Merchant Fraud Guide Sections

Account Takeover Fraud Detection

Someone logs in with a stolen password and shops on a saved card. Here is how to catch it before the order ships and the chargeback lands.

A customer logs in from a new device and a new location. Then they buy and ship to a new address. If the order ships, the fraudulent sale can later turn into a chargeback.

What account takeover looks like from the merchant side

Account takeover fraud happens when a fraudster gets into a real customer's account and uses it to buy from you. The payment often looks clean. The account is real, the card on file may be real, and the shipping address can be changed after login. Your payment checks see a returning customer, not a thief.

That is why detection has to happen at the account level, not just at checkout. The signs show up in how someone logs in and behaves, before they ever reach your buy button.

Login signals that point to a takeover attempt

Watch the login itself. Stripe's guide says machine learning can spot account takeover attempts. It watches for many failed logins, or logins from new devices or places. A burst of failed attempts followed by a success is a classic pattern. So is a login from a device the account has never used.

Location changes matter too, but read them with care. A customer on holiday logs in from somewhere new.

Device fingerprints and behavioral signals

A device fingerprint is a profile built from device details. Think model, operating system and IP address. Stripe's guide says machine learning can build a unique fingerprint for each user from these details. When the same fingerprint shows up on many accounts, that is worth a look. Stripe's article notes machine learning can spot many accounts tied to one device.

How a person acts adds more clues. Stripe's guide says machine learning can study typing speed, swipes or app use. It checks these to confirm who the user is and spot odd behavior. A sudden change in how someone types or swipes can be one of those anomalies. The account is the same. The person is not.

Risk scores: turning signals into decisions

Raw signals are hard to act on one by one. Stripe's guide says machine learning models can give risk scores to payments or user accounts. They use things like location and past behavior. A score pulls the separate signals into one number you can act on.

Set your response by score. A low score passes. A middling score can hold the order for a quick manual check. A high score blocks or pauses the account. The exact cutoffs are yours to choose, and you should write them down so every order gets the same treatment.

Real-time detection and why it adapts

Detection only helps if it runs while the order is happening, not the next morning. Stripe's guide says machine learning is a solution for real-time fraud detection because it can identify patterns and anomalies that indicate fraudulent behavior. The check runs in the moment, so a risky order can be stopped before it ships.

Fraud also changes. The tricks that worked last year fade and new ones appear. Stripe's guide says machine learning models can be retrained on new data so they stay up to date and better detect emerging fraud patterns. Retraining is how AI fraud detection tools keep up as fraud patterns change.

The data you send matters as much as the model. Adyen's docs say sending high quality data helps Protect's machine learning models better recognize fraudulent and legitimate transactions.

What to do when a flag fires

A flag is a prompt, not a verdict. Hold the order rather than shipping it. Reach the customer on a channel the fraudster does not control. Use the phone number on file from before the login. Ask them to confirm the order and prove who they are again.

If the account is compromised, force a password reset and check recent orders. Then close the gap that let them in. That is where account takeover fraud prevention comes in. It covers login monitoring, identity checks and what to do with a compromised account.

Detection and prevention work best as a pair. The same signals that flag a takeover can also block the next try. The same approach also fits card not present fraud detection across your whole checkout.

Sources

The rest of Fraud prevention