How to detect online fraud across the customer journey

A suspicious signup and a fraudulent payment can belong to the same sequence, but they do not arrive with the same evidence. To detect online fraud, assess the action being taken, connect device and network observations with account history, and retain the final outcome. Start at the earliest valuable action rather than waiting for a card charge.

Define the action and the loss

Write down what the business is protecting: a trial credit, account access, an order, stored value or a withdrawal. Then identify the last moment when a decision is useful. A payment verdict returned after fulfillment may help an investigation, but it cannot undo the shipment.

Separate fraud from other unwanted behavior. A promotion can be abused with a valid card and a real identity. A legitimate customer can use a VPN. A failed payment can come from an issuer restriction rather than fraud. These distinctions determine what you collect and how you evaluate a tool.

Build evidence around the event

Keep the evidence timestamp. A device relationship discovered later is useful for investigation, yet it should not silently appear in a reconstruction of what a system knew at checkout. Preserve both the event-time assessment and later findings.

Detect activity before a payment exists

At registration, relevant evidence can include repeated accounts, device reuse, masking and signup velocity. At login, inspect changes in device, location and authenticated account context. During product use, look for repeated claims on benefits or access shared outside the agreed entitlement.

ShieldLabs Identification combines device and network evidence with risk for visitors, users, devices and IPs. Ready-made account findings can make those relationships actionable before checkout. The review explains that role and its self-serve access.

That does not mean every account sharing a device belongs to one operator. Families, kiosks and support environments create legitimate links. Use corroborating activity and known controls. The fraud-ring guide shows how to inspect a connected group without turning every shared address into a conclusion.

Add the payment and money-movement layer

At checkout, combine the existing session with the payment attempt and its lifecycle. Preserve separate outcomes for the fraud service, authentication step, issuer and order. An issuer decline is not the same event as a merchant risk restriction.

Stripe Radar illustrates how payment-risk information fits a processor workflow. Sardine’s payment product describes a broader set of payment rails with device, behavioral and counterparty context. Required inputs and response timing differ; choose the one that matches the movement of value.

For a withdrawal, the recipient change and account history may matter as much as the payment instrument. An instant transfer also gives the application a different intervention window from an order that can be held before fulfillment. Specify the action deadline during evaluation.

Turn evidence into an explainable response

Define responses appropriate to the evidence: continue, verify, review, restrict or stop the action. Keep the reason available to the team handling a customer’s question. A risk score should not erase the named signals that produced it.

Use a recovery path. A returning customer on a new phone should be able to establish legitimate access. Repeated confirmed abuse requires a different response from a missing collection result. Treat unavailable evidence as its own state rather than converting it into either a clean verdict or proof of abuse.

Measure what happened afterward

Track the assessed event, action and observed outcome together. Inspect legitimate approval, confirmed loss, review workload, completed verification and abandonment. Follow labels long enough for the protected flow; payment disputes usually mature after the original decision.

Use the false-positive evaluation guide to define denominators. Compare candidate products on the same permitted events. A public browser check in the testing directory can show the interface and evidence type, but it cannot establish fraud detection performance for an entire customer population.

FAQ