Digital commerce brands lost an estimated $48 billion to fraud in 2025, and refund and policy abuse just displaced payment fraud as the top threat merchants report, according to the Merchant Risk Council’s 2026 Global eCommerce Payments & Fraud Report.
For every dollar of confirmed fraud, U.S. merchants now absorb $5.13 in total cost once chargeback fees, labor, and lost merchandise are counted. This is up from $4.61 from 2025. Trust and safety teams at retail ecommerce brands are defending against a faster, more automated adversary, and static rules and manual review queues were never built for that fight.
Why digital commerce brands are fraud’s biggest target right now
Retail ecommerce brands sit at the intersection of everything digital criminals want: stored payment methods, loyalty points, gift card balances, and a checkout flow designed to remove friction, not add it. That combination makes online retailers a more efficient target than almost any other digital business.
Recently, generative AI has widened the gap even further. TransUnion’s H1 2026 Top Fraud Trends Report found that nearly 7% of global fraud activity now involves deepfake AI, used to fabricate identities or bypass verification checks during account creation. The same report found that 8.3% of digital account creation attempts in 2025 were suspected of fraud, the highest-risk stage across the entire consumer lifecycle. Fraudsters are not waiting until checkout to attack. They are building fraudulent accounts early, aging them, and cashing out later when a store’s defenses are focused elsewhere.
The fraud types draining ecommerce margins today
Payment fraud remains a constant pressure, with stolen card testing, first-party fraud, and synthetic payment credentials all hit revenue directly. But three other categories deserve equal attention from fraud analysts building a digital commerce strategy.
Account takeover lets a fraudster log in as a legitimate customer, drain stored balances, and place orders using saved payment details, often without triggering a single payment-level rule.
Promotion and loyalty abuse exploits sign-up bonuses, referral codes, and reward points at a scale that manual review teams cannot keep up with.
Returns and refund abuse has grown so fast that the National Retail Federation’s 2025 Retail Returns Landscape report puts it at roughly $76 billion in losses for the year, with about 9% of all retail returns now fraudulent. Tactics like empty-box returns, wardrobing, and overstated quantities are increasingly organized rather than opportunistic.
Why rules and manual review can’t keep pace with digital commerce
Static rules aren’t effective, because they simply catch what has already happened. A rule built around last quarter’s attack pattern does little against a fraud ring that changes its device fingerprints, shipping addresses, or card testing cadence on a weekly basis. Every new rule also risks catching legitimate customers in its net, which can result in driving them away.
Manual review has its own ceiling. Retail ecommerce brands see order volume spike hard around major sales events, and a review queue sized for an average Tuesday cannot scale to Black Friday without either massive headcount or unacceptable delays. Analysts end up triaging by gut feel under time pressure, which is exactly the condition fraud rings are built to exploit.
Fraud rings also test defenses before committing to an attack. A small batch of low-value transactions probes which rules trigger a decline and which slip through without being flagged. Once a gap is found, the same ring returns days later with automated scripts running that pattern at a large volume. A fraud prevention program built only on rules written after the last incident will always be reacting to an attack that has already moved on.
What fraud prevention for digital commerce and retail ecommerce brands actually requires
Effective fraud prevention for digital commerce has to cover the full customer journey, with everything connected in one risk picture, not just the payment page. That means there needs to be visibility into account creation, login behavior, browsing patterns, checkout, and even post-purchase actions like refund requests.
This is where Sift’s approach to fraud prevention is built for retail ecommerce specifically. Sift assesses thousands of signals across the user journey, including device signals, behavioral patterns, and network-level data shared anonymously across thousands of merchants, and aggregates them into a Sift Score from 1 to 100, where 1 indicates trustworthy behavior and 100 signals likely fraud. Payment Protection targets card testing and payment fraud in real time. Account Defense identifies account takeover attempts before a fraudster ever reaches checkout. Content Integrity flags fraudulent listings, reviews, and promo abuse that can quietly erode customer trust. Analysts work these signals inside the Sift Console, where Queues prioritize the orders and accounts that actually need a human look, and Insights turns that activity into reporting the business can act on.
Balancing fraud prevention with checkout conversion
Every retail ecommerce brand faces the same tension: tighten fraud controls too much and legitimate customers get declined or interrupted at checkout, loosen them and fraud losses climb. Neither outcome is acceptable to a growth-focused commerce team.
Risk-based friction resolves that tension by applying step-up verification only where risk actually warrants it. A returning customer on a recognized device with a clean history checks out without interruption. A new account attempting a high-value order from a mismatched location and a risky payment method gets an additional authentication step before the order ships. That precision matters more than blanket caution. Sift’s data shows that most transactions carry low fraud risk, so the goal is not more friction, but rather, the right friction applied to the right sessions at the right moment.
Metrics that prove your fraud prevention program is working
Trust and safety teams need numbers that hold up in a budget conversation.
Chargeback rate and gross fraud loss matter, but they tell only part of the story.
False decline rate matters just as much, since every wrongly blocked order is lost revenue the fraud team caused rather than prevented.
Manual review rate and average review time show whether analysts are spending their hours on genuine risk or repetitive noise.
Account takeover rate and refund abuse rate round out a picture that lets a fraud analyst show, in concrete terms, what the program is protecting and what it is costing to run.
These numbers don’t mean much in isolation. But a fraud analyst who can show a rising Sift Score accuracy rate alongside a falling manual review rate illustrates that the program is catching more fraud while asking less of the team and the customer. That is the argument that keeps a fraud prevention budget intact through the next planning cycle, and it is the argument every retail ecommerce brand should be prepared to make.
Is your fraud team struggling to catch fraud in time? If so, your team needs Sift. Sift uses advanced machine learning technology to spot and catch fraudsters before they can cause financial harm to your business. If this seems like a good fit for your business, you can schedule a free consultation today.
Frequently asked questions
Fraud prevention for digital commerce is the set of tools and processes retail ecommerce brands use to detect and stop fraudulent activity across the customer journey, including account creation, login, checkout, payment, and post-purchase actions like refunds. It combines real-time risk signals, machine learning, and analyst review to separate fraudulent behavior from legitimate customer activity without adding unnecessary friction.
Retail ecommerce brands face a wider mix of fraud types at once, including payment fraud, account takeover, promotion abuse, and returns fraud, often from the same fraud rings working multiple angles against a single store. High order volume, seasonal spikes, and stored payment credentials also make ecommerce a more attractive target than many other digital businesses.
The Merchant Risk Council’s 2026 Global eCommerce Payments & Fraud Report found refund and policy abuse displaced payment fraud as merchants’ top-reported threat, with a majority of merchants seeing first-party misuse rise. Generous, customer-friendly return policies designed to build loyalty have become an easier target than payment fraud for digital criminals who understand exactly where the rules are lenient.
