Fraud Prevention for Online Orders

Fraud prevention should combine payment-provider controls, secure staff access, proportionate order review and a documented response to suspicious activity. It should not rely on stereotypes, ask staff to collect card secrets or block legitimate customers with unexplained rules.

Map the fraud scenarios

Use the payment provider properly

Enable supported authentication, CVV and address checks according to the provider's current documentation and the business risk profile. Do not invent universal reject rules. A partial address mismatch can have innocent causes, while a successful authorisation does not guarantee the order is genuine.

Create a proportionate manual-review policy

Define objective triggers such as repeated rapid attempts, unusual value relative to the operation, post-payment address change or inconsistent contact. Give staff a safe procedure that does not request a full card number, PIN, one-time banking code or unnecessary identity document.

Where the outcome remains uncertain, the business may decline or refund before preparation under its documented process. Record the reason and avoid discriminatory assumptions based on name, neighbourhood or accent.

Secure administration

• Unique staff accounts and least privilege
• Multi-factor authentication for payment, ordering and email administration
• Approval and audit for refunds, promotion creation and bank-detail changes
• Prompt offboarding of staff and agencies
• Device updates, backups and phishing training
• Supplier incident contacts and evidence retention

Handle a suspected incident

1. Protect active orders and accounts; do not destroy evidence.
2. Contact the payment provider or bank through a verified route.
3. Reset compromised access and check connected systems.
4. Identify affected orders, refunds, customer data and settlements.
5. Assess reporting obligations and customer communication.
6. Report fraud through the correct UK route where appropriate.
7. Review the root cause and update controls.

Measure false positives and outcomes

Track fraud loss, chargebacks, prevented attempts, legitimate orders blocked, manual-review time and customer complaints. A control that rejects many genuine households can cost more than the fraud it prevents.

Practical next step: write a one-page suspicious-order procedure with three review triggers, prohibited questions, approval authority and provider contact. Test it with staff using a harmless scenario.

Review supplier configuration regularly

Payment authentication, risk rules and device controls can change after a provider release. Schedule a periodic review with sample transactions and documented approval. Check that alerts reach a monitored address and that staff know the verified support route.

Keep fraud controls separate from customer-service judgement. A suspicious order may be declined, but a later complaint or data request still requires a fair and documented response.

Related guides

• Payments — the main guide for the wider topic.
• Payment Security and Compliance — the broader guide that frames this implementation.
• Data Protection for Payment Information — a closely related operational control to review alongside this page.
• PCI DSS Compliance for Restaurants — a closely related operational control to review alongside this page.

Sources and date checked

Guidance checked: 24 July 2026. Recheck official guidance and supplier documentation before changing a live system.

• NCSC: small organisations guide to cyber security
• GOV.UK: avoid and report internet scams and phishing
• Stop! Think Fraud: reporting fraud