Payment fraud misuses cards, transfers, or checkout flows so value moves without a genuine authorization from the payer.
The focus is the payment instrument and the moment of payment, not every deception that can happen on a website.
How it works
A card can be used without the holder, a bank transfer can be pushed to an account the victim was tricked into trusting, or a checkout can be fed a test of many card numbers.
Those cases share a movement of money through a payment channel, which is narrower than a fake shop, a fake review, or a stolen identity used only to open mail.
Merchants and banks lose the value, the fees, and the customer relationship, and the payer may spend weeks reversing a transfer that friendly looking instructions caused.
Detection watches the payment event, while governance and management decide appetite and staffing, and those are separate jobs from naming this fraud.
Concrete examples
- A stored card is charged for digital goods in another country an hour after the cardholder's account email was changed.
- A finance clerk sends a real transfer to a new account because an invoice email copied the usual vendor and changed only the digits.
- A checkout is hit with many small authorization attempts that look like a search for which stolen card numbers still work.
Protective measures
- Step up checks when the payee, device, or shipping story is new relative to the amount.
- Confirm changes to payout accounts out of band before the next transfer is allowed to leave.
- Limit repeated authorization attempts that fail, because they often precede a successful fraudulent charge.
- Separate payment case handling from the forum that sets how much payment loss the organization will accept.
How CDPCaptcha helps
A proof of work challenge raises the cost of scripted payment abuse by forcing each automated checkout to spend computation before it proceeds.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.