You're looking at a transaction that triggers two fraud signals but comes from a device with a clean history. Do you decline it and risk losing a legitimate customer, or approve it and prepare to defend the chargeback later? This decision repeats hundreds of times a day, and getting it wrong costs you either in lost revenue or dispute fees.
The choice between prevention and remediation isn't binary, but your resource allocation has to be deliberate. Here's how to decide where to invest your effort.
The Decision You're Facing
Your fraud prevention budget splits between two fundamentally different activities: stopping bad transactions before authorization and winning disputes after a customer files a chargeback. The first requires real-time signal processing and automated decision-making. The second requires evidence collection, documentation, and analyst time.
With chargebacks rising 19% year-over-year and merchants losing $4.61 for every dollar of fraud, you can't afford to guess. The right split depends on what's actually driving your losses.
Key Factors That Affect Your Choice
Three variables determine whether you should invest more in upstream blocking or downstream dispute management:
Your fraud mix. If stolen credentials and account takeover dominate your losses, you're dealing with true fraud that can be stopped with device signals, velocity checks, and behavioral analysis. If first-party misuse is your bigger problem, you're facing customers who complete legitimate purchases and dispute them later. First-party fraud made up 36% of all reported fraud in 2024, up from 15% a few years earlier.
Your chargeback rate. Card networks monitor merchants against thresholds around 0.65% for standard programs. If you're approaching that line, you need immediate intervention at checkout to reduce volume. If you're well below it but losing too many disputes, your problem is evidence quality, not transaction volume.
Your customer tolerance for friction. High-value customers notice authentication steps first. If you're seeing cart abandonment spike after adding Multi-Factor Authentication or 3D Secure to every transaction, you're trading fraud losses for conversion losses. That means you need smarter risk segmentation, not blanket controls.
Path A: Prioritize Upstream Prevention
Choose this path when true fraud dominates your chargeback queue and your current approve rate is too high relative to your fraud rate.
When to choose this:
- Device and network signals show clear patterns: emulators, proxies, or devices linked to prior fraud
- Velocity checks catch the same card or address hitting multiple accounts in short windows
- Your dispute win rate is already strong, but you're still losing too much to unauthorized transactions
What this looks like operationally:
Build a layered defense that combines device signals, behavioral analysis, and velocity checks. Don't rely on a single rule. A fraudster who passes the velocity check might still fail the device fingerprint test.
Set risk-based friction thresholds instead of applying the same authentication step to every order. Low-risk transactions move through without interruption. Mid-tier risk gets a lightweight challenge. Only the highest-risk orders trigger full verification or manual review.
Route high-risk transactions into analyst queues with the supporting signal data attached. Analysts make faster decisions when they see the full context, not just a binary fraud flag.
The tradeoff:
You'll reduce fraud losses and keep your chargeback rate below network thresholds, but you'll need to monitor false positive rates closely. Declining legitimate customers creates its own revenue loss. Track approve rate alongside fraud rate monthly. If your approval rate is rising while fraud losses stay flat, your prevention strategy is working. If both are dropping, you're blocking too aggressively.
Path B: Prioritize Dispute Management and Evidence Collection
Choose this path when first-party misuse drives your chargeback volume and your upstream fraud detection is already catching most true fraud.
When to choose this:
- The Merchant Risk Council found that 62% of merchants reported an increase in first-party misuse disputes, and 57% cited a rise in refund and policy abuse
- Your customers are who they claim to be, but they're disputing legitimate purchases anyway
- You're losing disputes because your evidence is incomplete or arrives late
What this looks like operationally:
Document device data, delivery confirmation, login history, and prior order patterns for every transaction. Card network programs like Visa's Compelling Evidence 3.0 reward merchants who show up with transaction-level evidence, not generic rebuttal letters.
Improve your billing descriptors so cardholders recognize the charge on their statement. Many first-party misuse cases start because a customer doesn't recognize a charge or can't get a fast answer from customer service.
Build a proactive refund process that's easier to access than filing a chargeback. Closing that gap before the customer calls their bank is cheaper than winning the dispute later.
The tradeoff:
You'll improve your dispute win rate, but you won't reduce the volume of chargebacks hitting your queue. Merchants win 45% of represented chargebacks but net only an 18% recovery rate once fees and time are factored in. Even when you win, you're still paying for analyst time and network fees.
Path C: Split Resources Based on Transaction Risk Tier
Choose this path when you're dealing with both true fraud and first-party misuse in meaningful volume.
When to choose this:
- Your fraud queue shows a mix of stolen credentials and legitimate customers disputing legitimate orders
- You have the tooling to segment transactions by risk score in real time
- You can route different risk tiers to different workflows
What this looks like operationally:
Use a fraud scoring system that rates transactions on a 1-to-100 scale. Low scores indicate trustworthy transactions; high scores indicate likely fraud. Set different thresholds for different actions.
For low-risk transactions, collect evidence automatically but don't add friction. If a dispute lands later, you'll have what you need to fight it.
For mid-tier risk, apply lightweight challenges and prepare stronger evidence collection. These are the transactions where you're not sure if it's fraud or a legitimate customer with an unusual pattern.
For high-risk transactions, block or hold for manual review. These are the ones where device signals, velocity checks, and behavioral analysis all point to fraud.
The tradeoff:
You need more sophisticated tooling and clearer internal workflows. Analysts need to know which queue they're working and what evidence standard applies. But you'll allocate resources more efficiently than a one-size-fits-all approach.
Summary Matrix
| Your Primary Problem | Best Path | Key Metric to Track |
|---|---|---|
| True fraud from stolen credentials | Upstream prevention | Approve rate vs. fraud rate |
| First-party misuse and policy abuse | Dispute management | Dispute win rate and recovery rate |
| Mixed fraud types in high volume | Risk-based segmentation | Chargeback rate by risk tier |
| Approaching network thresholds | Immediate upstream blocking | Monthly chargeback-to-transaction ratio |
| High cart abandonment after adding friction | Risk-based friction with lighter challenges | False positive rate |
Track these metrics monthly, not quarterly. Fraud patterns shift faster than your annual planning cycle. A workflow tuned for last year's attack pattern won't catch this year's.
