Payment Gateway Fraud in Colombia: How to Protect Your E-commerce Store

A Colombian online store processes hundreds of orders a month using a popular local payment gateway. One day chargebacks start rolling in — customers claiming to their bank they never authorized the purchase — and the store discovers an attacker had been using stolen cards to make purchases for weeks, targeting their store specifically because its anti-fraud controls were weaker than the competition's. The store doesn't just lose the shipped merchandise; it also faces chargeback fees and, if the pattern repeats enough, the risk of the payment gateway suspending its service for being flagged as high-risk.

Stolen card testing (carding). Attackers use lists of card numbers obtained from previous data breaches and make small, fast purchases across multiple merchants to identify which cards are still active, before using them for higher-value purchases.

Exploiting merchants with weak validation. Stores that don't properly verify the billing address (AVS) or the card's security code (CVV) become preferred targets, precisely because they offer less friction for fraud.

Brute-force attacks on payment forms, trying card data combinations at high speed until finding one that works, when the merchant has no attempt limits or CAPTCHA on the checkout process.

Impersonating the payment interface itself, through malicious code injected into the site (an attack type known as "e-skimming") that captures card data directly during the legitimate payment process, without the buyer or merchant noticing immediately.

Every chargeback carries an associated fee, regardless of whether the merchant wins or loses the dispute. But the more serious damage is usually reputational within the payments ecosystem itself: gateways monitor each merchant's chargeback rate, and exceeding certain thresholds can result in higher fees, fund holds, or in severe cases, service termination — which can leave an online store with no way to process payments while it finds a new provider.

Address verification (AVS) and security code (CVV) enabled and required on every transaction, with no exceptions for conversion convenience.

Rate limits on payment attempts, blocking or flagging for manual review multiple consecutive failed attempts from the same session or IP address.

3D Secure authentication when the gateway supports it, which shifts part of the verification responsibility to the card-issuing bank and significantly reduces fraud with stolen cards.

Monitoring for unusual patterns, like high-value orders shipping to addresses that don't geographically match the billing address, or multiple orders from the same card in a short window.

Periodic security audits of the checkout process, to catch vulnerabilities like e-skimming before an attacker exploits them — this is exactly the kind of review a cybersecurity audit focused on e-commerce platforms covers.

Review disputed transaction patterns for common signals (same IP address, same card range, same product pattern), temporarily tighten controls even if they slightly reduce conversion, and consider a full technical review of the payment process to rule out the site itself being compromised.