iGaming — or online gambling for games and events — has been steadily increasing in popularity. Despite its appeal, iGaming is not without fraud risk. In fact, its growth has contributed to the rise in account takeover fraud and bot attacks on the wider online gaming industry.

Here’s what you need to know about iGaming fraud prevention.

As a merchant in this vastly growing industry, you face a multitude of threats each day. While fraudsters perpetuate the majority of these attacks, even customers you might know can take advantage of your generosity and commit fraud.

Account takeover attacks

During account takeover attacks — sometimes referred to as account takeovers — fraudsters hack into player accounts with stolen credentials. Sometimes, they may deploy bots to crack valid username and password combinations.

Once fraudsters get into accounts, they may change account credentials, steal payment information, drain any stored account value, or make unauthorized purchases with the account information.

Bonus Abuse

Bonus abuse happens when a fraudster or player exploits promotions for personal gain. For example, a fraudster might create multiple fake accounts to take advantage of a sign-up bonus.

Chargeback fraud

Chargebacks happen when cardholders dispute purchases with their banks. And they can happen a couple different ways.

• Unauthorized transactions – Payment fraud happens when a fraudster uses stolen credit cards and debit cards to make purchases. In iGaming, a fraudster may use stolen cards to top off betting accounts. When cardholders discover the fraud, they call their banks to dispute the charges.
• Friendly fraud – Friendly fraud happens when cardholders and opportunistic customers use the chargeback process incorrectly. For example, a player might regret the amount gambled and falsely claim fraud to get the money back. Or a significant other might not know the family member is gambling and disputes the charge as suspected fraud.

Multi accounting

Gnoming, or multi-accounting, involves players creating multiple online gambling accounts to help one player win or increase their odds of winning over other players.

Money laundering

Online casinos provide an easy opportunity for fraudsters to launder money. They can buy chips with laundered money, gamble, and then cash out with real money. This threat puts you at risk of failed compliance with anti-money laundering (AML) regulations.

Self-exclusion fraud

Some casinos participate in self-exclusion policies — which allow a person with a gambling problem to request their name be added to a self-exclusion list. The person is then legally banned from participating casinos and faces repercussions for entering those casinos.

In this scam, fraudsters open online gambling accounts and make false claims under the self-exclusion policy to blackmail iGaming operators into getting a refund.

Unfair gameplay

Unfair gameplay refers to using tactics to gain an advantage over other players or bypass restrictions set by the iGaming operator. For example, players can use bots to assess the odds in a game and bet accordingly. Underage players often use technology to bypass ID verification so that they can gamble.

Protecting your online casinos and sports betting sites is crucial to maintaining the success of your business. Although iGaming fraud prevention can be difficult, the benefits far outweigh the negatives.

If you’ve been in the card-not-present space for long enough, you know it’s crucial to keep your chargeback rate in check. But what happens when you experience an unexpected influx in chargebacks that lands you in the Visa^® chargeback monitoring program?

In this guide, we’ll cover everything you need to know about the Visa dispute monitoring program and provide tips for managing chargebacks so you can avoid enrollment in the future.

Visa monitors your dispute count and ratio to determine which program category you fall into. You are issued fines based on that category and the amount of time you spend in the program.

Each month you violate Visa’s thresholds, you could be placed in one of the following categories.

• Early warning classification – 75 dispute count and 0.65% dispute ratio
• Standard classification – 100 dispute count and 0.9% dispute ratio
• High-risk merchant classification – 100 dispute count and 0.9% dispute ratio
• Excessive classification – 1,000 dispute count and 1.8% dispute ratio

Your dispute ratio — also known as a chargeback ratio or chargeback rate — is a metric that shows the ratio between the total number of transactions you process and the total number of chargebacks you receive.

Here’s how Visa calculator your dispute ratio:

For example:

Visa’s violation statuses determine when fines and penalties are issued. Those three statuses are:

• Notification: The first month that your account is in the standard threshold. Visa does not issue any fines during this stage; however, your processor can.
• Workout: In the months following the Notification status, Visa allows time for you to fix your chargeback issues. This is the workout status. Again, Visa won’t issue fines during this stage, but your processor probably will.
• Enforcement: If you do not fix your fraud issues during the months in the workout stage, your account moves to the enforcement stage. During the first month and any following months that your account meets the standard threshold or higher, Visa will issue fines and penalties.

Fines are charged per each dispute. And the fines you owe depend on your classification type — standard, high-risk, or excessive. Fines start as soon as you are enrolled in the Visa chargeback monitoring program if you are classified as high-risk or excessive.

Regardless of the classification, the longer you are in the program, the more you’ll pay in fines. Typically, you are charged $50 per dispute and then a $25,000 review fee during certain months.

If you’re enrolled in the program for 12 months, Visa can close your merchant account, and you will no longer be able to accept Visa payments. However, it’s possible your acquirer will choose to close your merchant account much sooner.

Sometimes chargebacks happen because customers don’t recognize purchases on their billing statements or they have a difficult time contacting your customer service teams. Other times, it’s because your employees ship items incorrectly — causing goods to arrive damaged or a customer to receive the wrong item.

The best thing to do is reevaluate your customer service protocols — both on and off your website. That includes:

• Making sure your fulfillment team is sending the right merchandise and packaging items correctly.
• Having your customer service teams answer phone calls quickly and accurately.
• Providing clear billing descriptors.
• Writing detailed and accurate product descriptions on your website.

Another way to combat chargebacks is to implement verification protocols during checkout that will check if the cardholder is the one making a purchase. Therefore reducing unauthorized purchases.

One method is to require customers to enter the card verification value (CVV) on the card. Fraudsters who obtain card numbers online will not have this information and will not be able to complete the transaction.

You can also use address verification service (AVS) — which allows you to compare the billing address a customer provides during checkout to the billing address on file with their bank. If the addresses don’t match, the transaction may be declined.

Lastly, you can implement 3D Secure 2.0 — an identity verification tool that authenticates card-not-present transactions. When a customer makes a purchase, you can send information like shipping address and order history to the customer’s issuing bank. The bank then reviews the information to determine the likelihood of fraud and accepts or challenges the transaction.

One of the easiest ways to mitigate fraud-related chargebacks is by updating your website security. Make sure you have a firewall so that you can monitor incoming and outgoing traffic on your site and block suspicious traffic.

Additionally, you can require CAPTCHAs during checkout to verify that the user interacting with your site is a human. These protocols can help you block bad traffic from bots — software that is programmed to run automated tasks such as card testing fraud and credential stuffing. As a result, you can mitigate chargebacks from unauthorized purchases.

Enrollment in the Mastercard^® chargeback monitoring program — called the Mastercard Excessive Chargeback Program — can be stressful.

But with these tips and suggestions, you can safely exit the program and avoid future enrollment.

The Excessive Chargeback Program (ECP) is designed to encourage merchants to reduce chargebacks and improve their chargeback management strategy. It also serves as a penalty for merchants with excessive chargebacks.

Acquiring banks and card brands like Mastercard want to make sure your business doesn’t become a liability for their organizations.

Mastercard uses two benchmarks to evaluate risk: the number of chargebacks in a given month and the chargeback rate. Merchants must exceed the threshold for both in order to be enrolled in the program.

Your chargeback rate is a metric that shows the ratio between the total number of transactions you process and the total number of chargebacks you receive. It’s also referred to as your chargeback-to-transaction ratio or chargeback ratio.

Here’s how Mastercard calculates your chargeback rate:

For example:

When you are enrolled in the ECP, your acquirer will classify you as either an excessive chargeback merchant (ECM) or a high excessive chargeback merchant (HECM).

Mastercard assesses fines for merchants enrolled in the ECP based on the time spent within the program. The first month is a grace period — Mastercard won’t charge fines. However, your processor might.

After the first month in the program, fines are issued monthly and increase the longer you are enrolled. Amounts can range from $1,000 to $200,000 depending on your program classification.

However, you could potentially face additional fines from your processor or Mastercard through the Issuer Recovery Assessment (ISR). The ISR is an additional fine for merchants classified as HECM at 5 USD/EUR per chargeback over 300 chargebacks.

The unfortunate reality of being enrolled in a chargeback monitoring program is that the process of getting out of it can be difficult. And more than that, the program itself can be a huge drain on your revenue.

Chargebacks alone can dampen your profits. Add fines and penalties on top of chargebacks, and the financial health of your business could be seriously damaged.

Additionally, fraud and excessive monthly chargebacks put your merchant account at risk — which means you could potentially lose the ability to process transactions.

Taking proactive measures to avoid enrollment in a monitoring program is ideal. However, once you are enrolled, there are steps you can take to exit as quickly as possible.

When it’s impossible to avoid enrollment in Mastercard’s chargeback monitoring program, there are steps you can take to minimize the impact.

Part of a chargeback monitoring program is to help merchants develop an effective chargeback management strategy. Mastercard may request that you submit a remediation plan that outlines the steps you’re taking to resolve issues and regain compliance.

Most remediation plans include the following key elements.

• Business description – Talk about the type of business you own, payment and billing methods you accept, marketing efforts, and any other notable aspects of the business. The card networks need to get a good sense of who you are.
• Policy outlines – Provide details about your return and refund policies, terms and conditions, and any other internal procedures that could relate to the chargeback issue.
• Chargeback description – Provide details of the events that lead to the increased number of chargebacks. That means investigating the root cause of the issues — not just the reason codes — so you can tell a complete story about what happened.
• Risk management strategy – Your strategy for reducing risk is one of the most important parts of the remediation plan. You’ll need to provide a description of all fraud tools and prevention methods you plan to use, when you will implement them, and how those will help prevent chargeback issues.
• Action plan – Let the card network know what steps you will take to reduce chargebacks — what solution you will use, when you will implement it, and your expected results. You’ll also need to include a backup plan in case the first plan fails.

Ecommerce fraud prevention is a key factor in running a successful digital business. Online merchants are a huge target for fraud simply because it’s easy for fraudsters to commit scams and get away with them — which is why being proactive about fraud is a necessity in today’s digital marketplaces.

Ecommerce fraud is an umbrella term for fraud schemes that specifically target ecommerce businesses. And each type of fraud can have serious consequences for your business — such as revenue loss, poor customer experiences, reputational damage, and inventory loss.

Despite the many threats facing your business, there are ways you can help prevent fraudulent activities.

Part of stopping ecommerce fraud is about knowing when it is happening to your business. Most high-risk orders have certain characteristics in common such as:

• Buying high-priced items
• Ordering multiples of the same thing
• Placing larger-than-normal orders

Check out this blog article about high-risk orders to learn more.

If you notice any of these details on a transaction — especially multiple red flags on a single interaction — you might want to block it.

Monitor your chargeback and refund data so that you have a better understanding of who is interacting with your brand and why fraud has happened in the past.

Once you have that data, you can choose to either block or accept customers that have engaged in bad behavior — such as filing disputes or committing refund fraud.

Evaluate things like customer lifetime value (CLV), your chargeback rate, fraud ratios, and online reputation before you make those decisions.

An IP address is a unique set of numbers assigned to each internet or network device. It allows devices to communicate with one another. Monitoring IP addresses can help you detect fraud a couple different ways.

First, IP addresses are location specific. If the IP address doesn’t match the same geographical area of either the billing or shipping address, a fraudster could be at work. Second, multiple purchase attempts from a single IP address could mean a fraudster is testing multiple cards.

An IP address is a unique set of numbers assigned to each internet or network device. It allows devices to communicate with one another. Monitoring IP addresses can help you detect fraud a couple different ways.

First, IP addresses are location specific. If the IP address doesn’t match the same geographical area of either the billing or shipping address, a fraudster could be at work. Second, multiple purchase attempts from a single IP address could mean a fraudster is testing multiple cards.

One way to keep out bots and fraudsters is to require authentication steps for suspicious interactions on your site. This authorization step could mean adding a CAPTCHA before checkout for orders under or over unusual amounts to ensure a user is not a bot. You could also implement secure multi-factor authentication protocols for suspicious logins.

Selective authentication requirements means you only challenge suspicious behavior and don’t add unnecessary friction for good customers. This keeps your experience safe yet user friendly.

The card verification value (CVV) is typically a three- or four-digit code printed on a card. It’s meant to add a layer of security to online purchases and mitigate credit card fraud.

Businesses can’t store CVV codes, so it’s unlikely fraudsters will have that information if they obtain card numbers from data breaches. If a business requires the CVV at checkout, fraudsters with just the card numbers won’t be able to complete the purchase.

Address verification service (AVS) compares a customer’s billing address provided during checkout to the billing address on file with the customer’s financial institution. If the addresses don’t match, the shopper probably isn’t the cardholder. If that happens when you run an AVS check, you might want to cancel the order.

3D Secure 2.0 is a tool to help verify a shopper’s identity to reduce the risk of fraud. When a cardholder makes a purchase, the merchant sends real-time information — such as shipping address, the customer’s device ID, or order history — to the customer’s bank (called the issuer or issuing bank).

The issuer reviews the information to determine the likelihood of fraud. New information that differs from past attributes could indicate fraudulent activity. Based on the assessment, the transaction can either be approved, declined, or challenged with further authentication steps.

It’s important to note that 3D Secure 2.0 provides a guarantee. If a transaction is fully validated with 3DS2.0, a chargeback is blocked.

Make sure you partner with a reputable payment processor. You don’t want to put your business at risk. Do your research and know who you’re working with before you sign up for services.

The benefit of working with a reliable processor — in addition to safely being able to accept payments — is that they can help you put security systems in place like CVV and AVS checks to minimize fraud.

A firewall is a network security device that monitors incoming and outgoing network traffic. It can allow or block traffic based on a defined set of security rules.

Setting up a firewall can improve your network security by blocking unauthorized access to your site. Plus you can better monitor your traffic and identify suspicious interactions — such as abnormal, high velocity activity from bots.

PCI-DSS is the global security standard for all businesses that store, process, or transmit sensitive cardholder data.

Maintaining compliance can help you create long-lasting relationships with customers, acquirers, and payment processors. Not maintaining compliance can lead to data breaches, law suits, damaged reputation, and a host of other problems.

Fraud is constantly evolving, which means your website and fraud software needs to be continually updated to keep pace. Outdated technology can leave you vulnerable to attacks.

HTTP is a protocol that allows data transmission via the web. HTTPS is HTTP but is more secure. It uses TLS (SSL) to encrypt normal HTTP requests and responses. This means that any information you transmit — like passwords or credit card numbers — will be difficult for anyone to intercept.

Training can play a crucial role in preventing fraudulent activity and should be offered to your whole team. Anti-fraud training can help employees identify and respond to potentially fraudulent inquiries more effectively.

For example, you can train each department on the following fraud practices.

• Fulfillment team – Train your fulfillment team to look for empty boxes that should have returned merchandise. Also, equip your fulfillment team to identify returns that involve counterfeit merchandise.
• Marketing team – Help your marketing team understand the importance of monitoring and analyzing ad traffic. With the marketing team’s help, you can detect and discontinue campaigns attracting fraud and promo abuse.
• IT team – Make sure your IT team is aware of emerging fraud threats so that they can respond appropriately. That includes keeping software up to date, installing firewalls, and setting up any other technologies that can stop potential threats.
• Customer service – Teach your customer service agents about social engineering and refunding services — these are some of the biggest threats your agents face. Also encourage agents to answer emails and calls promptly to maintain positive customer relationships.

Policies are the foundation of fraud detection software and prevention strategies. You need to establish rules about who you do and don’t want to do business with. However, these policies aren’t one-size-fits-all.

What works for another merchant in your industry might not work for you. And the way you handle one customer might be different for another. You need to be able to create policies that can block suspicious behavior on your site while still accepting the maximum number of customers possible.

Manual reviews means that one or more team members manually evaluates different data points to find fraud patterns.

Some businesses like to do some manual reviews to deliver better customer service or supplement older fraud solutions. However, manual reviews can be time-consuming, inaccurate, and ineffective at fighting fraud. And some businesses simply don’t have the time to manually review suspicious orders.

The decision to manually review transactions is something only you can decide. Maybe you want to review everything flagged as suspicious. Maybe you only review some. Or maybe you don’t review any at all.

Here are some things to consider:

• Return on investment (ROI) – Will you save more than you’ll spend in manual labor? Potentially losing $1,000 for a designer purse might warrant $10 in labor costs.
• Time – Can you afford delays in the checkout process? If you’re selling something that a customer expects to receive right away — such as a digital download or food order — you don’t have time to review orders.

Make sure your policies are written clearly on your website and placed in a location that is easy for customers to find. Consider having customers check a box that says they agree to your policies before checking out. That way, when a customer tries to exploit a policy, you can point back to their original consent.

Certain times of the year are usually busier than others. That might mean you want to accept a little more risk during the holidays to maximize profits. Maybe you change your refund and return policies to be more lenient or lower risk thresholds. Perhaps you pause manual reviews.

Whatever you decide, just make sure you reevaluate your strategy once the busy time has passed.

Certain merchandise can be more appealing for fraudsters. For example, if you mostly sell high-dollar items, fraudsters may target your low-dollar items so that they can use your business for card testing. Other items might be targeted for resale fraud — such as collectables or limited edition merchandise.

Keep track of items that attract fraud and consider removing them from inventory if they cause issues.

Fraud can happen through mobile apps, websites, phone orders, and more. Make sure your fraud systems protect different sales methods if you offer multiple ways to pay for merchandise.

Setting limits on the number of items a customer can buy or the minimum amount they need to purchase can help you avoid card testing fraud and retail arbitrage.

It may seem extreme, but unless you implement fraud prevention software, don’t allow guest checkout.

The more customer information you have, the better you can verify if the cardholder is the actual shopper. Plus, the extra work of opening an account may dissuade fraudsters from attacking your business.

One way to avoid return fraud and friendly fraud is by requiring your shipping and delivery department to take photos of orders once they have been delivered. This kind of proof can be extremely difficult for a customer to protest.

There are a variety of reasons for friendly fraud. For example:

• Buyer’s remorse
• Kids or a spouse making purchases without the cardholder’s knowledge
• Restrictive return policies

There are lots of things you can do to reduce the risk of friendly fraud. Generally, the more robust your strategy, the greater your protection. Here are some best practices that can get you started:

• Write clear product descriptions and include images so that customers know what they are getting
• Use a clear billing descriptor
• Don’t use bait and switch marketing
• Wait to charge the card until you are ready to ship merchandise
• Remind customers of recurring transactions before charging the card
• Share policies before completing transactions and require customers to accept the policies before finalizing purchases
• Offer great customer service when a customer has an issue

Some customers will still file disputes despite these protocols. For those cases, you can use chargeback prevention tools — such as prevention alerts, order validation, and RDR — to reduce the negative impacts disputes can have on your business.

Account takeover fraud happens so frequently because most customers use the same easy-to-guess password on multiple accounts. Setting password requirements will help with account protection and reduce ATO attacks.

For example, some password requirements you can implement include:

• Minimum length of eight characters
• Combination of letters and numbers
• Mix of upper and lowercase letters
• Use of special characters

Additionally, you can encourage customers to regularly update their passwords for stronger protection.

Egift card fraud is a growing threat to businesses that offer digital gift cards. And while these cards present many benefits — such as customer loyalty and more revenue — they come with risks. However, you can mitigate the negative impacts by recognizing gift card scams and implementing prevention tools.

Egift card fraud is a scheme where a fraudster buys gift cards online using stolen payment information then uses or resells them. Essentially, it’s a way to get cash. And because egift cards don’t require buyers to attach hardly any personal details to them, fraudsters can easily get away with scams.

Like other fraud schemes, egift card fraud can have a multitude of negative effects on your business — profit loss, inventory loss, and brand damage, to name a few. Understand the risks so that you can take the necessary precaution to avoid this type of fraud altogether.

Wondering how to stop egift card fraud and chargebacks? Fortunately, there are ways to help protect your business.