Cyber fraud is any scheme that uses the internet, email, text messaging, phone networks, or other digital systems to trick a person or business into handing over money, data, or account access. It most often shows up as phishing, account takeover, business email compromise, card testing, brand impersonation, and stolen card purchases that later turn into chargebacks. Merchants that treat it as a shared problem across security, payments, and customer service teams catch attacks earlier and lose less when one gets through.
What Is Cyber Fraud?
Cyber fraud sits where cybercrime and fraud overlap. Cybercrime covers attacks on systems, such as malware or network intrusions, while fraud covers deception for financial gain. Fraud in cyber security terms means using digital access or digital deception to steal value: a phishing email that captures an admin password, a spoofed supplier invoice that redirects a payment, or a bot that tests thousands of stolen card numbers at checkout.
The FBI tracks this category directly. Its 2025 Internet Crime Report counted 452,868 cyber-enabled fraud complaints with $17.697 billion in losses, which represented 45% of all complaints and 85% of all reported losses for the year.
How Cyber Fraud Differs From Traditional Fraud
Digital fraud moves faster and scales further than in-person schemes. One attacker can send millions of phishing messages, run automated credential stuffing against every login page they find, or rent ready-made tools sold as fraud-as-a-service kits. Artificial intelligence is adding to that scale: the 2025 IC3 report included an AI section for the first time, linking 22,364 complaints to nearly $893 million in losses.
Common Types of Cyber Fraud Targeting eCommerce Merchants
Most attacks against online stores fall into a handful of patterns. The table below summarizes the ones merchants report most often and how each affects the business.
| Fraud type | How it works | Impact on merchants |
|---|---|---|
| Phishing and spoofing | Fake emails, texts, or sites capture logins or payment details | Compromised admin, payout, or platform accounts |
| Business email compromise (BEC) | Attackers impersonate a supplier, executive, or partner to redirect payments | Direct wire or ACH losses that are hard to recover |
| Account takeover | Stolen credentials are used to access customer or staff accounts | Fraudulent orders, stolen loyalty points, data exposure |
| Card testing and stolen card fraud | Bots test stolen card numbers, then make full purchases | Fraud chargebacks, fees, and processor scrutiny |
| Brand impersonation | Scammers pose as your store to target your customers | Lost trust, support costs, and disputes blamed on you |
| Ransomware and extortion | Malware locks systems or criminals threaten to leak data | Downtime, recovery costs, and regulatory exposure |
Phishing and Spoofing
Phishing and spoofing were the most reported crime type in the 2025 IC3 data, with 191,561 complaints. For merchants, the targets are usually staff with access to the store admin, payment processor dashboard, ad accounts, or marketplace seller accounts. Training employees on how to spot a phishing scam remains one of the cheapest controls available.
How AI is changing phishing attacks
Generative AI removes the spelling mistakes and awkward phrasing that once gave phishing away. Attackers can now write convincing messages in any language, clone a supplier’s writing style, and produce realistic voice messages, so verification steps matter more than spotting typos.
Business Email Compromise
BEC attacks target the money moving out of your business rather than into it. A fraudster spoofs or compromises an email account belonging to a vendor, executive, or logistics partner, then asks for a change in bank details or an urgent payment. IC3 recorded 24,768 BEC complaints and about $3 billion in losses in 2025, and the FBI noted that AI-assisted BEC alone cost businesses more than $30 million. MFJ has covered how business email compromise schemes also use gift card requests to cash out.
Account Takeover
Account takeover fraud happens when criminals log in to real customer or staff accounts using stolen or guessed credentials. Customer account takeovers lead to fraudulent orders shipped to new addresses and drained stored value, while staff account takeovers can expose payout settings and customer data.
Card Testing and Stolen Card Fraud
Credit card fraud in cyber security terms usually starts with stolen card data from breaches, skimming, or phishing. Fraudsters run small test transactions to see which cards work, then use the valid ones for larger purchases or triangulation fraud schemes. The merchant ships the goods and absorbs the loss when the real cardholder files a fraud chargeback, which is why teams that fight fraudulent chargebacks need clean transaction and device data.
Brand Impersonation
Scammers increasingly pose as known businesses to reach customers directly. The FTC reported that imposter scam losses reached $3.5 billion in 2025, including nearly $1 billion lost to business impersonators. When a scammer uses your brand, your support team fields the complaints and your store can receive the disputes.
The Cost of Cyber Fraud for Online Businesses
Direct theft is only part of the cost. Each successful attack can bring chargeback fees, lost merchandise, staff time spent on investigations, higher processing rates, and possible penalties from card network monitoring programs.
Consumer data shows the pressure on the wider market: according to FTC testimony to Congress, consumers filed 3 million fraud reports and reported $15.9 billion in losses in 2025, up from just over $12 billion the year before. Shoppers who have been scammed are more cautious, and some file friendly fraud disputes when they do not recognize a legitimate charge.
Cyber Fraud Detection: Signals Merchants Should Watch
Effective cyber fraud detection depends on connecting signals that usually live in separate tools. Watch for these patterns across checkout, login, and back-office systems:
- Spikes in small or failed authorizations from the same device, IP range, or BIN, which often point to card testing.
- Logins from new devices or locations followed quickly by password, email, or shipping address changes.
- Orders where billing and shipping details, IP location, and device data do not match, especially for high-resale items.
- Requests to change supplier bank details or payout accounts, particularly when they arrive by email with urgency.
- Lookalike domains, fake social profiles, or search ads using your brand name.
Any one of these signals can have an innocent explanation, and treating each in isolation tends to produce either missed attacks or a flood of false declines that frustrate legitimate customers. The real value comes from correlating these signals across systems, so that a password reset, a new shipping address, and a high-value order from an unfamiliar device are seen as one risky sequence rather than three unrelated events.
Cyber Fraud Fusion: Connecting Security and Fraud Teams
Cyber fraud fusion is the practice of combining cybersecurity and fraud prevention data, tools, and teams so that one group’s signals inform the other’s decisions. A phishing campaign spotted by IT should trigger tighter login and payout checks by the fraud team, and an account takeover spotted by the fraud team should prompt a security review. Smaller merchants can apply the same idea by assigning one owner to review security alerts and fraud alerts together each week.
Cyber Fraud Prevention Checklist for Merchants
Good cyber fraud prevention uses several layers, so one failed control does not expose the whole business. These steps cover the most common attack paths.
1. Lock Down Accounts and Payouts
Require multifactor authentication or passkeys on every admin, processor, marketplace, and email account. Limit admin permissions to the staff who need them, remove access when people leave, and turn on alerts for any change to payout or bank details.
2. Verify Payment Requests Out of Band
Confirm every new or changed bank detail by calling a phone number you already have on file, never one listed in the request. This single step blocks most BEC attempts, including those written by AI.
3. Screen Transactions in Layers
Combine 3-D Secure, AVS and CVV checks, device fingerprinting, velocity rules, and bot management at checkout. Rate-limit login and payment endpoints to slow card testing and credential stuffing.
4. Protect Your Brand From Impersonators
Set up SPF, DKIM, and DMARC on your email domains, monitor for lookalike domains and fake social accounts, and tell customers clearly what your business will never ask for, such as passwords or payment by gift card.
5. Review Cyber Fraud Insurance Coverage
Cyber fraud insurance can help cover losses from social engineering, funds transfer fraud, and data breaches, but coverage varies widely. Many standard cyber policies limit or exclude voluntary payments made after a BEC scam, so ask your broker specifically about social engineering coverage and sublimits.
6. Report Cyber Fraud Quickly
Report incidents to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov, and notify your bank immediately if money was sent. Fast reporting matters most for wire transfers, because funds are far easier to freeze in the first hours and days. Strong cyber fraud protection includes a written incident plan so staff know who to call before an attack happens.
Make Cyber Fraud a Shared Priority This Quarter
Cyber fraud now drives the majority of reported internet crime losses in the U.S., and eCommerce merchants sit directly in its path through their logins, payouts, checkout pages, and brand. Start with the controls that block the most attacks for the least effort: multifactor authentication on every account, out-of-band verification for payment changes, layered checkout screening, and a single owner who reviews security and fraud alerts together. Merchants that close these gaps now will spend less time cleaning up losses and chargebacks later.
Frequently Asked Questions
Charity Amancio
Charity Amancio specializes in SaaS solutions for global eCommerce businesses, including payments and risk management applications. She bridges the gap between technology and merchant needs, offering practical perspectives on the tools shaping eCommerce. Her insights appear regularly in B2B publications covering the digital commerce space.