Last updated May 15, 2026 with current MRC and AI detection data, and a closer look at the patterns basic fraud tools consistently miss.
Almost every ecommerce platform now ships with some form of fraud prevention built in. A baseline rules engine. A simple checkout filter. Maybe a connection to a payment processor’s risk score. For the first few months of a new store’s life, this is usually enough.
It stops being enough faster than most merchants expect, and the gap between basic and advanced has widened sharply in the last two years. The Merchant Risk Council’s 2026 Global eCommerce Payments and Fraud Report named refund and policy abuse the #1 ranked fraud threat across ecommerce, displacing payment fraud for the first time. Almost two-thirds of merchants now report rising first-party misuse, and the patterns are spreading from transaction-level fraud into returns, claims, account behavior, and post-purchase abuse that out-of-the-box tools were never designed to catch.
Jamie, a Strategic Fraud Operations Specialist at Wyllo, has spent years watching this shift happen up close. She sees the gaps every day, on real merchants’ systems, in real time.
From Bank Teller to Fraud Operations
Before Wyllo, Jamie worked as a bank teller and later a private client banker. The fraud side of banking was what drew her in, and the stories from that period explain why she ended up doing the work she does now.
“We actually had a guy that would stand outside and offer money to college students to run into the bank and cash fake checks. He ended up getting arrested,” Jamie recalls. Other cases were harder to watch. “This guy came in with an older gentleman, and he was trying to convince the gentleman to withdraw all of his money and give it to him. It was really, really sad to see because the older gentleman was just not with it enough to know that he shouldn’t be giving away all of his money. We ended up not withdrawing the money.”
The case that made the deepest impression involved an apparent inside job. “A customer came in to withdraw his entire balance, but I saw that his profile was just recently updated in the system earlier that day. When I asked for his ID, it showed he was 75 years old, but the guy in front of me was clearly much younger.” Jamie suspects an employee was working with a fraudster to use a stolen identity, targeting an elderly customer’s account to clear out a lifetime of savings. She declined that withdrawal too.
“Cases like this have always interested me, and that’s why I decided to focus on fighting fraud on behalf of merchants.”
At Wyllo, Jamie now optimizes ecommerce fraud operations by proactively identifying system vulnerabilities merchants don’t know they have. She tailors decisioning logic for new merchants, monitors existing accounts for emerging patterns, and works directly with brands to solve their specific security challenges. Being on the front lines, she sees what’s actually happening before the data catches up.
Where Basic Fraud Prevention Falls Short
Most out-of-the-box fraud tools share three structural limitations.
They look at one transaction at a time. A rules engine scoring a single checkout in isolation can’t see that the same device just placed three orders under three different names, all shipping to the same address. The patterns that hurt most live in the connections between events, not inside any single event.
They tune to a generic threshold, not your specific business. A score that makes sense for a fast-fashion retailer makes terrible decisions on a luxury watch merchant. A rule built for low-AOV consumables over-declines high-AOV first-time buyers. Out-of-the-box thresholds are the average of every merchant on the platform, which means they’re rarely right for any individual merchant.
They only screen the entry point. A typical built-in fraud filter inspects the initial order at checkout. It doesn’t see what happens next: the refund request three weeks later, the policy-abuse pattern on the return, the support-channel pressure tactics, the chargeback that arrives a month after fulfillment. That’s where the new dominant fraud categories live.
Jamie’s diagnosis is sharper. “While we use a web of data points like card information, billing and shipping details, customer email addresses, IP addresses, and third-party data to screen orders, fraud prevention is a game of proactivity.” She continues, “The backend setup is really where all the vulnerabilities lie, and that’s what I focus on.”
The cost of all three limitations adds up in the same place: false declines on legitimate orders and missed abuse on the surfaces the tool wasn’t watching. Industry research now puts rules-based legacy systems at 60–75% detection accuracy with false-positive rates between 10–20%, while modern AI-driven systems run 90–97% accuracy with false-positive rates under 2%. The accuracy gap between basic and advanced is no longer marginal.
Three Specific Gaps Fraudsters Are Exploiting in 2026
Subscription and Recurring-Payment Blind Spots
Most subscription billing platforms include some fraud screening on the initial signup. Very few apply the same scrutiny to recurring activity. The result: a fraudster who passes the first signup check rides the rebill cycle for months before anything notices, or quietly reactivates a canceled account to keep the fulfillment going. The “one-click rebill” button on many subscription platforms is a particular blind spot, because most native fraud filters don’t run on those triggers.
Jamie ran into exactly this with a popular subscription brand. “We brought to light a problem that they never even knew they had. The subscription service they used was just not picking up on fraudulent orders.” Subscription and ecommerce platforms often have a fraud prevention component, but these are typically basic filters that don’t catch the advanced tactics of today’s evolving schemes. And most of the time, they don’t integrate with other systems to pass the insights and data needed to detect evolving patterns.
“Out-of-the-box solutions aren’t always the best for merchants. They don’t catch everything, and most merchants need a fraud specialist who understands their business to spot vulnerabilities,” Jamie says.
High-Value Orders With “Clean” Identity Signals
A high-value order can pass every basic check (matching billing and shipping, verified email, verified phone, no card mismatch flags) and still be fraud. The pattern that’s grown most over the last two years: stolen identity credentials harvested from breach data or phishing, paired with the actual victim’s email or phone (often compromised separately), used to place a single high-value order before anyone notices the account has been taken over.
Jamie walks through a recent case that made the point vividly. A fraudster attempted a high-value watch purchase using a stolen ID and additional verification photos. The order was flagged for review by the Wyllo team, and a request was sent to the customer’s email for further verification.
“We received verification images and a driver’s license matching the customer’s details from the customer’s email address,” Jamie says. “Everything pointed to this order being legitimate, but when we called the phone number matching all the credentials, the guy who answered said he didn’t place the order.” The real customer’s email had been hacked, and his ID photos were sitting in his inbox, making it easy for the fraudster to harvest the supporting materials.
A basic fraud tool sees clean signals and approves. An advanced system pairs the AI score with human expert review on the orders where the signals are too perfect, calls the listed phone number, and finds out the cardholder didn’t place the order.
Post-Purchase Abuse and Friendly Fraud
The fastest-growing fraud category in 2026 is not transaction-level. It’s refund abuse, return fraud, item-not-received claims, and first-party (friendly) fraud chargebacks. Mastercard’s State of Chargebacks 2025 report found friendly fraud now accounts for more than 45% of all chargebacks. The MRC report puts refund and policy abuse at the top of the threat list.
Basic fraud tools live at checkout. The damage now happens after fulfillment. A tool that screens the order and then disengages misses the entire second half of the journey, including the place where most of the cost actually lands.
When to Upgrade From Built-In to a Dedicated Platform
Fraudsters often test gaps across businesses of varying sizes to see what they can get away with. Larger merchants are more likely to have a solid infrastructure in place with a dedicated fraud detection system and team. Smaller merchants usually aren’t there yet. In both situations, fraudsters deploy a range of tactics because their methods are based on testing, learning, and adapting.
Smaller merchants tend to see more stolen-card fraud in the infancy of their business because fraudsters know they probably don’t have detection in place. Larger merchants tend to see fraudsters exploit mature customer-service operations to attempt return fraud and policy abuse.
Most merchants don’t realize the full landscape of what’s possible until a problem has already happened. “A single chargeback can be a sign of more to come, especially for new businesses,” Jamie warns.
The clearest signals that basic fraud prevention is no longer enough:
- A single chargeback is starting to feel like a pattern. New merchants in particular should treat the first few chargebacks as early indicators, not isolated events.
- Customer service is starting to absorb fraud work. When your CX team is Googling shipping-address photos and trying to figure out whether claims are legitimate, you’ve outgrown the built-in tool.
- Approval rates on legitimate borderline orders are quietly falling. Foreign cards, high-AOV first-time buyers, mobile orders from unfamiliar locations. If those are getting blocked more often, the false-decline cost is climbing.
- You’re seeing the same actor multiple times under different identities. Two slightly different names, two slightly different emails, same shipping address or device fingerprint. Basic tools rarely surface that connection.
- Fraud time is taking attention away from growth. As Jamie puts it: “If you’re managing fraud in-house or using a system that doesn’t seem to be catching everything, and it is starting to take time away from activities that drive business growth, it’s time to call in expert help.”
What “Advanced” Actually Means
The word gets used loosely. A useful checklist for distinguishing real capability from marketing copy:
Real-time decisioning, not batch scoring. Decisions made in the moment, not after fulfillment has already started packing the box.
AI plus human experts. Pure-AI systems over-decline borderline orders. Pure human review doesn’t scale. The strongest systems pair AI screening with expert analysts who review the orders where merchant-specific context matters most.
Merchant-specific tuning. A risk score trained on a competitor’s data isn’t going to make the right decisions on your business. Look for systems that adapt to your specific patterns, payment mix, customer base, and abuse history.
Connected signal across the journey. Checkout, returns, claims, account behavior, support, and chargebacks viewed together. The patterns that hurt most live in the connections.
Embedded in workflows your team uses. Risk scores and recommended actions delivered inside the CX, ops, and finance tools your team already lives in. Another standalone dashboard is not a tool; it’s a Slack notification.
Continuous learning. Models retrained on fresh data, not static rules updated quarterly.
Out-of-the-box tools, by definition, can’t meet most of these criteria. They’re optimized to be the average answer for the average merchant. The merchants who win the fraud game in 2026 are the ones who’ve outgrown that average.
How Wyllo Helps
Wyllo, the CX-first risk intelligence platform, was built around exactly this gap between basic and advanced. Three products do the most work in this conversation:
- Wyllo Payment Fraud Protection pairs AI-driven decisioning with human fraud experts who review the orders where merchant-specific context matters most. Higher approval rates on real customers, stronger catch rates on coordinated abuse, optional chargeback guarantee for predictable economics on residual loss.
- Wyllo Claim and Policy Abuse Prevention catches account takeover, refund manipulation, and policy exploitation upstream, before they cascade into refund cycles, chargebacks, and escalations.
- Wyllo Return Fraud and Abuse Prevention uses advanced risk models to enable personalized return policies right-sized to each shopper, addressing the post-purchase abuse that basic tools miss entirely.
The pattern across all three: connected signals across the full customer journey, merchant-specific tuning, embedded decisioning inside the workflows your team already uses, and human experts on the cases where judgment matters. Precision over paranoia. Less reaction. More reason.
Frequently Asked Questions
Why isn’t basic fraud prevention enough anymore?
Three structural reasons. Basic tools look at one transaction at a time, miss the connections that reveal coordinated abuse. They use generic thresholds that don’t match any individual merchant’s actual customer base. And they only screen at checkout, missing the refund, return, claim, and chargeback patterns that now make up the largest share of ecommerce fraud loss. The MRC’s 2026 Global Payments and Fraud Report ranks refund and policy abuse the #1 fraud threat for the first time, displacing payment fraud at the top of the list.
What’s the difference between basic and advanced fraud prevention?
Basic tools are typically rules-based, scoring transactions against fixed thresholds (velocity, geography, BIN, billing/shipping mismatch). Advanced tools add AI and machine learning that correlate signals across the customer journey, adapt to new patterns continuously, integrate human expert review on borderline cases, and embed decisioning inside the workflows your team already uses. Current research puts advanced AI accuracy at 90–97% versus 60–75% for rules-based legacy systems, with false-positive rates under 2% versus 10–20%.
When should I upgrade from built-in fraud prevention to a dedicated platform?
When the first chargeback feels like a pattern instead of an outlier. When customer service starts absorbing fraud-investigation work. When approval rates on borderline orders are falling and you’re worried about false declines. When you’re seeing repeat patterns from the same actor under different identities. The economics tip in favor of a dedicated platform earlier than most merchants expect, especially when fraud time starts replacing growth time.
What’s wrong with the fraud prevention built into my ecommerce platform?
Nothing for the first few months. The built-in tools handle obvious checkout fraud reasonably well. The limitations show up over time: they don’t see across the full journey (returns, claims, account behavior, support), they’re tuned to generic averages rather than your specific patterns, and they rarely include the human expert review that recovers borderline-but-legitimate orders. Merchants who outgrow the built-in tool usually do so without realizing it, and the cost shows up in fall-off approval rates and rising post-purchase abuse.
Do small merchants need advanced fraud prevention?
Often yes, sometimes sooner than they expect. Fraudsters specifically target smaller merchants under the assumption that defenses will be weaker. Smaller merchants typically see more stolen-card testing and friendly-fraud chargebacks during the early scaling phase, and a single bad incident can do meaningful damage on a thin margin. The economics shift earlier than many merchants think, especially for high-AOV categories or merchants exposed to coordinated abuse.
How does Wyllo’s approach differ from out-of-the-box tools?
Four ways. Wyllo pairs AI-driven decisioning with human fraud experts who handle the borderline cases. Wyllo tunes to your specific business, customer base, and abuse patterns rather than applying generic thresholds. Wyllo connects signals across the full customer journey (checkout, returns, claims, account behavior, support, chargebacks) rather than evaluating one transaction at a time. And Wyllo embeds decisioning inside the workflows your team already uses, not in a standalone dashboard nobody opens.
Bringing It Together
Out-of-the-box fraud prevention is a starting point, not a destination. The patterns that hurt most have moved past where basic tools can see them, the economics of false declines have climbed, and the cost of missed post-purchase abuse now eclipses the cost of missed transaction-level fraud in most categories. The brands that handle 2026 well are the ones who treat fraud prevention as a strategic capability rather than a checkbox at checkout.
Curious how a CX-first risk intelligence approach would change what your fraud defenses actually catch? Start with Wyllo Payment Fraud Protection for the AI-plus-human-experts model, or explore the broader Wyllo platform for connected intelligence across the full customer journey.
