The Holiday Fraud Prevention Checklist: Chargebacks, Card Fraud and Scams
Fraudsters love the holidays as much as shoppers do. Order volumes spike, staff are stretched and nobody wants to slow down a sale. This checklist covers the three threats that hit small businesses hardest between November and January: card fraud, chargebacks and scams aimed at the business itself.
Key takeaways
- Most holiday card fraud is card-not-present: online, phone and email orders where the card is not physically checked.
- Chargebacks can arrive months after the season ends, so the evidence you keep in December decides whether you win in March.
- Strong customer authentication tools such as 3-D Secure can shift fraud liability away from you on many online payments.
- Scams aimed at the business, such as fake supplier invoices and bank detail changes, spike when teams are busy and distracted.
- Set your rules before Black Friday on November 27, 2026, so staff are not making judgment calls under pressure.
Holiday fraud is not just a big-retailer problem. Small online stores are often targeted precisely because their checks are lighter, and small teams are easier to rush. The good news is that most fraud follows familiar patterns, and a short list of controls blocks a large share of it.
This checklist focuses on holiday-season threats. For the bigger picture, such as internal controls that stop employee fraud or a full cybersecurity checklist for your systems, see our separate guides on those topics.
How chargebacks work
A chargeback happens when a cardholder disputes a transaction with their card issuer and the issuer reverses the payment. The card networks, such as Visa and Mastercard, each run their own dispute process, but the basic steps look similar:
- Dispute: the cardholder contacts their bank, claiming fraud, non-delivery, a damaged item or a charge they do not recognize.
- Chargeback: the issuer pulls the funds back from your acquirer or processor, which debits your account and usually adds a fee.
- Response: you have a limited window to submit evidence, often called representment, showing the sale was valid.
- Decision: the issuer reviews the evidence. If it is still disputed, the case can move to further stages under the network's rules, sometimes with extra fees.
Time limits depend on the network and the reason for the dispute, and they can be long. For many common dispute reasons, cardholders have around 120 days to raise a dispute, sometimes counted from the expected delivery date rather than the purchase date. That means holiday disputes often arrive in February, March or later.
Card networks also monitor merchants' dispute and fraud levels. Businesses that exceed set thresholds can face fines from their processor, higher fees, reserves on their payouts or, in serious cases, lose the ability to accept cards. Ask your processor what thresholds apply to you.
Common mistake
Ignoring small chargebacks because "it is only one order." Each one counts toward your dispute ratio, and unanswered disputes are lost automatically. A run of small losses in a busy month can push a small business over a monitoring threshold.
The main holiday fraud patterns
Card testing
Fraudsters with lists of stolen card numbers use small online stores to check which cards still work. You see a burst of tiny orders or failed payment attempts, often in the middle of the night. Even failed attempts can generate fees. Turn on rate limits, CAPTCHA or bot protection at checkout and alerts for unusual numbers of declines.
Stolen card orders
These are classic card-not-present fraud: a real card used by someone who is not the cardholder. Warning signs include billing and shipping addresses far apart, rush shipping on high-value items, several cards tried on one order, mismatched names and email addresses that look randomly generated. None of these proves fraud alone, but together they deserve a manual review.
Friendly fraud
Sometimes the cardholder really did buy the item but disputes it anyway, either by mistake (a family member used the card, or the store name on the statement was unclear) or on purpose. Clear descriptors, delivery tracking and fast customer service prevent many of these.
Reshipping and triangulation
Orders go to freight forwarders or addresses that send goods on elsewhere, or a fraudster takes orders on a fake storefront and fills them from your shop with stolen cards. The real cardholder disputes the charge later, and you lose both the item and the money.
Scams aimed at the business
These target you rather than your customers:
- Fake supplier invoices for goods you did not order, timed for busy weeks when bills get paid quickly.
- Bank detail change requests from what looks like a real supplier's email, asking you to send payment to a new account. This is a form of business email compromise.
- Impersonation calls claiming to be from your bank, payment processor, utility or a government agency, demanding urgent payment.
- Gift card payment demands. The US Federal Trade Commission warns that anyone who demands payment in gift cards is a scammer. No real supplier, utility or agency asks for this.
- Fake delivery messages with links that steal login details, which the FTC also flags as a common scam during busy shipping periods.
Use the tools you already pay for
Most payment processors and ecommerce platforms include fraud tools that small businesses never switch on. Check these before the rush:
| Tool | What it does | Holiday setting to consider |
|---|---|---|
| Address verification (AVS) | Checks the billing address against the issuer's records, mainly in the US, Canada and the UK | Review or block orders where the address does not match |
| Card security code (CVV/CVC) | Confirms the buyer has the three or four digit code | Require it on every online order |
| 3-D Secure | Asks the cardholder to authenticate with their bank | Turn it on for higher-value or higher-risk orders, or all orders |
| Risk scoring | Rates each order based on many signals | Send high-risk orders to manual review before shipping |
| Velocity limits | Caps attempts per card, device or IP address | Tighten to stop card testing |
3-D Secure deserves special attention. When a payment is successfully authenticated this way, liability for many fraud-related chargebacks generally shifts from the merchant to the card issuer, though exact rules depend on the network and region. In the European Economic Area and the UK, strong customer authentication is a regulatory requirement for many online card payments, so it is likely already active. In the US and many other markets, it is often optional, and many small stores leave it off for fear of adding friction.
In physical stores, chip and contactless payments matter for the same reason. In the US, the card networks' EMV liability shift in October 2015 means that if a counterfeit card is used and the merchant did not accept the chip, the merchant may bear the loss. Make sure every pop-up and market card reader accepts chip and contactless payments.
Hypothetical example
Imagine an online jewelry shop that receives three orders in one hour, each for $400 or more, all with next-day shipping to the same forwarding address but paid with three different cards. The platform's risk score is "elevated," and two orders failed AVS. The owner holds all three for review and emails the customer for verification. No reply comes. Canceling and refunding costs nothing, while shipping would likely have led to three chargebacks and $1,200 in lost stock several weeks later.
Win the chargebacks you do get
You cannot prevent every dispute, but good records turn many losses into wins. For every holiday order, make sure you can quickly produce:
- The order confirmation with the customer's name, billing and shipping address, items and price.
- Proof of delivery with tracking, and a signature for high-value items.
- The authorization result, including AVS, CVV and 3-D Secure outcomes.
- Customer emails, chats and any agreement on returns or replacements.
- Your refund and return policy as shown at checkout.
- For digital goods or services, logs showing download or use.
Respond to every chargeback before the deadline, keep your reply short and factual and match your evidence to the reason code. If the customer is right, accept the dispute and learn from it.
Pro tip
Check how your business name appears on customer card statements. If it shows a legal company name nobody recognizes, ask your processor to change the statement descriptor to your shop name and add a phone number or website. Unrecognized charges are a common cause of avoidable disputes.
Rules for your team
Fraud often succeeds because a busy person makes a quick exception. Write a one-page holiday fraud policy and share it with everyone who takes orders or pays bills.
- Never change supplier bank details based on an email alone. Call the supplier using a number you already have on file.
- Never pay anyone with gift cards, cryptocurrency or wire transfer because a caller says it is urgent.
- Hold any order that triggers two or more warning signs until someone senior reviews it.
- Do not process manual card entries over the phone for high-value orders without extra checks.
- Do not click links in unexpected delivery, bank or account messages. Go to the site directly instead.
Signs of a healthy setup
- Fraud tools are on and reviewed weekly
- Staff know when to hold an order
- Every chargeback gets a response
- Bank detail changes are verified by phone
Red flags in your business
- No one checks risk scores before shipping
- Disputes are left to expire
- Bills are paid on email instructions alone
- Card readers fall back to swipe at events
Holiday fraud prevention checklist
- Turn on AVS, CVV and velocity limits in your payment settings
- Decide when to use 3-D Secure and switch it on
- Add bot protection or CAPTCHA to checkout to stop card testing
- Set a manual review rule for high-risk orders
- Check and update your card statement descriptor
- Make sure all card readers accept chip and contactless
- Save delivery tracking and signatures for high-value orders
- Write and share a one-page fraud policy for staff
- Verify any bank detail change by phone
- Schedule a weekly check of disputes and respond to each one
Where to report scams
In the US, report scams and fraud to the Federal Trade Commission at ReportFraud.ftc.gov, and contact your bank immediately if money has been sent. In Canada, the Canadian Anti-Fraud Centre takes reports. In Australia, the Australian Competition and Consumer Commission runs Scamwatch. Other countries have their own national reporting services, usually listed on police or consumer protection websites. Reporting helps authorities spot patterns and can support any bank recovery attempt.
Frequently asked questions
Can I refuse a chargeback?
You cannot block it, but you can contest it by submitting evidence through your processor before the deadline. The issuer then decides. If you do not respond, you lose automatically.
Does 3-D Secure hurt conversion?
It can add a step for some customers, though newer versions often approve low-risk payments without any extra screen. Many small stores use it only for higher-value or higher-risk orders to balance safety and convenience.
Should I refund a suspicious order instead of waiting for a chargeback?
If you have not shipped and you believe the order is fraudulent, canceling and refunding is usually cheaper than a chargeback, which adds fees and counts toward your dispute ratio. Check your processor's guidance.
Are the rules the same in every country?
No. Card network rules vary by region, and laws on payment authentication differ. Strong customer authentication is required for many online payments in the EEA and UK but not in the US. This is general information, so ask your processor about the rules that apply to you.
Related reading
The bottom line
Holiday fraud thrives on speed and distraction. Switch on the fraud tools you already have, set clear rules for holding orders and verifying payments, keep the records that win disputes and teach your team the scams to ignore. An hour of setup before Black Friday can save months of chargebacks after the season ends.
