E-commerce fraud prevention: How to fight Black Friday fraud

What to watch out for in e-commerce ahead of Black Friday

Black Friday creates a difficult risk environment because genuine customer behavior changes at the exact moment transaction volumes spike.

During peak periods, genuine shoppers buy more frequently, spend more, and ship items to new addresses. When your fraud rules rely on strict, static rules, these normal holiday purchasing patterns can trigger false alarms.

Planning for Black Friday traffic requires understanding which transaction changes represent normal holiday shopping and which combinations of signals indicate actual fraud.

That being said, here are a few things to look out for:

• Traffic and transaction spikes: A massive surge in orders gives fraudsters a crowd of legitimate transactions to hide within. Your system must process high order volumes quickly without creating manual review backlogs that delay shipping.
• Unusual but legitimate purchasing behavior: Holiday shoppers frequently buy items outside their usual habits. They purchase higher-priced goods, place multiple orders in a short window, and send gifts to addresses that don't match their billing information.
• More first-time customers: Black Friday promotions attract new shoppers who've never bought from you before. Without previous purchase data to review, evaluating whether a new customer is genuine becomes much harder.
• Promotion abuse: Black Friday floods the market with discount codes, new-customer offers, and referral incentives all at once, which makes this the time of year fraudsters target them hardest.
• Faster fulfillment: Same-day delivery and buy online, pick up in store (BOPIS) compress your fraud team's reaction time year-round, and Black Friday's order volume makes that reduced window a much bigger liability.

7 e-commerce fraud prevention strategies

1. Establish a baseline for normal customer behavior

Identifying abnormal activity requires knowing what normal customer activity looks like across your store in the first place.

Review your historical order data to map out standard baselines for things like:

• Average order value and basket size
• Purchase frequency and order velocity
• Ratio of new versus returning customers
• Standard shipping and billing address alignment
• Chargeback rates across specific product categories
• Account login and profile update frequencies

Breaking these baselines down by product category is also helpful. A $500 purchase might be standard for high-end electronics, but it could indicate risk for basic apparel, for example.

Compare peak sales against past Black Friday data rather than regular shopping periods. Purchasing patterns that look suspicious on an average Tuesday are often standard during a major holiday sale.

2. Use layered signals to apply the right level of verification

One unusual detail about an order rarely tells you much on its own. What actually works is looking at several signals together, like identity, device, geolocation, behavior, and transaction details, so you're weighing the whole picture instead of overreacting to one red flag.

Say someone places an unusually large order. By itself, that's nothing: plenty of real customers buy a lot at once. But now add a brand-new device, account details that were just changed, and a request for rush delivery to an address you've never seen before, and that same order looks a lot different.

This is the whole point of step-up verification: not every shopper needs to jump through the same hoops. A returning customer buying something typical shouldn't hit the same friction as a brand-new account trying to push through a big purchase with a handful of things that don't quite add up.

Let your risk scoring assessment decide how much verification an order actually needs instead of running every customer through your toughest checks by default. When the signals do call for more scrutiny, that could mean multi-factor authentication (MFA), identity data checks, document verification, or biometrics.

 

Read more: Building adaptable verification workflows with KYC orchestration

3. Use velocity checks to catch unusual activity in real time

Velocity monitoring flags unusually high activity tied to an identity, device, payment method, address, or other attributes within a set window of time, such as:

• Several purchases tied to the same identity within minutes
• Multiple accounts sharing one device
• Repeated attempts across different payment cards
• Multiple orders heading to the same delivery address
• Quick account changes followed immediately by a purchase
• Repeated attempts to claim a one-time promotion

Coordinated attack networks often use different names and email addresses, yet share the same device fingerprint, IP address, or delivery location. Linking these shared signals in real time helps you stop automated promotion abuse and card-testing scripts before they cause more damage.

4. Look past your own customer and transaction history

A fraudster can look completely new inside your database, even if that same identity, device, or other detail has already caused problems somewhere else.

The issue is that your own data can only tell you so much about a customer.

Cross-industry fraud intelligence – shared risk signals, threat indicators, and behavioral patterns pulled from across different sectors – fills in that missing piece, giving you context your own transactions never could.

 

And this matters most with new customers, since that's exactly when you have the least history to go on. And it gets even more important during big promotions, when a wave of first-time shoppers means a lot more accounts you know almost nothing about.

Read more: How cross-industry intelligence stops fraud without hurting conversion

5. Aim to protect customer accounts from takeover with ongoing monitoring

Verifying a customer once doesn't mean their account stays safe forever. Even a long-trusted account can get hijacked.

Keep an eye out for the usual warning signs, like:

• A login from a new device or an unfamiliar location
• Several failed login attempts in a row
• A password or email reset (especially one followed right away by a purchase)
• Changes to stored payment or shipping info

When you spot any of these, ask for extra authentication in the moment, rather than waiting until checkout to confirm something's off.

 

Take a $500 order from a longtime customer. On a normal day, that barely registers. But that same order placed minutes after a password reset and a shipping address change? That's a completely different story, and likely worth stopping to check.

The login itself deserves just as much attention as what happens after it. Risk-based authentication or MFA can kick in when login activity looks unusual, while rate limiting (capping how many requests a single user can make in a given window) and bot detection help catch automated attacks.

6. Extend fraud prevention beyond checkout

Getting a payment approved doesn't mean the risk is over. Fulfillment, delivery and returns all open the door to different forms of abuse after checkout.

To prevent this, you can implement safety controls across your entire fulfillment workflow, such as:

• Require identity verification for high-value store pickup orders before handing over merchandise
• Flag order modification requests that change the delivery address right after payment approval
• Track return activity to identify accounts that repeatedly claim non-delivery or return incorrect items

 

7. Continuously test and optimize your fraud rules

Customers change, fraudsters adapt and your own products and sales channels keep evolving, too, so the rules you built six months ago might not be working anymore.

Every so often, take a look at your rules. Some are catching real fraud. Others could be throwing off a ton of false positives, sending too many genuine customers to manual review, or creating enough friction that people abandon their carts.

Track both sides of the equation: fraud metrics like loss rate and chargebacks, and customer-experience metrics like your false-positive rate, manual review rate, approval rate and checkout abandonment.

Do this review before a major event like Black Friday, so any rules already causing trouble don't get worse once volume spikes. Then keep watching performance while the event's underway, and do a proper review afterward to catch any new patterns that could be worth building into your rules going forward.

What does better fraud prevention for e-commerce look like?

Effective fraud prevention requires making accurate calls on every login, order and delivery request. You need to know if a buyer is who they claim to be, if their account is secure and whether an order requires extra review before shipping.

These calls get harder to make during peak periods like Black Friday, when the volume of new customers and orders makes it tougher to separate a genuine shopper from a risky one.

As an identity verification and KYC and KYB provider, we combine identity data with fraud intelligence and onboarding orchestration so you can watch for risk across the entire shopping journey – not just the moment someone enters a card number – and adjust the experience accordingly.

Here are three reasons retailers across the globe choose to work with us:

Confirm that new shoppers are genuine without slowing them down

The GBG Go platform gives you access to 110+ identity and fraud modules, so you can build different verification paths depending on what signals are available for a given shopper. That means a fuller picture of a first-time buyer in real time – not just whether their name and address check out, but whether their behavior and connection actually look like a normal customer or something worth a second look.

And since the workflow builder is no-code and drag-and-drop, adding or swapping out modules doesn't require a developer every time you want to adjust something.

 

That real-time picture is what lets you catch the shopper browsing from a known-risky IP, flying through checkout faster than any real customer would or showing buying patterns that just don't add up, all before their order gets confirmed.

GBG Go can also connect you to GBG Trust, which layers cross-industry fraud intelligence on top of your own data. It draws on identity insights from 28+ sectors to flag suspicious connections your own records might not show you.

That's especially handy when a shopper is brand-new to your store but has history elsewhere – and it's not just a hunch: Our Global Fraud Report found that 81% of the 1,200+ fraud professionals surveyed believe this kind of cross-sector collaboration actually helps fight fraud.

Catch account takeover and suspicious orders before merchandise ships

Account takeover is especially tricky because the account itself is genuine, it's just not being controlled by the person who owns it anymore.

Consider a scenario where a long-time customer resets their password and places a large order. On the surface, the order appears standard. But if the phone number tied to that account was recently subjected to a SIM swap attempt (where fraudsters reroute a victim's calls and texts to intercept one-time passcodes), that password reset becomes highly suspicious.

Our solutions can detect SIM swapping and call-forwarding attempts in real time, stopping attackers before they can drain stored credit, redeem loyalty rewards or place unauthorized orders.

 

Our deliverable address verification tools also inspect destination addresses to confirm they correspond to real residential locations and match the buyer's profile.

Combining these signals gives your team clear evidence to act on before high-value goods leave your warehouse.

Increase verification only when an order actually calls for it

When initial transaction signals are ambiguous, you don't have to choose between approving a risky order or turning away a potential customer.

Instead, you can use dynamic routing to trigger step-up verification only when specific risk thresholds are crossed.

 

When an order requires stronger proof, our document verification capabilities run more than 50 forensic tests against 8,500+ global ID types across 195 countries to detect altered or forged IDs.

Our FaceMatch tool compares the photo on the ID with a live selfie, while passive liveness detection confirms a real person is completing the check rather than a photo, video or deepfake.

A returning customer making a routine purchase passes through without extra steps, while an order with multiple conflicting signals triggers step-up authentication. This approach keeps your checkout fast for genuine buyers while protecting your revenue against fraud.

 

Book a demo to learn how our identity verification and fraud prevention platform helps retailers stay secure.

FAQs: Ecommerce fraud prevention

What is ecommerce fraud prevention?

Ecommerce fraud prevention refers to the tools and verification strategies online retailers use to detect and block unauthorized or deceptive transactions.

It involves verifying customer identities, analyzing device and payment signals and monitoring order patterns to prevent financial losses from stolen cards, account takeovers and chargebacks.

Why does ecommerce fraud increase around Black Friday?

Fraud increases during Black Friday because high transaction volumes make it easier for malicious orders to blend in with legitimate ones

Fraudsters take advantage of seasonal purchasing habits, such as larger basket sizes, gift shipments to new addresses and rush fulfillment options, knowing that review teams are under pressure to process orders quickly.

How can retailers prevent ecommerce fraud without increasing false declines?

Retailers can reduce false declines by moving away from rigid, single-attribute rules and adopting layered, risk-based verification.

By combining identity data, device signals, address verification, and cross-industry threat intelligence with providers like us, retailers can evaluate overall order risk accurately and apply step-up verification only to high-risk transactions.