a static risk score. A control set that works in one product line or country may fail in another because shipping times, payment methods, and customer trust levels differ. Where merchants operate across channels, the same buyer may look low risk on one path and higher risk on another, so the policy has to account for context. This approach aligns with broader control thinking in NIST SP 800-53, but the business logic still has to be tailored to the merchant’s own funnel. It breaks down when teams use a single approval rule for all traffic or when they tune for loss reduction without measuring conversion impact.

Where the Standard Answer Breaks Down: High-Friction Segments, Promotions, and Repeat Buyers

Tighter fraud controls often increase checkout friction, so merchants have to balance loss prevention against conversion and customer experience. That tradeoff becomes sharper during promotions, flash sales, or peak demand periods, when good customers behave faster and fraudsters also test volume-based abuse.

One common edge case is a segment that looks risky in aggregate but is valuable over time. New customers, international buyers, and gift purchases can all produce more false positives if the fraud model is too narrow. Another is repeat-buyer behaviour: a customer with a clean history may still trigger concern if a basket suddenly changes shape, but the decision should reflect the full relationship, not just the latest order. Merchants also need to decide whether they are optimising for immediate approval rate or for net revenue after chargebacks, returns, and support load. Those are not the same outcome.

Industry consensus is limited on a single best fraud threshold because the right setting depends on margin, fulfilment cost, dispute exposure, and brand tolerance for friction. The stronger rule is to tune controls by order value, customer confidence, and business context rather than by one global standard. Merchants that ignore that distinction often end up protecting loss metrics while quietly damaging growth in the parts of the funnel that matter most.

Practitioner Guidance

What to prioritise: Start with the points in the funnel where fraud controls most directly affect revenue, usually checkout, account creation, and post-order review. The first question is not “how do we stop more fraud?” but “where are we losing the most net value through false declines, manual delay, or avoidable disputes?”

What to measure: Track approval rate, false-decline rate, chargeback rate, refund rate, and manual-review burden together. A fraud program is underperforming if it improves one metric while damaging the others enough to reduce net revenue.

Decision rule: If a control protects against a meaningful loss but creates heavy friction for a profitable segment, narrow the rule rather than applying it globally. If the pattern is both high-risk and low-value, block or automate it decisively.

Practitioner takeaway: Merchants should treat fraud policy as a revenue-shaping control, not just a loss-prevention control, because the best operating point is the one that preserves good demand while making abusive demand expensive.

Related resources from NHI Mgmt Group

• Why does fraud pressure rise as Shopify merchants grow faster?
• Why do fraud controls affect revenue as much as they affect loss prevention?
• Why do legally required identity checks still leave mobility platforms exposed to fraud and revenue loss?
• Why do electronics merchants face higher fraud pressure during periods of heavy demand and aggressive promotion?