The first line of defence
Canadian merchants dealing with card not present fraud should turn on checks for online payments before a risky order ships.
- AVS matches the billing address to the card.
- CVV confirms the buyer has the physical card.
- 3-D Secure (Visa Secure, Mastercard Identity Check) adds bank-side verification and can shift liability for fraud.
These three catch a large share of fraud with little friction for legitimate customers.
Smart rules and screening
Add velocity rules that limit attempts per card or IP, flag unusually large orders, and screen device and IP signals. These rules quietly stop patterns that show up on card-not-present sales: a burst of tries from one address, a rush ship-to you have never used, or a caller pushing you to skip the postal code. Set the limits for bursts and outliers so a normal shopper is unlikely to trip them. Watch what the rules hold back, and loosen a rule that blocks good wallet payments. Save manual review for the orders the rules actually flag, and ship after those checks pass.
Reduce chargebacks proactively
Use a clear billing descriptor so customers recognize the charge as your store, not an unfamiliar processor name. Fulfil and ship promptly, send the receipt when you capture, and send tracking when the order leaves. Keep records of authorization, including the AVS result, with the order. Many chargebacks are friendly fraud or simple confusion, and clarity plus a file prevents them. For a booking deposit, the receipt should say deposit and the appointment date. A vague "online payment" and a silent week are how a real buyer disputes a real charge. The descriptor and the delivery note are part of the defence.
Balance security and conversion
Over-aggressive rules block real sales, including wallet payments from customers you want. Tune thresholds, and reserve manual review for genuinely risky orders: a new address, an unusual amount, or a failed AVS result the buyer wants ignored. Vault cards for trusted repeat buyers so they are not challenged on every return. Layer the stronger checks on the higher-risk tickets and leave an ordinary cart alone. Armour Payments includes fraud tools across online payments. Talk to sales to configure them for your ticket size and for the mix of phone orders and store checkout you actually run.
A phone order for a rush delivery
A caller asked for same-day delivery to an address you have never shipped to, and wanted to pay by reading a card over the phone. The amount was larger than your usual ticket, and the caller pressed the clerk to skip the postal-code check. That order waits. Run CVV and AVS before anyone picks the goods. For a higher amount, step up to 3-D Secure so the bank can verify the buyer and, when it completes, shift liability. A burst of attempts from one IP in a short window gets the same pause. Ship after the checks pass, and keep the authorization record with the order. The tool set is on online payments. Keying the card itself is covered in what a virtual terminal is.
Descriptor and delivery notes that prevent a false dispute
A genuine buyer disputed a charge because the statement name was the processor, and the parcel sat for a week with no tracking email. That dispute still costs the sale even when the buyer was real. Set the billing descriptor to the store name people see in your inbox. Send the receipt when the payment is captured. Send tracking when the order ships. For a booking deposit, the receipt should say deposit and the appointment date, not a vague "online payment." Keep the AVS result on the order. Review the risky ones by hand, and leave repeat buyers in a vault so they are not challenged on every return visit. Configure the stack with sales. The checkout side, so the extra check is not a wall of fields, is in high-converting checkout.