Fraud Prevention in European Payment Systems: A Technical Guide

Fraud Is a Systems Problem

Payment fraud is not solved by a single tool or rule. It requires layered defenses that work together, each catching what the others miss. For European payment systems, the regulatory environment (PSD2, SCA) provides a baseline, but you still need application-level protections.

Types of Payment Fraud

Card Testing

Fraudsters use stolen card numbers to make small test transactions before attempting larger ones. Signs: rapid low-value transactions from the same IP or device.

Account Takeover

Compromised credentials used to access legitimate accounts and change payment methods. Signs: password reset followed by payment method change, new device.

Friendly Fraud

Legitimate customers who dispute valid charges. The hardest to prevent because the original transaction is genuine.

Synthetic Identity Fraud

Fabricated identities combining real and fake information. Common in subscription services with free trial periods.

Layered Defense Architecture

Layer 1: Pre-Authorization Checks

Before sending a transaction to your PSP:

class FraudCheckPipeline {
    private array $checks = [
        VelocityCheck::class,
        GeoLocationCheck::class,
        DeviceFingerprintCheck::class,
        EmailReputationCheck::class,
        AmountThresholdCheck::class,
    ];

    public function evaluate(Transaction $tx): FraudScore {
        $score = new FraudScore();
        foreach ($this->checks as $check) {
            $result = app($check)->check($tx);
            $score->addSignal($result);
        }
        return $score;
    }
}

Layer 2: Velocity Controls

Track transaction frequency per customer, IP, card, and device:

• Max 3 payment attempts per card per hour
• Max 5 payment attempts per IP per hour
• Max 1 new payment method per account per day
• Increasing delays after failed attempts

Layer 3: SCA as a Defense

Strong Customer Authentication (3D Secure 2) shifts liability for fraud to the card issuer. For transactions that require SCA, the issuer authenticates the cardholder. Use SCA strategically:

• Always apply SCA for first transactions with new customers
• Request SCA exemptions only for trusted, returning customers
• Monitor exemption decline rates per issuer

Layer 4: Post-Authorization Monitoring

After payment succeeds, continue monitoring:

• Unusual download or access patterns
• Immediate plan upgrades after signup
• Geographic mismatches between billing and usage
• Multiple accounts from the same device

Practical Implementation

1. Start with velocity checks. They catch the most common fraud patterns with minimal complexity.
2. Log everything. Fraud investigation requires complete transaction histories including IP, device, and behavioral data.
3. Use your PSP's tools. Mollie, Stripe, and Adyen all offer fraud scoring. Layer your own checks on top.
4. Review manually at first. Understand your fraud patterns before automating responses.
5. Track false positives. Blocking legitimate customers costs more than most fraud losses.

The best fraud prevention system is invisible to legitimate customers and impenetrable to fraudsters. Start with simple velocity checks and manual review, then add sophistication as your transaction volume grows and patterns emerge.