eCommerce fraud is no longer a background cost of doing business. It is a fast-moving, AI-accelerated threat that is reshaping how merchants price risk, build checkout flows, and protect margin. Losses are climbing across nearly every merchant segment. The tactics driving those losses are shifting away from simple stolen-card fraud toward something far harder to catch.
Below, we break down the eCommerce fraud trends 2026 data actually shows. Plus, we’ll discuss the online payment fraud trends driving losses higher, and how the picture differs for different merchants.
Key Highlights
- AI enables automated, cross-platform attack playbooks for merchants to face.
- Account takeovers rise as stolen credentials target eCommerce accounts.
- Card testing attacks threaten a large share of global merchants.
- First-party fraud surges as legitimate customers dispute post-purchase valid orders.
- Synthetic identity fraud grows rapidly using real and fabricated info.
- Fraudsters abuse promotional incentives by creating fraudulent new user accounts.
- Ghost tapping links physical card-present fraud to online risk models.
The State of eCommerce Fraud in 2026
eCommerce fraud losses are still rising even as prevention spending increases. The 2026 Global eCommerce Payments and Fraud Report from the Merchant Risk Council and Visa Acceptance Solutions surveyed more than 1,100 merchants across 35-plus countries and found that fraud, chargebacks, and policy abuse remain top-of-mind concerns across SMB, mid-market, and enterprise segments alike.
A few figures put the scale in perspective. Global credit card fraud alone is estimated to reach $43 billion by the end of 2026, and merchants now lose roughly $4.61 for every $1 of actual fraud once chargebacks, fees, and operational costs are factored in. Ravelin’s Global Fraud Trends 2026 report, based on a survey of 1,504 merchants in 10 countries, describes 2026 fraud as potentially stabilizing but costlier, meaning attack volume may be leveling off while the cost per successful attack keeps rising.
Fraud is not a problem merchants can solve once and move past. It requires ongoing investment. Plus, those who treat it as a fixed cost rather than an evolving risk are the ones absorbing the losses.
Top Online Payment Fraud Trends Shaping 2026
Several online payment fraud trends are showing up across nearly every industry report this year, and they tell us that fraud is becoming more automated, identity-driven, and harder to separate from legitimate customer behavior. Here are key trends related to online payment schemes you need to watch out for.
1. Fraudsters are using AI to power automated, cross-platform attack playbooks.
Adyen’s 2026 fraud report describes fraud as operating like repeatable, automated playbooks that are tested on one platform and quickly redeployed across others. In Veriff’s Fraud Industry Pulse Survey 2026, 74% of respondents reported an increase in online fraud year over year, 75% specifically pointed to more artificial intelligence (AI)-driven fraud attacks, and 78% expect the threat to keep growing through 2026.
It is clear that a defense tuned to yesterday’s attack won’t hold for long. Because these playbooks are built to be redeployed the moment they’re blocked in one place, merchants get more value from adaptive, machine-learning-based fraud detection that updates itself against new patterns. Sharing threat intelligence across platforms and payment partners also helps close the gap.
2. Account takeover attacks are rising sharply as stolen credentials get tested against eCommerce accounts at scale.
TransUnion’s H1 2026 fraud trends report found a 37% year-over-year increase in the suspected digital fraud rate tied to account takeover. Stolen credentials from breaches are tested against eCommerce accounts at scale, often using the same automation fraudsters use for card testing.
A few defenses are worth prioritizing given how this attack works, such as rate-limiting on login attempts to slow down automated credential stuffing, mandatory multi-factor authentication, and device-fingerprinting or behavioral analytics that can flag a login as suspicious even when the password is correct. Monitoring for unusual login velocity from a single IP range or device cluster is also a strong early-warning signal, since that pattern is a near-universal fingerprint of credential-stuffing tools.
3. Card testing continues to threaten a large share of global eCommerce merchants.
Mastercard research shows that roughly a third of global eCommerce merchants face active card-testing attacks, where small transactions are used to validate stolen card numbers before larger purchases follow.
So what can a merchant actually do about it? Start by making small, low-value transactions harder to automate. Then add velocity checks that flag a burst of low-dollar authorizations from the same card, IP, or device, as well as CAPTCHA on checkout after repeated failed attempts. Treat address verification (AVS) or CVV mismatches as an automatic block rather than a soft warning. Some merchants also disable or tightly cap $0 or $1 authorization-only transactions, since these are a favorite tool for testing whether a stolen card is still active.
4. Post-purchase and first-party fraud have become the fastest-growing fraud category.
Shopify’s guide to eCommerce fraud management in the AI era identifies first-party fraud, where a legitimate customer disputes a transaction after receiving the goods, as the fastest-growing fraud category for 2026.
In practice, this means the fight shifts from the payment page to the post-purchase experience. Delivery confirmation with photo evidence, signature-required shipping for higher-value orders, and clear, easy-to-find return policies all reduce the ambiguity that first-party fraud relies on.
Compiling a documented evidence trail (e.g., order confirmations, tracking data, delivery proof, and customer communications) also puts merchants in a far stronger position when disputing illegitimate chargebacks. Some merchants now even use dedicated chargeback-representment tools, like Chargeflow.io, to automate that evidence gathering.
Latest eCommerce Fraud Trends and Emerging Risks
Several emerging patterns are gaining attention as the latest eCommerce fraud trends heading into 2027. Among others is the rise of synthetic identity fraud, buy-now-pay-later services, and real-time payment rails is giving bad actors new avenues to exploit before merchants can react. Learn about these trends below.
5. Synthetic identity fraud is one of the fastest-growing categories merchants face.
Fraudsters combine real and fabricated personal information to build identities that pass traditional verification checks, then use them to open accounts, exploit promotions, or apply for buy-now-pay-later credit. Deepfake and voice-cloning technology is also lowering the barrier for social engineering attacks aimed at customer service teams and account recovery flows.
Because synthetic identities are built to pass checks that only verify individual data points, merchants need verification that looks at the whole picture rather than one field at a time. On the customer-service side, staff handling account recovery or high-risk requests should be trained to recognize social-engineering red flags. They should also have a verification protocol that doesn’t rely solely on voice or visual confirmation.
6. Promotional and new-account abuse is climbing as fraudsters chase sign-up incentives rather than existing accounts.
Rather than targeting existing accounts, fraudsters increasingly create new accounts with stolen or synthetic identities specifically to exploit sign-up bonuses, referral programs, and first-order discounts. 13.5%, or roughly 1 in 7, of all newly created accounts were suspected to be fraudulent, making account creation the riskiest step in the customer journey, with promotion abuse cited as one of the key motives behind this type of new-account fraud
Merchants can respond by tightening the rules around what triggers a promotion in the first place. These actions could be limiting sign-up bonuses to one per verified device, IP address, or payment method. You can also add friction (like phone or email verification) before a discount code activates rather than after.
Plus, watch for clusters of new accounts that share subtle similarities, like near-identical shipping addresses or emails generated from the same pattern. Capping the value of first-order discounts, or delaying their redemption until after a return window closes, also reduces the payoff for abuse or loyalty fraud.
7. Ghost tapping is bringing physical card-present fraud signals into online risk models.
Shopify’s report describes ghost tapping, where stolen card credentials are validated through small near field communication (NFC)-based charges, noting that the same stolen credentials frequently surface later in online fraudulent transactions, which means card-present and card-not-present fraud signals are becoming more connected than they used to be.
Looking ahead, this trend is a reminder that in-store and online fraud teams can no longer operate in separate silos. Merchants with both physical and digital storefronts should look for fraud-detection platforms that pool card-present and card-not-present data into a single risk score. That way, a card flagged for a suspicious NFC test in-store is automatically treated as higher-risk for online purchases too.
Even merchants who are purely online stand to benefit from working with payment processors or card networks that share this kind of cross-channel signal. Remember, a stolen card validated through ghost tapping may show up on their platform next.
Enterprise Merchants Vs. Small Business Merchants: How Fraud Risk Differs
The different types of fraud do not hit every merchant the same way. Enterprise merchants and small business merchants face different attack patterns, carry different cost burdens, and typically respond with different tools, largely because of the resources and data each has available.
Small businesses are frequently targeted precisely because they tend to lack advanced fraud tooling and dedicated manual review staff, a pattern noted in the small-business fraud research from FAU’s Center for Forensic Accounting. It showed that smaller organizations report a higher median fraud loss than larger ones, partly due to weaker internal controls.
Enterprise merchants, on the other hand, face fraud that is more systematic and automated, with Adyen’s 2026 report noting that businesses with access to larger, high-quality transaction datasets are generally better positioned to spot and prevent fraud proactively. This is even as attackers scale the same tactics across their platforms and brands.
| Factor | Enterprise Merchants | Small Business Merchants |
|---|---|---|
| Annual revenue spent managing fraud | Around 12% of eCommerce revenue | Around 12% of eCommerce revenue |
| Primary fraud pattern | Automated, cross-platform attack playbooks reused across brands | Card testing, account takeover, and stolen-identity purchases |
| Detection resources | In-house fraud teams, large proprietary datasets, custom rules | Limited staff; heavy reliance on third-party fraud tools |
| Biggest vulnerability | Fraud blending in with legitimate high-volume customer behavior | Weak internal controls and thin fraud-review capacity |
| Typical fraud tooling approach | Custom-built or heavily configured enterprise fraud platforms | Off-the-shelf, third-party fraud prevention services |
Spend figures based on Demandsage’s compilation of Statista data.
The practical difference comes down to scale and data. Enterprise merchants fight fraud engineered to look like normal customer behavior across a large footprint, while small business merchants more often face a resource gap, so the right prevention strategy looks very different depending on which side of that line a merchant sits on.
How Merchants Can Respond to These Trends
Understanding the trends is only useful if it changes how a merchant operates day to day. Fortunately, the same reports that document rising fraud losses also point to a fairly consistent set of responses that are working across merchant sizes.
- Layer identity verification instead of relying on a single check. Synthetic identity and account takeover fraud both depend on passing a single verification step, so device and IP intelligence combined with behavioral analytics help close the gap that traditional card-not-present verification leaves open.
- Extend fraud strategy beyond the payment moment. Merchants are being urged to cover the full customer journey, including returns, refunds, and policy abuse, since post-purchase fraud is now rivaling payment fraud in cost.
- Monitor chargeback ratios closely. This matters more in 2026 than in past years given tightening thresholds under card network monitoring programs.
- Match the tooling approach to merchant size. Smaller merchants tend to benefit from third-party fraud prevention services that pool data across many stores, while larger merchants often get more value from custom-built systems tuned to their own transaction history.
The merchants seeing the best outcomes in 2026 treat fraud protection and prevention as a continuous cycle of testing, calibrating, and adjusting, rather than a static rule set installed once and left alone.
The Bottom Line
Fraud is evolving faster than many merchants’ defenses. Online payment fraud trends are shifting from simple stolen-card fraud toward AI-assisted, identity-driven attacks that are harder to distinguish from real customers. Merchants that invest in layered verification, extend fraud prevention across the full customer journey, and treat fraud strategy as an ongoing process are better positioned to protect both revenue and customer trust.
Frequently Asked Questions
Charity Amancio
Charity Amancio specializes in SaaS solutions for global eCommerce businesses, including payments and risk management applications. She bridges the gap between technology and merchant needs, offering practical perspectives on the tools shaping eCommerce. Her insights appear regularly in B2B publications covering the digital commerce space.
