Fraud Protection Suite

Overview

Ionic provides a comprehensive fraud protection suite to help merchants prevent fraudulent transactions, reduce chargebacks, and protect their business from financial loss.

Our multi-layered fraud prevention approach combines real-time fraud scoring, address verification, card validation, and authentication protocols to provide maximum protection.

Key Fraud Protection Features:

Kount Fraud Detection - Real-time fraud scoring and device fingerprinting
Address Verification System (AVS) - Address matching validation
Card Verification Value (CVV) - Security code validation
3D Secure Authentication - Enhanced cardholder authentication (3DS 1.0 and 2.0)
Velocity Checking - Rapid transaction detection
Chargeback Management - Dispute tracking and notifications
EMV Liability Shift - Counterfeit fraud protection for card-present transactions
PCI DSS Level 1 Compliance - Industry-standard data security

Fraud Protection Layers

Kount Fraud Detection
AVS Validation
CVV Validation
3D Secure
Velocity Checking

Real-Time Fraud Scoring

Kount provides advanced fraud detection using machine learning, device fingerprinting, and behavioral analysis to score every transaction in real-time.Key Benefits:

Real-time fraud risk scoring (0-100)
Device fingerprinting and tracking
Velocity checks across multiple dimensions
Customizable fraud rules and thresholds
Geolocation analysis
Email and phone validation

How It Works:

Collect device data from customer browser
Submit Kount session ID with transaction
Kount analyzes 200+ data points in real-time
Receive fraud score and recommendation
Apply rules based on your risk tolerance

Integration Options:

Payment API integration
Collect.js integration
Gateway.js integration
Manual device data collection

Address Verification System

AVS compares the billing address provided by the customer with the address on file at the card-issuing bank.Validation Points:

Street address match
5-digit ZIP code match
9-digit ZIP code match
International postal code match

Common AVS Responses:

X - Exact match (address + 9-digit ZIP) ✅ Accept
Y - Address + 5-digit ZIP match ✅ Accept
A - Address match only ⚠️ Review
Z - ZIP match only ⚠️ Review
N - No match ⛔ Decline/Review

Best Practices:

Always request complete billing address
Configure AVS rules based on risk tolerance
Review transactions with partial matches
Consider international AVS limitations

Card Verification Value

CVV is a 3-4 digit security code printed on the card that verifies physical card possession.CVV Response Codes:

M - CVV matches ✅ Accept
N - CVV does not match ⛔ Decline
P - Not processed ⚠️ Review
U - Issuer not certified ⚠️ Review

Benefits:

Reduces card-not-present fraud
Improves approval rates
Demonstrates due diligence
Required for PCI compliance best practices

Implementation:

Always request CVV for card-not-present transactions
Never store CVV after authorization
Decline transactions with CVV mismatch
Configure CVV rules in merchant portal

Enhanced Authentication

3D Secure adds an authentication layer where cardholders verify their identity with their issuing bank.Supported Versions:

3D Secure 1.0 (traditional redirect flow)
3D Secure 2.0 / EMV 3DS (enhanced with frictionless flow)

Key Benefits:

Shift liability for fraudulent transactions
Increase approval rates for authenticated transactions
Meet regulatory requirements (PSD2 SCA in Europe)
Reduce chargebacks by up to 70%

Authentication Results:

Y - Authenticated successfully
A - Authentication attempted
N - Authentication failed
U - Authentication unavailable

Integration: Use Gateway.js for seamless 3D Secure integration.

Kount Fraud Detection

Implementation

Initialize Gateway.js

Include Gateway.js and create an instance with your API key

<script src="https://api.ionicfi.com/js/Gateway.js"></script>
<script>
  const gateway = Gateway.create({
    apiKey: 'YOUR_PUBLIC_API_KEY',
    environment: 'sandbox'
  });
</script>

Get Kount Service

Retrieve the Kount service instance

const kount = gateway.getKount();

Collect Device Data

Collect device fingerprinting data from customer browser

kount.collectDeviceData(function(sessionId) {
  console.log('Kount Session ID:', sessionId);
  // Store session ID for transaction submission
  window.kountSessionId = sessionId;
});

Submit with Transaction

Include Kount session ID in your payment request

// Submit payment with Kount data
submitPayment({
  type: 'sale',
  amount: '99.99',
  ccnumber: '4111111111111111',
  ccexp: '1225',
  cvv: '999',
  kount_session_id: window.kountSessionId
});

Review Fraud Score

Analyze the fraud score returned in the transaction response

// Response includes fraud score
{
  response: '1',
  responsetext: 'SUCCESS',
  kount_score: '25',
  kount_decision: 'A' // A=Approve, D=Decline, R=Review
}

Fraud Score Interpretation

Kount returns a fraud score from 0-100 with each transaction:

Score Range	Risk Level	Recommendation	Action
0-20	Low	Approve	Process transaction normally
21-40	Medium-Low	Approve with monitoring	Process but flag for review if patterns emerge
41-60	Medium	Review required	Manual review before fulfillment
61-80	Medium-High	Decline or review	Decline automatically or require verification
81-100	High	Decline	Reject transaction

Configure your fraud score thresholds in the merchant control panel based on your risk tolerance and business model. E-commerce businesses may have different thresholds than digital goods merchants.

Testing Kount

In sandbox mode, use these email patterns to trigger specific fraud scores:

# Low risk transaction
email=[email protected]
# Returns: kount_score=10 (Low risk)

# Medium risk transaction
email=[email protected]
# Returns: kount_score=50 (Medium risk, review required)

# High risk transaction
email=[email protected]
# Returns: kount_score=90 (High risk, decline)

# Critical risk transaction
email=[email protected]
# Returns: kount_score=95 (Critical risk)

AVS and CVV Validation

Implementing AVS/CVV Checks

<?php
function validateFraudChecks($result) {
    // Check primary response
    if ($result['response'] != '1') {
        return [
            'approved' => false,
            'message' => 'Transaction declined: ' . $result['responsetext']
        ];
    }

    // Define acceptable AVS codes
    $avs_acceptable = ['X', 'Y', 'A', 'Z', 'W', 'D', 'M'];
    $avs_match = in_array($result['avsresponse'], $avs_acceptable);

    // Check CVV
    $cvv_match = ($result['cvvresponse'] == 'M');

    // Determine if manual review needed
    $needs_review = !$avs_match || !$cvv_match;

    if ($needs_review) {
        // Flag for manual review
        flagForReview($result['transactionid'], [
            'avs' => $result['avsresponse'],
            'cvv' => $result['cvvresponse'],
            'reason' => !$avs_match ? 'AVS mismatch' : 'CVV mismatch'
        ]);
    }

    return [
        'approved' => true,
        'transaction_id' => $result['transactionid'],
        'needs_review' => $needs_review,
        'avs_match' => $avs_match,
        'cvv_match' => $cvv_match
    ];
}
?>

AVS Response Codes

Code	Description	Street	ZIP	Recommendation
`X`	Exact match	✅	✅ (9-digit)	✅ Accept
`Y`	Match	✅	✅ (5-digit)	✅ Accept
`A`	Address only	✅	❌	⚠️ Review
`W`	ZIP only (9-digit)	❌	✅	⚠️ Review
`Z`	ZIP only (5-digit)	❌	✅	⚠️ Review
`N`	No match	❌	❌	⛔ Decline/Review
`U`	Unavailable	-	-	⚠️ Review
`R`	Retry	-	-	🔄 Retry
`E`	AVS error	-	-	⚠️ Review
`S`	Not supported	-	-	- Accept
`G`	Global non-verifiable	-	-	- Accept

Testing AVS/CVV

Use these test cards to simulate different AVS/CVV scenarios:

Card Number	AVS	CVV	Description
`4111111111111111`	`X`	`M`	Full match - Low fraud risk
`4000000000000002`	`N`	`N`	No match - High fraud risk
`4242424242424242`	`Y`	`M`	Address + ZIP match
`4000000000000101`	`A`	`M`	Address match only
`4000000000000200`	`Z`	`M`	ZIP match only
`4000000000000085`	`N`	`M`	No address match
`4000000000000093`	`Y`	`N`	CVV mismatch - Fraud indicator

3D Secure Authentication

Combined 3D Secure + Kount Integration

For maximum fraud protection, combine 3D Secure authentication with Kount fraud detection:

const gateway = Gateway.create({
    apiKey: 'YOUR_PUBLIC_API_KEY',
    environment: 'sandbox'
});

const threeDSecure = gateway.get3DSecure();
const kount = gateway.getKount();

// Step 1: Collect Kount device data
kount.collectDeviceData(function(kountSessionId) {

    // Step 2: Collect payment token
    CollectJS.configure({
        callback: function(token) {

            // Step 3: Perform 3DS authentication
            threeDSecure.configure({
                amount: '99.99',
                currency: 'USD',
                billingAddress: {
                    firstName: 'John',
                    lastName: 'Doe',
                    address1: '123 Main St',
                    city: 'New York',
                    state: 'NY',
                    zip: '10001',
                    country: 'US'
                }
            });

            threeDSecure.authenticate(token, function(threeDSResult) {

                if (threeDSResult.authenticated) {
                    // Step 4: Submit with both 3DS and Kount data
                    submitPayment({
                        payment_token: token,
                        amount: '99.99',
                        // 3D Secure fields
                        cardholder_auth: threeDSResult.cardholder_auth,
                        cavv: threeDSResult.cavv,
                        xid: threeDSResult.xid,
                        eci: threeDSResult.eci,
                        // Kount fraud detection
                        kount_session_id: kountSessionId
                    });
                } else {
                    // Authentication failed - high fraud risk
                    showError('Authentication failed. Please try a different payment method.');
                }
            });
        }
    });
});

3D Secure Testing

Test 3D Secure authentication flows:

Card Number	3DS Result	Description
`4000000000001000`	Authenticated	Full authentication successful
`4000000000001091`	Authenticated	Frictionless flow (no challenge)
`4000000000001018`	Unavailable	Authentication unavailable
`4000000000001034`	Failed	Authentication failed
`4000000000001042`	Challenge	Challenge flow required

Velocity Checking

Velocity Rule Configuration

Configure velocity rules in the merchant control panel to detect suspicious patterns: Common Velocity Rules:

Card Testing Prevention

Rule: Maximum 3 transactions per card per 10 minutesPurpose: Prevent fraudsters from testing stolen card numbersAction: Decline subsequent transactions, flag IP for review

Rapid Transaction Detection

Rule: Maximum 5 transactions per IP per hourPurpose: Detect automated fraud attemptsAction: Require CAPTCHA or additional verification

High-Value Velocity

Rule: Maximum $1,000 per card per dayPurpose: Prevent large-scale fraudAction: Hold for manual review if exceeded

Failed Attempt Tracking

Rule: Maximum 3 failed attempts per card per dayPurpose: Detect card testing and brute force attemptsAction: Block card temporarily, alert fraud team

Testing Velocity Rules

Test velocity detection with rapid transactions:

# Transaction 1
curl -X POST https://api.ionicfi.com/api/transact.php \
  -d "security_key=YOUR_KEY" \
  -d "type=sale" \
  -d "amount=10.00" \
  -d "ccnumber=4111111111111111" \
  -d "ccexp=1225" \
  -d "cvv=999"

# Transaction 2 (immediately after)
curl -X POST https://api.ionicfi.com/api/transact.php \
  -d "security_key=YOUR_KEY" \
  -d "type=sale" \
  -d "amount=10.00" \
  -d "ccnumber=4111111111111111" \
  -d "ccexp=1225" \
  -d "cvv=999"

# May trigger velocity check based on your configured rules

Chargeback Management

Chargeback Notifications

Receive real-time chargeback notifications via webhooks:

{
  "event": "chargeback.received",
  "chargeback_id": "CB123456",
  "transaction_id": "123456789",
  "amount": "99.99",
  "reason_code": "10.4",
  "reason": "Other Fraud - Card Absent Environment",
  "due_date": "2025-11-15",
  "timestamp": "2025-10-30T10:30:00Z"
}

Visa
Mastercard

Code	Description	Prevention
`10.1`	EMV Liability Shift Counterfeit	Use EMV chip readers
`10.2`	EMV Liability Shift Non-Counterfeit	Implement 3D Secure
`10.3`	Other Fraud - Card Present	Verify ID, check signature
`10.4`	Other Fraud - Card Absent	Use AVS/CVV, 3D Secure, Kount
`10.5`	Visa Fraud Monitoring Program	Monitor fraud rates, strengthen security

Code	Description	Prevention
`4837`	No Cardholder Authorization	Use 3D Secure, verify customer
`4840`	Fraudulent Processing	Implement fraud detection
`4849`	Questionable Merchant Activity	Follow best practices
`4863`	Cardholder Does Not Recognize	Clear descriptor, save proof

Chargeback Prevention Strategies

Use 3D Secure

Shift liability and reduce fraud chargebacks by up to 70%

Verify AVS/CVV

Decline transactions with address or CVV mismatches

Enable Kount

Real-time fraud scoring prevents fraudulent transactions

Clear Descriptors

Use recognizable statement descriptors to prevent confusion

Save Evidence

Retain transaction logs, IP addresses, and delivery confirmation

Fast Fulfillment

Ship quickly and provide tracking to prevent “merchandise not received” claims

Fraud Prevention Best Practices

Required Fields for Fraud Prevention

Always collect these fields to maximize fraud detection:

Field	Purpose	Example
`cvv`	Verify physical card possession	`999`
`ipaddress`	Geolocation and velocity tracking	`192.168.1.1`
`email`	Customer verification and Kount scoring	`[email protected]`
`phone`	Customer verification	`212-555-1234`
`address1`	AVS validation	`123 Main St`
`city`	AVS validation	`New York`
`state`	AVS validation	`NY`
`zip`	AVS validation	`10001`

Best Practice: Including CVV significantly improves approval rates and reduces fraud. Always include customer IP address for fraud detection and geolocation analysis.

Fraud Detection Decision Flow

Implementation Checklist

Basic Fraud Protection

Collect CVV for all card-not-present transactions
Enable AVS validation
Configure AVS/CVV decline rules
Collect customer IP address
Set up duplicate transaction checking

Advanced Fraud Detection

Implement Kount fraud detection
Configure fraud score thresholds
Set up velocity rules
Enable device fingerprinting
Create manual review workflows

Authentication

Implement 3D Secure for high-risk transactions
Configure 3D Secure exemptions
Test authentication flows
Handle authentication failures gracefully

Monitoring & Response

Testing Your Fraud Protection

Comprehensive Testing Scenarios

Test all fraud protection features before going live:

Test Kount Integration

# Test low risk
email=[email protected]
# Expected: kount_score=10

# Test high risk
email=[email protected]
# Expected: kount_score=90

Test AVS/CVV Validation

# Test AVS mismatch
ccnumber=4000000000000002
address1=123 Test St
zip=99999
# Expected: avsresponse=N

# Test CVV mismatch
ccnumber=4000000000000093
cvv=999
# Expected: cvvresponse=N

Test 3D Secure

# Test successful authentication
ccnumber=4000000000001000
# Expected: authenticated=true, cardholder_auth=Y

# Test failed authentication
ccnumber=4000000000001034
# Expected: authenticated=false

Test Velocity Rules

# Submit multiple rapid transactions with same card
# Expected: Subsequent transactions flagged or declined

Fraud Rate Monitoring

Key Metrics to Track

Monitor these metrics in your merchant control panel:

Metric	Target	Action Threshold
Fraud Rate	< 0.5%	> 1% - Review settings
Chargeback Rate	< 0.9%	> 1% - Risk of penalties
3DS Authentication Success	> 95%	< 90% - Review flow
AVS Match Rate	> 85%	< 80% - Review requirements
CVV Match Rate	> 95%	< 90% - Review requirements
Average Kount Score	< 30	> 40 - Tighten rules

Excessive chargebacks (above 1%) can result in fines, increased processing fees, or account termination. Monitor fraud rates closely and adjust protection settings as needed.

Configuration

Merchant Control Panel Settings

Configure fraud protection in your merchant portal: Navigation: Settings > Fraud Prevention

AVS/CVV Rules
Kount Settings
3D Secure
Velocity Rules

Enable/disable AVS checking
Set acceptable AVS codes
Enable/disable CVV checking
Configure CVV mismatch action (decline/flag)
Set international AVS handling

Next Steps

Gateway.js Integration

Implement 3D Secure and Kount fraud detection

Response Codes

Understand AVS, CVV, and fraud response codes

Webhooks

Set up chargeback and fraud event notifications

Testing Guide

Test your fraud prevention implementation

Payment Variables

Fraud-related API parameters

Go Live Checklist

Prepare for production with fraud protection

Getting Started

Integration Methods

Partners

API Reference

​Overview

​Fraud Protection Layers

​Real-Time Fraud Scoring

​Address Verification System

​Card Verification Value

​Enhanced Authentication

​Transaction Pattern Analysis

​Kount Fraud Detection

​Implementation

​Fraud Score Interpretation

​Testing Kount

​AVS and CVV Validation

​Implementing AVS/CVV Checks

​AVS Response Codes

​Testing AVS/CVV

​3D Secure Authentication

​Combined 3D Secure + Kount Integration

​3D Secure Testing

​Velocity Checking

​Velocity Rule Configuration

​Testing Velocity Rules

​Chargeback Management

​Chargeback Notifications

​Common Fraud-Related Chargeback Codes

​Chargeback Prevention Strategies

Use 3D Secure

Verify AVS/CVV

Enable Kount

Clear Descriptors

Save Evidence

Fast Fulfillment

​Fraud Prevention Best Practices

​Required Fields for Fraud Prevention

​Fraud Detection Decision Flow

​Implementation Checklist

​Testing Your Fraud Protection

​Comprehensive Testing Scenarios

​Fraud Rate Monitoring

​Key Metrics to Track

​Configuration

​Merchant Control Panel Settings

​Next Steps

Gateway.js Integration

Response Codes

Webhooks

Testing Guide

Payment Variables

Go Live Checklist

Overview

Fraud Protection Layers

Real-Time Fraud Scoring

Address Verification System

Card Verification Value

Enhanced Authentication

Transaction Pattern Analysis

Kount Fraud Detection

Implementation

Fraud Score Interpretation

Testing Kount

AVS and CVV Validation

Implementing AVS/CVV Checks

AVS Response Codes

Testing AVS/CVV

3D Secure Authentication

Combined 3D Secure + Kount Integration

3D Secure Testing

Velocity Checking

Velocity Rule Configuration

Testing Velocity Rules

Chargeback Management

Chargeback Notifications

Common Fraud-Related Chargeback Codes

Chargeback Prevention Strategies

Fraud Prevention Best Practices

Required Fields for Fraud Prevention

Fraud Detection Decision Flow

Implementation Checklist

Testing Your Fraud Protection

Comprehensive Testing Scenarios

Fraud Rate Monitoring

Key Metrics to Track

Configuration

Merchant Control Panel Settings

Next Steps