Eric Kuvykin

Reviewed October 17, 2026. This operational guide replaces an earlier general overview. The original publication date and URL are retained.

A fraud rule that worked before a checkout change can behave differently afterward. Review the decision process with controlled comparisons rather than assuming every new decline is prevented fraud.

Freeze the change record

Record the checkout version, fraud configuration, payment methods and deployment time. Identify simultaneous changes such as a new wallet, shipping option or authentication setting. Keep a pre-change comparison period with similar order characteristics. A raw decline count is not enough when transaction volume or the customer mix also changes.

Inspect a bounded sample

Select approved, declined and manually reviewed orders using a documented method. Record the available reason category, authentication outcome, order value and eventual known result. Avoid collecting more personal data than the review requires. Flag uncertain outcomes as unknown; do not label every declined order fraudulent or every approved order legitimate just to make the report complete.

Distinguish authentication from the sale outcome

EMVCo describes 3-D Secure as supporting authentication for card-not-present payments. The merchant still needs to inspect the authorization result and its own order workflow. For example, a successful authentication followed by an authorization decline should not be counted as a completed sale. Nor should an authentication challenge abandoned by the customer automatically be classified as a fraud attempt.

Approve a reversible adjustment

If a pattern suggests a configuration problem, ask the provider to explain the relevant signal and test a narrow adjustment. Document the owner, rollback threshold and follow-up date before release. Compare approval, completed checkout, manual-review workload and subsequently observed losses; these measures can mature at different times. Keep a human review path for ambiguous high-impact cases. The aim is a defensible operating decision with recorded uncertainty, not a promise that a scoring tool eliminates fraud.

Sources and related reading

Primary reference: EMVCo’s 3-D Secure overview. The examples and workflows above are illustrative operational analysis, not reported client results.

Continue with the AMS New Jersey merchant reading path and merchant technology decision worksheet.