Holiday Card-Fraud Checklist for Orange County Retailers

The short answer: holiday fraud hits Orange County retailers in three places — the counter, the online checkout, and the refund desk. A few habits at each one, set up before Black Friday, prevent most of the losses we see on merchant statements every January.

The busy season is exactly when fraudsters expect your staff to be rushed, your seasonal hires to be new, and your attention to be on the line out the door. Here’s the checklist we walk through with our merchants each November.

Why Does Fraud Spike Between Black Friday and New Year’s?

Volume is the cover. When a shop on Main Street in Huntington Beach or a boutique near South Coast Plaza runs three times its normal transactions, one bad sale doesn’t stand out. Fraudsters also know that seasonal staff haven’t been trained on what a suspicious transaction looks like, and that managers are less likely to question a big ticket during a rush.

The cost doesn’t arrive until later. A fraudulent sale in December usually comes back as a chargeback in January or February — after the merchandise is gone, and with a chargeback fee on top of the lost sale.

What Should Happen at the Counter?

• Always dip or tap — never key in a card that’s physically present. Since the EMV liability shift in October 2015, counterfeit-card fraud liability generally sits with whichever side has the weaker technology. If your terminal reads chips and you insert the card, you’re protected. If you key the number in, you’re not.
• Be wary of “the chip doesn’t work, just swipe it.” A damaged chip is sometimes real, but repeated chip failures followed by a swipe or a hand-keyed number is a classic counterfeit pattern.
• Watch for split payments across several cards on high-value items such as electronics, designer goods, and gift cards — especially when the first card declines.
• Limit gift card sales on a single transaction and require manager approval above a set amount. Gift cards are the easiest way to turn a stolen card into cash.
• Train seasonal staff on day one. Five minutes on these four rules prevents more fraud than any software setting.

What Should Happen at the Online Checkout?

Card-not-present fraud is where most small retailers lose money, because there’s no chip to protect you. If you sell online through WooCommerce, Shopify, or another platform, check these settings before the rush:

• Require the CVV code and decline orders where it doesn’t match.
• Turn on address verification (AVS) and review orders where the billing ZIP code doesn’t match.
• Add velocity limits and a CAPTCHA to stop “card testing” — bots running hundreds of small authorizations to find live stolen cards. Card testing can generate a wave of declines and fees in a single night.
• Flag mismatched billing and shipping addresses on large first-time orders, especially rush or overnight shipping to a freight forwarder.
• For buy-online-pick-up-in-store, check photo ID against the cardholder name, and don’t release orders to “a friend” without the original buyer’s confirmation.

What About Refunds and Returns?

Refund fraud peaks in January, when holiday returns arrive. Two rules close most of the gap:

• Refund to the original card only. Refunding a card purchase in cash or to a different card is one of the most common fraud schemes against retailers.
• Restrict who can issue refunds on the terminal. Every modern terminal and POS supports a manager password for refunds. If yours doesn’t have one set, set it now.

What Should You Check on Your Statement Afterward?

Look at your December and January statements for chargebacks, retrieval requests, and spikes in declined-authorization fees. A sudden jump in small declined transactions often means a card-testing attack hit your online store. If you can’t tell what a fee is, that’s a problem in itself — our guide to hidden processing fees explains the usual suspects, and you can check your overall cost with our fee calculator.

Frequently Asked Questions

Who pays when a fraudulent holiday sale turns into a chargeback?

Usually the merchant. For card-present sales where you dipped or tapped the chip, counterfeit-fraud liability generally shifts to the card issuer. For online and keyed-in sales, the merchant typically absorbs the loss plus a chargeback fee.

Is it worth turning on AVS and CVV checks if they slow down checkout?

Yes. Both checks run in the background during authorization and add no extra steps for legitimate customers. They are among the cheapest fraud protections available to online sellers.

What is card testing?

Card testing is when fraudsters use bots to run many small transactions on your checkout to find out which stolen card numbers still work. It can leave you with authorization fees and, later, chargebacks. CAPTCHA, velocity limits, and requiring CVV help stop it.

Can DL Payments help set up fraud tools on my existing system?

Yes. We review your terminal, gateway, and online checkout settings as part of our free statement review, and help you turn on the protections your current setup already supports.