Fraud notification
What is fraud notification?
Fraud notification is an alert initiated by an when a transaction raises suspicion of activity, indicating that the account or card details may have been compromised or used illegitimately. No funds move when one is filed, which is what separates it from a .
Fraud notifications are an early intervention mechanism. They prompt a merchant to investigate the order, verify the transaction's legitimacy with the cardholder, and issue a where the claim holds, which mitigates the risk of a subsequent chargeback on the same transaction. Because nothing is debited at the notification stage, the merchant keeps both the funds and the decision until a is formally raised.
Key facts
- Also known as: fraud alert, fraud warning, issuer fraud report
- Filed by: the issuer, after a cardholder reports a charge as unauthorized or unrecognized
- Scheme reporting feeds: , which issuers send to Visa through its Risk Identification Service, and (System to Avoid Fraud Effectively), Mastercard's equivalent
- Prevention alerts: a faster class of notification reaching merchants through services such as and , delivered at the dispute-inquiry stage rather than on a reporting cycle
- Financial effect: none. A notification records fraud, it does not reverse a payment
- Relationship to disputes: independent. A notification can exist with no chargeback attached, and a chargeback can arrive with no notification before it
- How merchants receive it: through the or PSP. Merchants can't pull scheme fraud data from the network directly
How it works
- A cardholder reports the transaction. The cardholder contacts the issuer and states that a charge on the account was unauthorized or unrecognized.
- The issuer classifies the claim. It codes what happened – lost or stolen card, card-not-present fraud, account takeover – and that classification stays attached to the record.
- The issuer files the record with the card network. Submission runs on a recurring reporting cycle rather than at the moment the cardholder calls.
- The network aggregates the data by merchant. Records are grouped by merchant, acquirer, region, and fraud type, producing a fraud profile for the merchant across its volume on that network.
- The acquirer passes the notification to the merchant. The merchant matches the record back to the original order and decides whether to refund it, block the account, or hold the evidence for a dispute that follows.
Why it matters
- Because the issuer files the record when the cardholder first calls, the notification reaches the merchant ahead of the chargeback the same claim can trigger. Refunding inside that window removes the basis for the dispute.
- Notification data covers fraud that never becomes a dispute. Where an issuer writes off a small fraudulent charge instead of filing a chargeback, the notification is the only record the merchant ever sees of it.
- Card networks count notification volume toward their fraud monitoring programs, which are tracked separately from the . A merchant can breach a fraud limit while its chargeback ratio still looks clean.
- Repeat notifications concentrated in one BIN range, geography, or product reveal which attack the rules aren't catching yet.
Common issues
- False positives. A notification is triggered by a forgotten subscription or an unrecognized as readily as by genuine card fraud.
- Reporting lag. Scheme feeds run on a cycle, so a notification can land days after the transaction, once digital goods have already been delivered.
- No direct access. Merchants depend on the acquirer to share scheme fraud data and can't request it from the network themselves.
- Over-refunding. Treating every notification as confirmed fraud refunds legitimate orders, particularly where the claim is raised by the genuine cardholder.
- Double counting. A notification and a chargeback for the same transaction are two separate records, so counting both inflates a merchant's internal fraud rate.
