Where fraud rules run
The most important thing about fraud rules for online stores is not which rules you pick. It is when they run. UltraCart evaluates every rule against the order before the credit card is processed, comparing the details of the current order against previous transactions to spot a pattern. A rule that declines a transaction stops it at checkout, which means there is no charge to reverse, no product to recover, and no dispute counted against the ratio your processor is watching.
That timing matters more than it sounds. Where fraud screening arrives as an installed app, the check usually happens after the order already exists, because an add-on cannot step in front of the authorization. The difference feels academic right up until you are the one issuing refunds and pulling packed boxes off the shipping line.
UltraCart groups its rules into families: exemptions, credit card checks, IP and subnet velocity, address matching, and affiliate abuse. Each rule reads as a sentence you finish, so you enter a value, pick what should happen, and click apply. The full list lives in the UltraCart fraud prevention configuration guide.
Start with exemptions
Exemption rules are checked first, and an order matching one skips every other rule in the system. This makes them the most important rules on the page and the ones most often forgotten, because they are the rules that stop your fraud system from attacking your own business.
Add your office and call center IP addresses before you add anything else. A rep taking twelve phone orders in an afternoon from one IP address looks exactly like a fraud ring to a velocity rule, and the first thing you will learn without an exemption is that your own team cannot place orders. If you run B2B, add an exemption for customers logged into a profile with a pricing tier, since those are known accounts with a purchase history and there is rarely a reason to hold their orders.
The first five fraud rules
If you turn on nothing else, turn on these five. They cover the fraud patterns that actually reach small and mid-size stores: oversized orders testing a stolen card's limit, someone cycling through card numbers at your checkout, high-velocity attempts from one place on the internet, orders whose billing and shipping do not agree, and affiliates writing their own commissions.
| Family | Rule | Where to start |
|---|---|---|
| Credit Card | If single transaction exceeds | Flag at 2x your average sale, decline at 4x |
| Credit Card | If user changes credit card number this many times | 4 |
| IP / Subnet | If weekly attempted transaction count for IP subnet exceeds | 10 |
| Address | If billing address does not match shipping | Flag for review |
| Affiliate | If affiliate generates multiple sales with the same IP in one week | Flag for review |
The transaction ceiling is the one merchants underestimate. Someone testing how much room is left on a stolen card will try to spend all of it, so an order at four times your typical basket size is worth stopping outright rather than reviewing. The card-change rule catches the opposite behavior: one person sitting at your checkout working through a list of numbers looking for one that clears.
The affiliate rule deserves a note because almost nothing else offers it. If you run an affiliate program, a partner placing several orders from a single IP address in a week is generating commissions rather than customers. This rule requires that you are using UltraCart's built-in affiliate management, since it needs the attribution data to work.
Stop card testing
A card testing attack, sometimes called carding, is not someone trying to steal your products. It is someone using your checkout as a free validation service for a batch of stolen card numbers before selling them on. Your store is chosen because it is reachable, not because of what you sell.
The damage is the per-attempt fee your processor charges whether or not the transaction succeeds. A sustained run generates thousands of attempts and a bill to match, and some processors respond by suspending your payment processing entirely while they sort it out, which costs you every legitimate sale in the meantime.
The fix is a velocity cap in the IP and subnet rules, flagging any IP address that exceeds five attempted transactions in a day or ten in a week. Choose the action deliberately: declining tells the attacker each card failed without revealing the decline came from you rather than the issuing bank, which makes your checkout useless for testing. The guide to blocking a carding attack covers the exact thresholds.
Protect free trial offers
If you sell a free trial, a shipping-only offer, or anything with a rebill behind it, you have a specific fraud problem that generic advice will not touch. Someone loads a prepaid or gift card with just enough to clear the initial charge, receives the product, and disappears before the rebill, which was never going to succeed. You paid for the goods, the shipping, and often an affiliate commission on a sale that was never real.
The premium credit card rule checks whether the card is prepaid or a gift card, using a third-party service at five cents per card validated. That fee sounds like a reason to hesitate until you do the arithmetic. On a trial offer costing you five dollars in product, five in shipping, and forty in commission, a single blocked fraudulent order pays for nine hundred validations. UltraCart's own documentation shows this rule blocking 3.85% of transactions on a free trial campaign.
Scope this rule to your trial items specifically rather than running it across your whole catalog. There is no reason to spend five cents validating a card on a straightforward one-time purchase, and prepaid cards are perfectly legitimate on most of what you sell. If you want the underlying mechanism, see how BIN validation identifies prepaid and gift cards.
Pick the right action
Every rule has an action, and choosing the wrong one is how fraud systems end up costing more than the fraud. UltraCart gives you four:
- Flag for review: The order goes to Accounts Receivable with an automatic merchant note explaining which rule it tripped, so whoever picks it up knows why.
- Decline transaction: The customer is stopped at checkout and sees a decline message, which you can customize per rule.
- Process payment and review: The payment goes through and the order lands in the Fraud Review queue for a second look before it ships.
- Process payment and modify: The payment goes through and the order is tagged, usually into a custom field, so it can be picked up by a downstream process.
The instinct is to decline everything suspicious. Resist it. Declining a real customer costs you the order and often the relationship, and the rules most likely to produce false positives are exactly the ones people set to decline first, particularly the billing and shipping mismatch. Gift purchases, corporate cards, and anyone who has moved recently all trip that rule honestly. Start new rules at flag for review, watch what actually lands in the queue for a few weeks, then tighten the ones that only ever catch fraud.
Scope every rule
A rule that applies to your entire store is usually a rule you will end up turning off. Each rule accepts optional filters, and using them is the difference between fraud prevention that stays on and fraud prevention that gets disabled after it blocks a good customer.
You can limit a rule to specific items, which is how the prepaid card check stays on your trial offer and off everything else. You can limit it to particular rotating transaction gateways, which matters if you run several merchant accounts with different risk profiles or different acquirer requirements. You can limit it to a single screen branding theme, so a rule written for one storefront does not govern another. Leave a filter empty and the rule applies to everything.
Two more controls are worth knowing. You can block an entire email domain by writing the rule as a wildcard, so an address ending in a particular free provider can be declined or held. And when a fraudulent order does get through, you can build new rules straight from it, using the IP address range, the full card number, the numeric part of the street address with the postal code, or the email address. If you have linked UltraCart accounts, your existing rules populate to newly linked accounts automatically.
Prove your fraud rules work
This is the part almost nobody does, and it is the difference between a fraud configuration and a fraud strategy. UltraCart records statistics for every rule daily, available under Reporting as the Fraud Rule Statistics Report. Pick a date range and you get a spreadsheet showing, for each rule, how many times it was checked, how many orders it declined or exempted, how many passed, and the percentages.
That report answers questions intuition cannot. Which rules have never fired once, and are therefore pure false-positive risk with no upside? Is the transaction ceiling you set two years ago still right now that your average order has moved? A rule that has fired zero times in six months is not protecting you, it is waiting to block a real customer.
Run it quarterly. Retire the rules that never fire, tighten the ones that only ever catch fraud, and loosen the ones producing review work that always turns out legitimate. A rule set nobody has revisited since launch drifts out of alignment with both the threats and your own business.
Fraud rules FAQ
What happens to an order flagged for review?
It goes to Accounts Receivable with an automatic note in the merchant comments naming the rule it tripped. Make sure at least one user is configured to receive the Process Credit Card Payment and Fraud Review notifications under Configuration, then Users, or flagged orders will sit unnoticed.
Does the customer still get a receipt?
By default, yes, even when the order is held. If that is not what you want, open your receipt email template and choose the option to hold the receipt until payment processes. The receipt is then held until you authorize the payment from Accounts Receivable.
What message does a declined customer see?
If you do not set a custom message, they see a generic decline asking them to confirm the billing address matches the one on their card statement and try again. You can write your own message per rule, and on rules that produce occasional false positives it is worth doing, because a customer who understands what to fix might complete the order.
What do the premium rules cost?
The prepaid and gift card check is five cents per card validated. The fraud score rules are one cent per card validated, and there is a variant that exempts APO and FPO addresses, which is worth using if you sell to military addresses since they score poorly for reasons that have nothing to do with fraud. Every other rule in the system is included in your account.
How is the fraud score calculated?
The score comes from MaxMind and is a composite of machine learning models and heuristics, so there is no published breakdown of how each factor is weighted. You can still inspect the underlying indicators on the order. Pay attention to the proxy detection checks and to the ship forwarder and email carder flags, which are the signals that most often push a score high enough to warrant review.
Can I block orders from free email providers?
Yes. Add an email rule using a wildcard for the domain, then choose whether to decline those orders outright or route them to Accounts Receivable. Use this one carefully, since plenty of legitimate customers buy from free email accounts, and holding for review is almost always the better action than declining.
Where to go from here
Fraud rules are one layer. They stop the orders you can identify as bad before the card is charged, but they cannot recover a payment declined for an ordinary reason, and they cannot fight a dispute already filed. UltraCart covers the first of those with automated payment retry, part of its built-in revenue recovery tools.
Start with exemptions so your own team is protected, turn on the five rules above at flag for review, and put a note in your calendar to run the statistics report in ninety days. That is an afternoon of work that pays for itself the first time it stops an order you would otherwise have shipped. If you want help tuning a configuration around a specific offer or an active attack, UltraCart's professional services team can work through it with you, and every rule here is also reachable through the UltraCart API and webhooks. For more on protecting margin, browse the UltraCart resource articles.