Consumers usually judge merchants by the visible outcome, not by the hidden mechanics of an attack. When data or card details are compromised, shoppers see the merchant as the point of failure because that is where the transaction happened and where trust was placed. If merchants cannot show effective prevention and response, confidence drops quickly and repeat purchasing suffers.
Why shoppers assign blame to the merchant first
Consumers usually experience online shopping fraud as a trust failure at the merchant boundary, even when the root cause sits elsewhere in the payment or identity chain. They do not see the hidden steps that led to card theft or account compromise, so the merchant becomes the most visible and actionable point of responsibility. In practice, perception follows the transaction path, not the attacker path.
That matters because fraud judgment is shaped by where the customer handed over data, where the purchase was authenticated, and where the loss became visible. If the merchant cannot clearly explain what protected the transaction, confidence drops faster than the technical facts can be reconstructed.
What drives the blame pattern
Several things make the merchant the default target for blame. First, the merchant controls the checkout experience, so customers assume the merchant also controlled the exposure. Second, shoppers rarely know whether the compromise happened through a site flaw, a third-party script, a leaked token, or a card-presented elsewhere. Third, they care most about whether the purchase felt safe and whether the merchant can make them whole.
- Visible touchpoint: the merchant is the face of the transaction.
- Information asymmetry: the attacker’s path is usually hidden from the buyer.
- Expectation gap: consumers assume the party collecting the data should protect it.
- Recovery test: weak communication or slow remediation makes the merchant look negligent.
That is why blame often persists even when the fraud mechanism was indirect. The customer is judging trust management, not just technical causation.
One reason this distrust escalates quickly is that compromise often leaves behind an obvious consequence, not an obvious explanation. The loss may appear at the card statement, but the underlying exposure can involve a site compromise, insecure integration, or leaked payment data. A useful benchmark is that NHI Mgmt Group’s Ultimate Guide to NHIs reports that 96% of organisations store secrets outside secrets managers in vulnerable locations, which helps explain how hidden exposure can survive long enough to surface as a merchant-facing fraud event.
What merchants have to prove after an incident
Once a fraud incident occurs, the merchant is judged on proof, not reassurance. Customers want to know whether the merchant can show prevention, containment, and response. That includes whether payment flows were protected, whether suspicious activity was detected quickly, and whether exposed credentials, scripts, or integrations were rotated or removed.
- Prevention: show the controls that reduced exposure before the incident.
- Detection: show that abnormal activity was visible and investigated.
- Containment: show how quickly risky access or compromised components were isolated.
- Response: show what was rotated, revoked, patched, or notified.
This is also where credibility is won or lost. If the merchant can explain the failure mode in plain terms and demonstrate corrective action, customers are more likely to see the event as contained. If the merchant is vague, consumers infer that the organisation does not understand its own exposure.
Current security guidance treats access control, auditability, and secure key handling as basic expectations for reducing preventable loss. For practitioners, the point is not just to prevent every incident, but to make the failure mode legible enough that the merchant does not look careless. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because its access control, audit, and configuration management families map directly to the controls customers implicitly expect to be working.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV — Oversight | Merchant trust and fraud blame hinge on accountable oversight of controls and response. |
| PR.AC — Identity Management, Authentication, and Access Control | Fraud incidents often follow access or checkout control failures that customers expect merchants to prevent. | |
| RS.CO — Communications | Customer blame is shaped by how clearly the merchant explains the incident and response. | |
| Recommendation — Show clear oversight of fraud controls, investigation, and customer remediation. Tighten access and authentication controls around checkout and payment paths. Communicate incident scope, impact, and remediation clearly and quickly. | ||
| CIS Controls v8 | 6 — Access Control Management | Checkout and transaction trust depend on limiting and reviewing access paths that can enable fraud. |
| 8 — Audit Log Management | Detection and post-incident proof rely on logs that can reconstruct what happened. | |
| Recommendation — Restrict and review access paths that can expose transaction data. Retain and review logs that reconstruct the fraud path. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Secrets and Credential Exposure | Hidden compromise often starts with leaked secrets that customers cannot see but merchants must control. |
| NHI-06 — Overprivileged Non-Human Identities | Excessive access can broaden the blast radius of a merchant-side compromise. | |
| NHI-09 — Third-Party and Supply Chain Risk | Fraud blame often involves merchant integrations and vendors that customers still perceive as the merchant's responsibility. | |
| Recommendation — Eliminate exposed secrets and rotate any credentials used in the fraud path. Reduce privilege on service accounts and integrations tied to checkout. Review third-party integrations that can affect checkout trust and data exposure. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Customer trust depends on assurance that identities involved in purchase and recovery are properly established. |
| AAL — Authenticator Assurance Level | Strong authentication reduces account takeover paths that often appear to customers as merchant failure. | |
| Recommendation — Raise assurance for account recovery and payment-related identity checks. Use stronger authenticators for customer accounts and recovery flows. | ||
Practitioner Guidance
What to verify: After a fraud event, verify whether the compromise path was merchant-side, third-party, or customer-side, and whether your response can distinguish those cases without ambiguity. If you cannot show that separation clearly, customers will default to blaming the merchant regardless of root cause.
What practitioners underestimate: Communications quality is part of the control environment. A technically sound response can still fail reputationally if the merchant cannot explain what happened, what was protected, and what changed after the incident. In fraud handling, clarity is not optional, it is evidence.
Practitioner takeaway: The merchant is blamed when the customer sees a trust break and the organisation cannot narrate, prove, and remediate the break faster than the loss spreads.
Related resources from NHI Mgmt Group
- What breaks when merchants rely on fraud tools only after card authorization?
- Why do API incidents often surface only after users are affected?
- Why do rules-based fraud scoring systems often cost merchants good orders?
- Why do false declines often cost merchants more than the fraud they are meant to stop?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
