Payment Fraud Prevention
Identify manipulated mobile clients at checkout. Reduce exposure to automated use of stolen payment data alongside your processor’s fraud and chargeback controls.
The loss extends beyond the transaction.
Stolen card numbers and payment details are sold in batches, then fed into automated checkout attempts. Some attempts test whether a card works; others place fraudulent orders. The merchant may ship the goods before the cardholder disputes the payment—and an approved sale becomes a chargeback.
The Federal Reserve’s debit card study shows both the long-term fraud burden and who bears it. These historical figures cover reporting issuers subject to Regulation II, not all payment fraud or AI-related fraud.
Debit card fraud loss rate
Losses as a share of transaction value · basis points
The long-term burden rose; recent growth was small.
Selected years; values rounded as in the report. One basis point is 0.01%. Covers debit and prepaid transactions reported by covered issuers, whose experience may differ from other issuers.
Board of Governors of the Federal Reserve SystemHighlights & Figure 13View underlying data
| Category | Value |
|---|---|
| 2011 | 7.8 bp |
| 2021 | 17.5 bp |
| 2023 | 17.6 bp |
Who absorbed the losses?
Share of reported debit card fraud losses · 2023 · %
Merchants carried almost half of reported losses.
Loss allocation across all transaction types reported by covered issuers. This is a share of losses, not the probability a payment is fraudulent or a statement about chargeback liability in every case.
Board of Governors of the Federal Reserve SystemHighlights & Figure 17View underlying data
| Category | Value |
|---|---|
| Merchants | 49.9% |
| Issuers | 28.3% |
| Cardholders | 21.8% |
An established market, with more automation behind it.
The trade is established: in 2025, the Justice Department seized domains tied to BidenCash, a marketplace it said trafficked more than 15 million payment card numbers and associated personal information. Underground listings may group stolen data by BIN—the issuer identifier at the start of a card number. A BIN alone is not a stolen card.[4][3]
Automated card testing already operates at scale. AI adds cheaper fictitious profiles and more convincing messages around the fraud, as described by the FBI. It can lower the effort needed to sustain an operation, but the charts above do not isolate AI’s contribution.[3][2]
Intervene before the order becomes a dispute.
The cost is not limited to the order value. Card-testing bursts can generate processing charges even when transactions fail. Successful fraudulent orders can bring chargebacks, investigation work, and losses after fulfillment. PCI SSC and NCFTA describe financial and reputational impacts across the payment chain.[3]
Cipherstep adds a client-integrity checkpoint to your integrated mobile checkout. The Attestation SDK seals device and runtime observations for server-side analysis. Your backend can reject a manipulated client or route uncertain findings for review before authorizing the order. RASP can interrupt supported instrumentation inside the app.
Combine those findings with payment authentication, transaction velocity, card and recipient risk checks, and your processor’s fraud controls. Cipherstep assesses the client; it does not verify card ownership or replace chargeback management. A stolen card used through a clean app still needs transaction-level scrutiny.