Fraud Screening Without Killing Good Orders

The layers the card networks describe

Visa's dispute management guide (June 2024) points card-absent merchants to address verification (AVS), the card security code (CVV2) and Visa Secure. Treat them as layers rather than a single gate: each check filters a different kind of order and leaves a different record behind for a dispute. Ask your provider which checks your gateway supports, how each result is returned to your system, and what your account does with a mismatch by default, because a response code only helps if your checkout acts on it. Sending complete, accurate data in the authorization request is what makes the results worth reading.

What each check gives you if an order is disputed

Screening is also evidence gathering. Visa's guide says your acquirer can respond to a disputed transaction when you received an AVS "Y" match and the billing and shipping addresses are the same, provided you supply proof of the shipping address and signed proof of delivery. It also lists certain CVV2 results that give response rights, such as an issuer that does not support CVV2, or an issuer that approved a mail, phone or e-commerce order despite a no-match result. For Visa Secure, the guide says a successfully authenticated transaction (electronic commerce indicator 5), or an attempt where the issuer or cardholder does not take part (indicator 6), protects the merchant from fraud-related disputes, while a merchant that does not attempt authentication (indicator 7) is not protected. It adds that liability shift rules vary by region, and that a Visa Secure merchant identified by the Visa Fraud Monitoring Program may still receive disputes under condition 10.5. Our 3D Secure guide covers authentication in more detail.

Decline, review or accept

A useful rule set has three outcomes, not two. Decline orders with signals you trust, such as a card that fails the security code check on a high-value order. Send borderline orders to manual review, where someone checks the order history, contacts the customer or asks for authentication. Accept the rest. Every hard decline turns away some genuine customers, and those losses never appear in your dispute reports, so decide which signals are strong enough to block and which only justify a second look. Rules that count attempts, cards or addresses over time complement the velocity limits your acquirer may set on your account.

Do not store what the rules forbid

Screening tools, order logs and support notes must not become a store of sensitive data. Visa's Core Rules (18 April 2026) require members to ensure their merchants do not store, after authorization, the full contents of magnetic stripe or chip data, the CVV2, or the PIN or encrypted PIN block, and to ensure merchants comply with PCI DSS. If you charge returning customers, use tokens and the stored credential process rather than keeping card numbers or security codes.

Measure, then tune

Visa's guide recommends tracking disputes by condition, tracking dispute activity as a share of sales, and tracking card-present and card-absent disputes separately. It says Visa monitors merchant dispute activity monthly and notifies acquirers when merchants have excessive disputes, and that acquirers are expected to act. Visa's rules list excessive unauthorized transactions and identification by the Visa Acquirer Monitoring Program among the reasons an acquirer must add a terminated merchant to the terminated merchant file. Illustrative example only, with made-up round numbers: a store takes 1,000 online orders a month. Its rules decline 20, send 50 to review and accept the rest. Reviewers approve 40 of the 50. If fraud disputes stay flat after loosening a rule and approvals rise, the rule was costing sales; if fraud disputes rise, tighten it again. Change one rule at a time so you can see its effect.