The rising threat of AI in e-commerce fraud – and how to combat it

To protect your margins and customer trust, a proactive, ecosystem-wide approach is now essential.

For smaller businesses with limited budgets, transaction monitoring is the first line of defence. While basic onboarding screening is useful, it rarely catches a sophisticated synthetic ID. Robust monitoring identifies red flags after the fact, such as a 'good' account suddenly making multiple small, rapid-fire transactions or frequent chargebacks.

AI can steal a password, but it struggles to replicate the subconscious way a human interacts with a device. Analysis of keystroke dynamics (typing rhythm) and navigation patterns can flag an AI bot even if it has the correct login credentials.

Criminals collaborate; merchants must do the same. This means:

• Intelligence sharing: Moving past the 'silo' mentality to share data on known fraudulent networks.
• Hybrid AI models: AI must be beaten by AI, but human oversight remains critical. The EU AI Act and similar UK guidance highlight that AI cannot be left to run without human checks to catch new, 'out-of-the-box' phishing tactics.

In the past, customers were verified at sign-up and then left alone. But as synthetic identities 'mature' over months, the standard in 2026 is moving toward continuous Electronic Identity Verification (eIDV).

• What it is: Instead of a single snapshot at onboarding, your system periodically 'checks in.' It looks for anomalous changes in a customer’s data profile, like a sudden change in email domain to a disposable one or a phone number switching to a Voice over IP (VoIP) service.
• Why it works: It catches 'sleeper' accounts that were created legally but have since been taken over or 'ripened' for a large-scale fraud attempt.

AI-generated 'damaged goods' photos are a rising headache. Fraudsters now use generative AI to create realistic images of broken electronics or 'empty boxes' to claim refunds without returning anything.

• The fix: Use machine vision tools that scan return photos for 'AI artefacts' (microscopic inconsistencies in pixels that humans can't see).
• Added layer: Require photo metadata (EXIF data) that proves the photo was taken at the customer's GPS location at a specific time, rather than being a generated file.

Since deepfake voice technology is now so accessible, a phone call from a 'manager' or a 'VIP customer' can no longer be taken at face value.

• The strategy: Establish an internal rule that no sensitive action—like an emergency password reset or a high-value refund override—can be triggered by voice alone.
• The 'Out-of-Band' check: If a customer calls with a high-stakes request, the agent must send a verification code to the customer’s registered app or secondary email before proceeding.

Fraud is rarely an isolated incident; it’s usually a network. Graph Neural Networks (GNNs), like Ecommpay’s award-winning solution, help you see the invisible links between seemingly unrelated accounts.

• The power of connection: A GNN can flag that three different accounts, with different names and addresses, all happen to use the same device fingerprint or have logged in from the same obscure IP range within the same hour.
• Ecosystem protection: This is where the 'Me to We' shift happens. By seeing these clusters, you can block an entire network of bots before they even reach the checkout.

The threat is no longer a technical one; it is a systemic challenge at the intersection of psychology, technology, and regulation. By moving from reactive reimbursement to proactive, intelligence-led prevention, you can protect your business from the industrialised scale of modern fraud.