By William Stapleton, Frisco, TX
Why this keeps coming up in every merchant conversation
I run a payments company, so fraud questions land on my desk almost every week. A restaurant owner wants to know why a customer’s card got declined three times before it worked. A retailer wants to know why a chargeback went against them when they did everything right. Most of these questions come from the same place: people think fraud prevention is something that happens once, at setup, instead of something that has to keep moving.
That mindset made sense ten years ago, when a merchant could pick a processor, turn on a fraud filter, and mostly forget about it. It does not work anymore. The tools fraudsters use change every year, and the tools that stop them have to change with them.
The shift I’m watching most closely heading into 2026
Card-present fraud has gotten harder to pull off because chip technology and tokenization closed a lot of the old doors. So fraud has moved where the doors are still open: card-not-present transactions, account takeovers, and synthetic identities built from stolen or invented personal data.
For a business owner, this means the fraud you need to worry about in 2026 rarely looks like a stolen physical card. It looks like a legitimate-seeming customer account that was built slowly, over months, specifically to pass basic fraud checks before it gets used for one large purchase. That kind of fraud does not trip the old alarms because it was designed by someone who studied the old alarms first.
What I tell business owners to stop doing
The biggest mistake I see is treating fraud prevention as a single setting rather than a set of layers. A business turns on address verification, feels covered, and stops there. One control catches one kind of problem. Fraud that is built to look normal will slip past a single filter almost every time.
The second mistake is ignoring the data a business already has. Most merchants sit on transaction history that would tell them a lot, average order size, typical time of day, common shipping patterns, but nobody looks at it until after a chargeback shows up. By then the useful moment has passed.
What actually helps
Layer your checks instead of picking one. Address verification, card verification codes, and velocity checks (how many times a card or account is used in a short window) each catch different things. None of them is enough alone, but together they cover more ground than any single tool.
Watch behavior, not just data points. A transaction that matches every field on file can still be wrong if it does not match how that customer normally behaves. Someone who orders twice a year and just placed five orders in an hour is worth a second look, even if their information checks out.
Treat your fraud settings as something you tune, not something you set. I tell merchants to revisit their thresholds every few months. What counted as a suspicious order pattern last year might be normal now, and what was normal might now be a red flag. Static settings age badly.
Know the cost of being too strict. This is the part people miss. A fraud filter set too tight will decline good customers along with bad ones. I have seen businesses lose more revenue to false declines than they ever would have lost to actual fraud. Security and customer experience have to be balanced against each other, not treated as separate problems.
The part that will matter more in 2026
Synthetic identity fraud is going to keep growing because it is patient and it is cheap to build. A fraudster does not need to steal your customer’s identity if they can manufacture a new one that looks just as real to a basic verification check. This is why I think identity verification at account creation matters as much as fraud checks at checkout. If a fake identity gets in the door early, it will pass your point-of-sale checks later, because by then it has a transaction history that looks clean.
Where I’d start if I were a business owner today
Pull your chargeback data from the last twelve months and look for patterns, not just totals. Ask your processor what layers of fraud protection are actually active on your account, not just what is available. And build in a habit of reviewing your settings on a schedule instead of waiting for a bad quarter to force the conversation.
Fraud prevention is not a project with an end date. It is closer to maintenance: the businesses that treat it that way spend less time cleaning up after the fact.