​Your Holiday Fraud Rules May Be Turning Away Your Best New Customers

Wayne Hamilton is CEO and co-founder of pmtbox, a payments and risk platform built to get ahead of fraud instead of reacting to it.

gettyEvery fall, I watch merchants get ready for the holidays by tightening up on fraud. Risk teams adjust their rules, lower their decline thresholds and add verification steps at checkout to get ahead of the attacks they expect between Thanksgiving and New Year’s. In the process, many end up turning away legitimate customers along with fraudsters.

The instinct makes sense, especially since merchants know the chargebacks from those sales won’t land until January and February, when returns come back and sales slow. Nobody wants to start the year with that kind of hangover on their books.

I’ve spent my career in payments, first running a merchant processing company and now building technology that brings payments, risk and data together for merchants. Over that time, I’ve seen how different holiday fraud looks once you measure it as a rate. While more fraud attempts do occur during peak season, legitimate volume grows so much faster that fraud usually makes up a smaller share of total transactions. TransUnion’s analysis of the 2023 holiday period found that 2.4% of U.S. e-commerce transactions from Thanksgiving through Cyber Monday were suspected fraud, compared with 4% for the rest of that year.

When merchants tune their tools for a threat that is larger in raw numbers but smaller as a proportion of sales, their good customers absorb the cost. Here’s how I’d encourage merchants to approach holiday risk this year.​

Seasonal fraud headlines focus on how many attacks merchants will face, and that count almost always climbs. Before reacting to it, merchants should check what share of last holiday season’s transactions actually turned out to be fraudulent and compare it with the rest of their year.

If the rate held steady or dropped, as it often does when volume surges, there’s little reason to treat the season as a special threat that calls for stricter rules.

A false positive, often called a false decline, is a legitimate order that gets rejected because it looks risky. Merchants hear about fraud through chargebacks, fees and processor warnings. A declined good customer generates none of those signals, and in my experience, many of those customers never come back.

Datos Insights estimates the industry average false decline rate at 1.51% of annual sales, based on its survey of U.S. e-commerce merchants. Few merchants track that number with the attention they give their fraud rate.

The holiday season brings in customers who don’t look like your usual buyers. Many have never purchased from you before, and some shop with you only once a year.

Gift buyers often ship to addresses that don’t match their billing information or place larger orders than they normally would. Those are the same patterns tightened fraud rules are built to catch, so the customers most likely to be flagged are often the new and seasonal shoppers a merchant spent its marketing budget trying to attract.

A good holiday season also brings in customers who keep buying the following year. When a first-time customer gets declined, the merchant loses that order and, very likely, any future orders from that customer. Holiday results come in lower than they should, and customer lifetime value takes a hit that carries into the new year.

• Compare last year’s holiday fraud rate against the rest of the year before changing any rules.

• Set a target approval rate for the season and review it weekly, the same way you would review chargebacks.

• Review how your fraud tool treats first-time customers, gift orders and mismatched shipping addresses.

• Ask your fraud provider how its model accounts for seasonal volume, and whether it can tell a busy day from an attack.

• Avoid reacting mid-season to raw attempt counts without checking what they mean as a percentage of sales.

Fraud will always be part of the holiday season. So will first-time customers who could become regulars, and a merchant’s fraud rules should be set with both in mind.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?