Shopify fraud glossary

An authentication step in which the card issuer verifies the shopper — for example with a banking-app approval or one-time code — before a card payment completes. A successful 3DS check usually shifts liability for fraud chargebacks from the merchant to the issuer.

Fraud in which an attacker logs in to a real customer account with stolen or guessed credentials, then uses saved details, loyalty points or gift-card balances, or changes the shipping address.

The number that identifies the network operator — an ISP, mobile carrier, cloud or hosting company — that announces an IP range on the internet. Fraud tools use the ASN to tell residential traffic from datacenter and hosting traffic.

A card check that compares the numeric parts of the billing address — street number and postal code — with the address the issuing bank has on file. An AVS mismatch is a risk signal, not proof of fraud.

A brute-force attack in which fraudsters take a card issuer's Bank Identification Number (the first digits of a card) and generate the remaining digits, testing thousands of combinations against a checkout to find valid cards.

Using a store's checkout to check whether stolen card numbers work, usually through many small or failed payments in a short time. It causes authorization fees, chargebacks and processor scrutiny.

A forced reversal of a card payment that the cardholder's bank starts after a dispute. The merchant loses the payment amount and usually pays a chargeback fee, unless the dispute is won through representment.

The share of transactions in a period that become chargebacks, measured by count or by value. Card networks monitor it, and ratios around 0.9–1% can put a merchant into a monitoring program.

The code a card network attaches to a chargeback to state why the cardholder disputed the payment — for example fraud, item not received or not as described. It decides what evidence the merchant needs to respond.

A compact way to write a block of IP addresses, such as 203.0.113.0/24, where the number after the slash sets how many addresses are included. It lets a store block a whole network range with one rule.

The 3- or 4-digit security code printed on a payment card. A matching CVV suggests the buyer physically has the card, so a CVV mismatch on an online order is a strong fraud signal.

An IP address that belongs to a cloud, hosting or server provider rather than a home or mobile connection. Real shoppers rarely browse from one, so datacenter traffic often indicates bots, scrapers or proxies.

Identifying a browser or device from a combination of attributes — such as screen, fonts, language and hardware features — so the same device can be recognized across visits, accounts and IP addresses.

A cardholder's challenge to a payment with their bank. It may be resolved through an inquiry or become a chargeback, in which case the funds are pulled back from the merchant.

A legitimate customer or order that fraud rules block or a bank declines. False positives are easy to miss in reports but cost revenue and repeat customers.

Also called first-party fraud: a real cardholder makes a purchase and then disputes it — claiming it never arrived or was unauthorized — instead of asking the merchant for a refund.

Restricting access to a store, or to checkout, based on the visitor's location as estimated from their IP address. In the EU, geo-blocking of consumers from other member states is limited by the Geo-blocking Regulation.

A web browser that runs without a visible window and is controlled by code, through tools such as Puppeteer, Playwright or Selenium. It is used for testing, and also by bots that scrape stores or automate checkout.

A form field hidden from human visitors but visible to bots. Any submission that fills it in is almost certainly automated, so it can be blocked without adding friction for real customers.

Estimating a visitor's country, region and city from their IP address using commercial databases. It is highly accurate at country level but much less reliable at city level.

Exploiting discounts beyond their intended use — for example with multiple accounts, leaked single-use codes or code-stacking scripts — to claim discounts the store never meant to give.

The merchant's formal response to a chargeback, submitting evidence such as delivery confirmation and order details to the card network to recover the funds.

A proxy that routes traffic through real home or mobile internet connections, so requests carry clean residential IPs. Fraudsters use them to get past datacenter and IP-reputation blocking.

Abusing a store's return or refund process — for example returning an empty box, a different item or a used product — to get money back while keeping the goods.

Automated software that buys up limited-stock products, such as sneaker drops or limited editions, faster than humans can, usually to resell them at a markup.

An anonymity network that routes traffic through several volunteer relays so the destination site only sees the IP of the final relay, called the exit node. Very little legitimate shopping traffic uses Tor.

A scheme in which a fraudster sells goods on a marketplace, then fulfils those orders by buying from a real store with stolen cards. The real buyer receives the item, and the store is hit with the chargeback.

A rule that limits how often something can happen in a time window — such as orders per card, checkout attempts per IP or accounts per device — to catch automated and repeated fraud.

A service that encrypts a user's traffic and routes it through a server elsewhere, so websites see the VPN server's IP and location instead of the user's. Many real shoppers use VPNs, so VPN traffic needs careful handling.