Credit Card Scams Small Businesses Must Avoid

Most advice about credit card scams is written for the person holding the card. Check your statement, freeze your credit, don’t click the link.

None of that helps the business on the other side of the counter. When a stolen card is used to buy from you, you are not the victim who gets refunded. You are usually the one funding the refund, and if the order was delivered, you’re out the goods as well as the money.

That’s the gap this guide fills. The credit card scams a small business runs into are a different set from the consumer ones: cons that arrive dressed as a large order, contracts that arrive dressed as a better processing rate, and invoices that arrive dressed as a supplier you already use. Every one of them is easier to stop at the point it lands than to unwind afterwards.

The Bottom Line

• In card-not-present transactions, the merchant almost always absorbs the loss. You refund the money, you lose the goods, and you usually pay a chargeback fee on top.

• The cost is bigger than the transaction. LexisNexis Risk Solutions put the total cost at $4.61 for every $1 of fraud for US retail and ecommerce firms in its 2025 study, once fees, labour and replaced stock are counted.

• Most fraudulent orders announce themselves. Large rush orders from a new customer, a shipping address that doesn’t match billing, and a refusal to give a working phone number are the classic three.

• Fraud that comes through the processor is quieter. Tiered rates, terminal leases and “sign today” pressure cost more per year than most single scam orders do.

• The last safe moment is before the goods leave the building. Once a driver is on the road, every option you had gets more expensive.

Why businesses lose more than consumers do in a card scam

Consumer card protection is strong. Federal law caps a cardholder’s liability, and in practice most issuers zero it out. That protection has to be paid for by somebody, and in a card-not-present transaction, that somebody is the merchant.

The mechanics are worth being blunt about. When a customer disputes a charge as fraudulent, the issuer pulls the money back from your account. You then get the chance to fight it with evidence. If the card really was stolen, you will lose, because no amount of delivery proof shows that the person who placed the order was the cardholder. The goods are gone too, and unlike a store return there’s no incentive for anyone to bring them back.

Then come the second-order costs. LexisNexis Risk Solutions’ True Cost of Fraud study found North American ecommerce and retail companies were absorbing $4.61 in total cost for every $1 of direct fraud loss in 2025, up from $2.40 back in 2016. Staff time, chargeback fees, replaced inventory and the delivery run you already paid for all sit inside that multiplier.

Volume matters here too. The more orders you take without seeing a card, the more exposure you carry. That’s worth keeping in view when you turn up the tap on demand: a campaign that works brings strangers, and digital advertising for local businesses is very good at putting your order form in front of people who have never bought from you before. Nothing wrong with that. It just means your fraud checks need to be in place before the ads run, not after the first bad order.

The stolen card rush order, and why delivery makes it worse

This is the scam that costs delivering businesses the most, and it barely registers in consumer fraud advice because consumers never see it.

The pattern is consistent. A new customer places an unusually large order, often by phone or through a web form, for high-value items. They’re in a hurry. They want it today or tomorrow. They’re relaxed about price and specific about timing. They pay by card without blinking, and they may offer a second card if the first declines. Then they ask for delivery to an address that isn’t the billing address, or for someone else to collect.

Weeks later the real cardholder notices the charge, the dispute lands, and the money leaves your account.

The Better Business Bureau’s warning on fraudulent purchases from stolen cards lists the signals that show up over and over:

• Unusually large orders placed online with no prior contact from the customer.

• Rush orders for large quantities of high-priced items, shipped to different addresses or overseas.

• Several transactions on one card in a short window, or one billing address with multiple shipping addresses.

• Multiple cards used from a single IP address.

• Orders from free email accounts, with missing information, or from customers who won’t give contact details.

There’s a doorstep variant that food and floral businesses know well. The order is delivered, and the person who answers says the cardholder isn’t home, they’ll call the number in later, could you just leave it. The goods go, the payment never lands cleanly, and there’s nothing to recover.

The fix is unglamorous and it works: verify before the goods move. Call the number on the order and confirm the name and billing address. Where a call isn’t practical, flash call verification confirms the customer controls the number they gave you by placing an automated call the system verifies itself. Require the security code on the back of the card. Use Address Verification Service so that a billing and shipping mismatch holds the order instead of releasing it. And when something feels off on a large order, the BBB’s own advice is the one to write on the wall: when in doubt, don’t send the order out.

Card-not-present fraud: who actually pays

It helps to know the rule rather than guessing at it, because the answer shapes how much checking is worth doing.

In a card-present sale, where a chip card is dipped or tapped on a compliant terminal, liability for a counterfeit or stolen card generally sits with the issuer. In a card-not-present sale (phone orders, web orders, anything keyed in by hand), it sits with the merchant. You are the one who accepted a card you never saw.

The one meaningful exception is 3-D Secure authentication. When an online transaction is authenticated through 3DS and later disputed as fraud, liability shifts to the issuing bank. That shift only applies if the authentication actually completed, which is why it’s worth confirming with your payment provider that 3DS is switched on for your online checkout rather than assuming it is.

Two practical conclusions follow. First, keyed-in and phone orders deserve more scrutiny than anything taken at a terminal, because they carry a risk that a tapped card does not. Second, if a large share of your revenue arrives without a card present, fraud screening isn’t an optional extra in your software stack. It’s part of the cost of selling that way.

Red flags to check before an order goes out for delivery

Fraudulent orders are rarely subtle. The problem is that the signals arrive one at a time, and each looks explainable on its own. Reading them together is the skill.

One note on the last row. Fraud depends on urgency, because urgency is the thing that stops people checking. Any request that involves skipping a step you’d normally take is worth exactly the delay it takes to check it, whatever the customer says about the wedding on Saturday.

Credit card processing scams that target small businesses

The second family of scams doesn’t come through the order book. It comes through a salesperson offering to lower your rates, and it takes money quietly for years.

Business News Daily’s rundown of credit card processing scams covers the main plays, and every one of them shows up in the small-business world regularly:

• Tiered pricing. A low headline rate that applies only to “qualified” transactions, with digital wallets and keyed-in payments quietly reclassified into pricier tiers. Flat-rate pricing is easier to audit.

• Terminal leasing. Leasing a card terminal instead of buying one. Business News Daily puts a terminal purchase around $300 against lease costs that can reach $4,000 over the term, and those leases are frequently non-cancellable.

• Hidden surcharges. Fees that live in the contract rather than the quote (statement fees, PCI fees, cancellation fees) and add up to hundreds or thousands a year.

• Disappearing support. The rep who answered every call before signing stops answering afterwards. Check reviews and support hours before you commit, not after.

• Pressure closes. Limited-time offers with a deadline attached. Legitimate processors will still be there next week.

• POS lock-in. Proprietary software that won’t talk to any other processor, so switching means rebuilding your entire operation.

The defensive move is the same in every case: month-to-month terms, flat-rate pricing, no equipment lease, and a written answer to “what does it cost me to leave?” before you sign anything.

Fake invoices and business impersonation scams

The third family targets the person who pays the bills rather than the person who takes the orders, and it’s the fastest-growing of the three.

The Federal Trade Commission reported $3.5 billion in losses to imposter scams in 2025, out of roughly $16 billion in total reported fraud losses, the highest on record and up about 25% on 2024. Business impersonators accounted for nearly $1 billion of that, with the largest losses going to criminals posing as a bank.

For a small operation, it usually arrives as one of these:

• An invoice from a supplier you recognise, with new bank details and a polite note about a change of account.

• A call from someone claiming to be your bank’s fraud team, warning about suspicious activity and offering to move your money somewhere safe.

• A renewal notice for a domain, listing or directory you’re not sure you signed up for, priced just low enough that querying it feels like more work than paying it.

Two controls stop nearly all of it. Never act on payment details that arrive by email or phone. Call the supplier back on a number you already had, not the one in the message. And set a rule that no bank account change gets made by one person alone, even in a two-person business.

What to fix first if you take card payments and deliver

If you’re going to change three things this month, make them these.

Put a verification step in front of dispatch. Any first-time order over a threshold you set gets a phone call and an AVS check before it is packed. The threshold matters more than the policy. Pick a number where losing that order hurts, and apply it without exceptions.

Get your payment settings audited. Confirm 3DS is active on your online checkout, confirm the security code is required, and confirm keyed-in transactions are flagged differently from tapped ones in your reporting. Your processor can answer all three in one call.

Make the risk visible to whoever packs and whoever drives. The person building the order is the last human who sees it before it becomes a delivery. A one-page list of red flags by the packing bench catches more fraud than any dashboard, because it’s read at the only moment when stopping is still free.

Everything here sits inside a bigger question, which is what software you’re running the business on in the first place: the ordering system, the payment stack, the delivery side. Our guide to the must-have business tools for a company that delivers its own orders walks through the categories and where each one earns its money. Payment protection is one of ten, and it’s the one people only rate properly after the first bad chargeback.