Card Fraud and Chargebacks for Small Webshops
By CodexierPublished 5 min read
For a small webshop, a single fraudulent order is annoying. A pattern of them can cost margin, time and eventually your card acquiring agreement. Chargebacks exist to protect cardholders, and the process is weighted in their favour, so the shop's job is to prevent the avoidable ones and document the rest. This guide explains how a chargeback moves through the system, how to spot risky orders, what strong customer authentication changes and how to avoid losing good customers to over-cautious checks.
How a chargeback works
- The cardholder contacts their bank and disputes the payment.
- The bank sends the dispute through the card network to your payment provider, which debits the amount from your balance.
- You get a deadline, often a week or two, to respond with evidence through the provider's dashboard.
- The issuing bank decides. If you win, the money comes back; if not, it stays with the cardholder.
- Some cases can be appealed further, but the costs usually exceed the value for small orders.
Signs of a risky order
No single signal proves fraud, but combinations are worth a manual look before shipping. Your payment provider's risk score is a good start; your own knowledge of normal orders adds the rest.
- Shipping address differs from billing address, especially a parcel locker or forwarding service far from the card's country.
- Several orders with different cards to the same address in a short time, or several failed payment attempts before a success.
- Unusually large quantities of easily resold items, such as electronics, gift cards or sizes across the whole range.
- Express shipping on a high-value first order with a free email address and no account history.
- Requests to change the delivery address after payment, or to ship to a different name.
3-D Secure and its trade-offs
Under PSD2, most online card payments in the EEA need strong customer authentication, which in practice means 3-D Secure: the customer confirms in their bank app, often with BankID in Sweden. When a payment is authenticated, liability for a fraud chargeback generally moves to the issuing bank. Exemptions exist, such as low-value payments or transactions the provider judges low-risk, and when an exemption is used, the liability usually stays with you.
| Approach | Fraud protection | Conversion effect |
|---|---|---|
| Always require 3-D Secure | Highest; liability shift on every authenticated payment | Some customers drop out at the extra step |
| Provider decides (risk-based) | Good; challenges only risky payments | Smoothest for most shops |
| Request exemptions aggressively | Lower; you keep liability | Fewest steps, highest risk |
Other methods change the picture. With invoice and part payment from Klarna, Klarna carries the credit risk under its seller protection terms, provided you follow them. Swish payments are pushed by the payer and have no card-style chargeback. Our comparison of Klarna, Stripe and Swish covers the trade-offs.
Evidence that wins a dispute
| Dispute reason | Evidence to send |
|---|---|
| Fraud, not authorised | 3-D Secure result, IP and device data, previous undisputed orders by the same customer |
| Goods not received | Tracking showing delivery to the given address, signature or parcel locker scan |
| Not as described | Product page at time of order, photos, customer messages, your return offer |
| Subscription cancelled | Accepted terms, cancellation rules, log of logins or usage after the claimed cancellation |
| Refund not processed | Refund confirmation or proof that the return never arrived |
Many disputes start as a customer who could not reach you. A visible contact route, fast replies and a return process that follows Swedish distance selling rules prevent chargebacks that were never fraud.
Balancing fraud checks and conversion
Every check also stops some genuine customers. Blocking all orders with differing addresses turns away people buying gifts; forcing extra steps at checkout loses buyers on mobile. Decision rule: let the payment provider's risk-based authentication handle the default case, review manually only orders that combine several risk signals, and tighten further only if your dispute rate approaches the level your provider warns about.
When you do not need outside help: a shop with a few disputes a year needs good routines, not a project. Our checkout optimisation service is for shops where fraud rules and checkout friction have become tangled, for example when a strict rule set is blocking good orders. The checkout friction checklist is a good first step, and you can book a short call to review your settings.
Frequently asked questions
Can I refuse a chargeback?
You cannot stop it from being raised, but you can respond with evidence through your payment provider. Whether you win depends on the reason code and your documentation.
Does 3-D Secure protect me from all chargebacks?
No. It generally protects against fraud claims on authenticated payments. Claims that goods did not arrive or were not as described are still decided on your evidence.
Should I cancel an order I suspect is fraud?
If several risk signals combine and the customer cannot be verified, refunding before shipping is usually cheaper than losing both goods and a chargeback. Contact the customer first when the signals are weak.
What happens if I get too many chargebacks?
Payment providers and card networks monitor dispute rates. Above certain levels you can face extra fees, monitoring programmes, holds on payouts or termination of your account.
Fraud rules blocking good customers?
In a free 15-minute call we look at your payment setup, dispute history and checkout, and tell you which settings to change before spending money on anything else.
Book a free 15-minute call