Early Fraud Warning

An early fraud warning is a notification to a merchant that a card transaction it processed has been reported as fraudulent by the cardholder's issuer. The warning usually arrives before any chargeback is raised, and sometimes no chargeback follows at all. It gives the merchant the chance to refund the payment, cancel unshipped orders, block the customer or card and review related transactions. The term is used particularly by payment providers that pass network fraud reports to their merchants.

Early fraud warnings are based on the fraud reporting systems run by the card networks. Issuers are required to report confirmed fraud on their cards, through Visa's fraud reporting (often referred to by the name of its report, TC40) and Mastercard's equivalent system, historically known as SAFE. These reports feed the networks' fraud monitoring programmes. Early fraud warnings differ from dispute alerts, which come from issuer-merchant collaboration networks and may cover non-fraud disputes as well.

1. A cardholder tells their issuer that they did not make a transaction, or the issuer's own systems detect fraud.
2. The issuer blocks the card and reports the fraudulent transaction to the card network.
3. The network records the report and makes it available to the acquirer.
4. The acquirer or payment provider passes the information to the merchant, often through an API or dashboard, as an early fraud warning.
5. Separately, the issuer may or may not raise a chargeback, depending on the amount, the liability rules and its own policies.

Because reporting is required regardless of whether a chargeback is raised, early fraud warnings can reveal fraud that would otherwise go unnoticed by the merchant until it showed up in network monitoring statistics.

• Avoiding chargebacks. Refunding a transaction after a warning usually prevents a later fraud chargeback, saving the chargeback fee and keeping the merchant's chargeback ratio lower.
• Stopping further losses. Fraudsters often place several orders with the same card, email address or device. A warning allows the merchant to cancel pending orders and block linked accounts.
• Improving fraud models. Warnings provide confirmed fraud labels that merchants can feed into fraud decisioning rules and machine learning models, improving future detection.
• Protecting standing with networks. Fraud reports count towards the networks' fraud monitoring thresholds, so understanding them helps merchants manage the risk of being placed in a programme.

Refunding does not remove the fraud report from network records, so it does not by itself reduce counts in fraud monitoring programmes, which are based on reported fraud rather than chargebacks.

Not every early fraud warning should lead to a refund. If goods have already been delivered and the merchant has strong evidence that the genuine cardholder made the purchase, such as authenticated 3-D Secure, a known device and a history of undisputed orders, it may prefer to keep the payment and contest any chargeback with compelling evidence. If the transaction was authenticated and liability has shifted to the issuer, the merchant may not need to refund, since a fraud chargeback should not succeed. For low-value orders and digital goods where evidence is weak, refunding is often the cheaper option. Many merchants set automated rules based on amount, fulfilment status and authentication outcome.

Early fraud warnings can arrive days or weeks after the transaction, by which time goods may already have shipped. Not all issuers report promptly or consistently, and some reports reflect friendly fraud, where the genuine cardholder falsely claims they did not make the purchase. Matching a warning to the right order requires accurate transaction identifiers. Warnings also cover only card payments on networks whose reports the acquirer receives, so they are not a complete view of fraud. They work best as one input among many in a merchant's fraud and dispute management processes.

Merchants that receive many warnings usually automate their response. A typical setup ingests warnings through the payment provider's API, matches them to orders, checks fulfilment status and authentication results, and then either issues a refund, flags the order for review or adds the card, email and device to a block list. Results are logged so that the team can measure how many warnings were followed by chargebacks and adjust rules over time.

Merchants often use early fraud warnings together with dispute alert networks such as Ethoca and Verifi, order information sharing services, and their own fraud screening. Combining these sources gives broader coverage and earlier notice, allowing merchants to act on more fraud before it turns into chargebacks or repeat losses.