Merchant fraud is fraud that targets a business selling goods or services, usually by abusing payment systems, account access or order flows. It commonly includes stolen cards, chargeback abuse, account takeover, fake refunds and identity misuse within e-commerce or point-of-sale environments.
What merchant fraud is
Merchant fraud is not a single tactic, but a family of abuse patterns that exploit commercial trust, payment rails, and order workflows. It becomes dangerous because losses can arrive through direct theft, disputed payments, fraudulent refunds, and operational friction all at once.
In practice, the term covers attacks that target checkout, settlement, and post-sale processes. That means the business may be defending card-not-present transactions, in-store payment activity, account recovery paths, refund handling, and customer support workflows simultaneously.
How merchant fraud typically works
The common paths are straightforward but effective: stolen payment credentials are used to place orders, compromised customer accounts are used to hide activity, and refund or chargeback processes are abused after the sale. Fraudsters often prefer the weakest link in the flow, not the most obvious one.
Merchant fraud also spans identity misuse. An attacker may reuse a real customer identity, compromise a merchant account, or manipulate a legitimate order into looking normal until the loss is irreversible. The danger is that many controls are designed to approve transactions quickly, so the abuse blends into ordinary business volume.
Why merchant fraud is hard to spot
It often looks like routine commerce until losses accumulate. A single fraudulent order may be indistinguishable from a normal customer purchase, while refund abuse, account takeover, and card testing can appear as low-value noise spread across many events.
Detection is complicated by the fact that merchant fraud crosses teams and systems. Payment processors, fraud teams, customer support, fulfilment, and security may each see only part of the picture, which creates blind spots in attribution and response.
Business impact and control priorities
The business impact is broader than direct stolen funds. Merchant fraud can drive chargeback fees, stock loss, extra support load, reputation damage, and false confidence in sales metrics. For many organisations, the hidden cost is the time spent reconciling fraudulent activity after the fact.
Controls need to reflect the whole flow, not just the payment step. Stronger account protection, refund governance, transaction monitoring, device and behaviour signals, and tighter operational review of high-risk orders all help reduce exposure. Payment and fraud teams should treat business-process abuse as part of the security surface, not as a separate problem.
Risk and Threat Considerations
Merchant fraud creates direct financial exposure, but the larger risk is that fraudsters exploit trusted commerce workflows to scale abuse quietly. Once account access, refund logic, or payment acceptance is weak, the same pattern can be repeated across many transactions before it is noticed.
Failure mechanism: Attackers abuse stolen cards, compromised accounts, weak refund handling, or chargeback processes to obtain goods, money, or service value while making the activity look like legitimate customer behaviour.
Impact: Merchants can suffer financial loss, inventory shrinkage, fee reversals, operational disruption, and degraded trust in sales and customer data.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Merchant fraud depends on reviewing transaction and account signals for abuse. |
| IA-5 — Authenticator Management | Account takeover and identity misuse are central merchant-fraud abuse paths. | |
| Recommendation — Review transaction and account logs for fraud patterns and escalate anomalous events. Manage credentials tightly and rotate compromised authenticators quickly. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Fraud often succeeds through abused account access and weak privilege controls. |
| Recommendation — Limit access paths that enable refunds, account changes, or order abuse. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Merchant platforms often expose auth failures that enable account takeover and abuse. |
| API5 — Broken Function Level Authorization | Refund and order-management abuse often exploits missing authorization checks. | |
| Recommendation — Harden authentication on commerce and account endpoints to block takeover-driven fraud. Enforce function-level authorization on refund, order, and account actions. | ||
Practitioner Guidance
Why practitioners should care: Merchant fraud is a cross-functional control problem, not just a payments issue. Security, fraud operations, and customer service should align on which signals trigger review, hold, denial, refund approval, or account step-up because the abuse path often spans more than one team.
What to watch for: Repeated failed payment attempts, mismatched account and delivery details, unusual refund timing, high dispute rates, and sudden changes in purchase behaviour often reveal fraud before losses become material. The most useful controls are those that reduce false approvals without creating unnecessary friction for legitimate customers.
Related resources from NHI Mgmt Group
- Who is accountable when a fraud guarantee shifts liability away from the merchant?
- Why do merchant-only fraud controls fail against organised abuse?
- Why do siloed fraud tools create blind spots in merchant risk management?
- What happens when a merchant outsources gift card management without integrating fraud signals?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org