Verify payments by checking the transaction details against your payment processor's records in real time

The fastest way to catch a fraudulent payment is to confirm it exists in your processor's system before you fulfill the order. When a customer claims they paid, log into your payment gateway—Stripe, Square, PayPal, or whatever you use—and search for the transaction by amount, date, and customer name. A real payment will show a confirmation number, a timestamp, and a status of "completed" or "settled". A fake one will not appear at all, or will show as "pending" or "failed".

Do not rely on a screenshot or email receipt the customer sends you. Those can be forged in minutes. Your payment processor's dashboard is the source of truth. If the transaction does not exist there, the payment did not go through, no matter what the customer claims.

Set a rule: do not ship, deliver, or unlock access to anything until you have personally confirmed the transaction in your processor's system. This takes 30 seconds and stops most fraud before it costs you.

Key Takeaways

  • Check every payment in your processor's dashboard before fulfilling an order—a real transaction will show a confirmation number and "completed" status.
  • Screenshots and email receipts are easy to forge; your payment processor's records are the only verification that matters.
  • Set up automatic payment status notifications so you know immediately when a transaction settles, rather than waiting for a customer to tell you.
  • For high-value orders, use address verification (AVV) and card verification codes (CVV) to reduce the risk of stolen card fraud.
  • If a payment shows as "pending" or "failed" in your system, do not process the order—contact the customer and ask them to pay again.

Use your payment processor's built-in verification tools

Most payment gateways offer automatic checks that run on every transaction. These include Address Verification Service (AVS), which compares the billing address the customer entered against the address on file with their card issuer, and Card Verification Value (CVV), which confirms the three- or four-digit security code on the back of the card matches the card number.

These tools are not foolproof—a thief with a stolen card and the victim's personal information can pass both checks—but they catch the majority of casual fraud. Most processors let you set rules: reject all transactions that fail AVS, or flag them for manual review. For high-value orders, require both AVS and CVV to pass before the payment is accepted.

Check your processor's settings to see what verification is currently enabled. Many platforms turn on basic checks by default, but you may need to adjust the strictness. Stripe, for example, lets you choose whether to accept "partial" matches on address verification or require an exact match.

Watch for red flags in the transaction data itself

Fraudulent payments often have patterns. A customer using a card from one country but shipping to another, or placing a large order with an address that was just added to the account, or paying with a card that has never been used before—none of these are proof of fraud, but they are worth a second look.

Your processor's dashboard will show you the card type, the last four digits, the issuing bank, and the country of origin. Compare these against the shipping address and the customer's account history. If a customer who has always shipped to California suddenly orders $2,000 worth of goods to be sent to Nigeria, and pays with a card issued in Russia, that is a signal to pause and verify by phone or email before you ship.

Some processors offer fraud scoring, which assigns a risk level to each transaction based on dozens of data points. Stripe calls this Radar; Square has its own system. These tools are not perfect, but they flag transactions that match known fraud patterns. Review the score before you process high-value orders.

Require confirmation from the customer's payment method

For orders above a certain amount—$500, $1,000, whatever makes sense for your business—send a confirmation email or text to the phone number or email address associated with the card. Ask the customer to confirm they made the purchase. A real customer will respond quickly. A fraudster will not, because they do not have access to that contact information.

This step is called customer verification and it is one of the most reliable fraud checks available. It costs you nothing and takes the customer 10 seconds. Many payment processors can automate this: Stripe and Square both support sending verification codes via SMS or email that the customer must enter to complete the transaction.

If the customer does not respond to the verification request within a set time—24 hours is common—cancel the order and refund the payment. Do not assume they are busy. A legitimate customer will verify immediately to get their order moving.

Set up alerts for payment status changes

Payments do not always settle instantly. A credit card transaction might show as "authorized" for a few hours before it moves to "captured" or "settled". During that window, the payment can still fail—the customer's bank can decline it, or the card can be reported stolen. If you ship before the payment fully settles, you could end up with a chargeback and no merchandise.

Configure your processor to send you an email or webhook notification the moment a payment status changes. This way you know in real time when a transaction has fully settled and is safe to process. Do not rely on the customer to tell you the payment went through. Let your processor tell you.

Most processors send these notifications by default, but check your settings to make sure they are turned on. If you use a shopping cart or order management system on top of your processor—like Shopify, WooCommerce, or BigCommerce—configure it to only mark an order as "paid" once the processor confirms the payment has settled, not just been authorized.

Understand the difference between authorization and settlement

Authorization means the customer's bank has approved the charge and set aside the funds. Settlement means the money has actually moved from the customer's account to yours. These are not the same thing, and the gap between them matters.

When a customer enters their card details and clicks "pay", the processor sends an authorization request to the card issuer. If approved, the processor shows you a confirmation number and the transaction appears in your dashboard as "authorized" or "pending". At this point, the money is not in your account yet. It is held by the card issuer, waiting for you to "capture" or "settle" the transaction.

Settlement usually happens within 24 to 48 hours, but it can take longer. During that time, the customer's bank can still reverse the charge if the card was reported stolen, if the customer disputes the transaction, or if the authorization expires. Only after settlement is complete should you consider the payment final and safe to process the order.

Some processors let you authorize a payment without immediately capturing it. This is useful if you want to verify the customer's information before taking their money. But if you do this, set a reminder to capture the payment within a few days, or the authorization will expire and you will have to ask the customer to pay again.

Use 3D Secure for online card payments

3D Secure (also called 3DS or Verified by Visa, Mastercard SecureCode, etc.) is an extra layer of authentication that requires the customer to prove they own the card. When you enable 3D Secure, the customer is redirected to their bank's website during checkout and asked to enter a password, answer a security question, or approve the transaction on their phone.

This step is annoying for legitimate customers—it adds 30 seconds to checkout—but it stops most card fraud cold. A thief with a stolen card number cannot complete the 3D Secure step because they do not have access to the customer's bank account or phone. Many processors now require 3D Secure for certain transactions, especially those over a certain amount or from high-risk countries.

Enable 3D Secure for all transactions, or at minimum for orders over a threshold amount. Your processor can handle the setup. The trade-off is a small increase in checkout friction, but the fraud reduction is worth it.

Frequently Asked Questions

What should I do if a payment shows as "pending" in my processor's dashboard?

Do not process the order yet. A pending payment has been authorized but not settled, and it can still fail. Wait for the status to change to "completed" or "settled" before you ship or deliver. If the payment is still pending after 48 hours, contact the customer and ask them to check with their bank, or ask them to pay again with a different card.

Can a customer chargeback a payment after I have verified it in my processor's dashboard?

Yes. Verification confirms the payment was real at the moment it was processed, but a customer can still dispute it later with their bank and claim they did not authorize it or that the goods were not as described. Chargebacks are a separate process from payment verification. Keep records of all communications with the customer and proof of delivery to defend against chargebacks.

What if a customer sends me a screenshot of their payment confirmation?

Do not accept it as proof. Screenshots are easy to forge using free tools. Always verify the payment in your processor's dashboard yourself. If the transaction does not show up there, it did not happen, regardless of what the screenshot shows.

Is it safe to process a payment that failed AVS or CVV checks?

It depends on your risk tolerance. A failed check does not mean the payment is fraudulent—it could be a legitimate customer with outdated information on file. But the risk is higher. For low-value orders, you might accept it. For high-value orders, contact the customer and ask them to update their card information or use a different payment method.

How long does it take for a payment to settle after I capture it?

Usually 24 to 48 hours, but it varies by card type, bank, and processor. Credit cards often settle faster than debit cards. International transactions can take longer. Check your processor's documentation for the typical timeline. Do not assume a payment is final until your bank account shows the deposit.