Fraud Prevention

UltraCart's ecommerce fraud prevention runs against every order before the credit card is processed, so a bad transaction is stopped at checkout instead of discovered on a chargeback notice three weeks later. You decide which rules apply and what happens when one trips. The entire system is included in your account, with no separate fraud app to buy or connect.

The system compares the order in front of it against previous transactions and known fraud patterns. Rules are grouped into exemptions, credit card checks, IP and subnet velocity, address matching, and affiliate abuse, and each one reads as a plain sentence you finish: decline transactions over a set amount, hold orders where the billing address does not match the shipping address, flag any IP that has attempted more than five transactions today. There is nothing to script and no model to train.

Without a filter at checkout, a fraudulent order costs you three separate times: the product ships, the chargeback arrives, and your processor counts the dispute against your ratio. Card testing attacks make it worse, because every attempt carries a transaction fee whether or not it succeeds. UltraCart lets you cap attempts per IP address by day and by week, so a carding run stops after a handful of tries rather than thousands. When a rule does trip, you choose the response: decline at checkout with a custom message, flag the order into Accounts Receivable for review, process the payment and modify the order, or process the payment and route the order to the Fraud Review queue for a second look before anything ships.

Rules can be narrowed to specific items, specific rotating gateways, or a single screen branding theme, so a filter written to protect a free trial offer does not interfere with your main catalog. Exemption rules run first, which is how call centers and office IP addresses stay clear of the system while taking phone orders. When a fraudulent order does slip through, you can build new filters directly from it: the IP address range, the full card number, the numeric portion of the street address paired with the postal code, or the email address. Fraud rules are also reachable through the UltraCart REST API, so a connected application can search, insert, and remove them on your behalf as it works your disputes.