Fraud prevention on a Magento or Adobe Commerce store running Hyva comes down to three layers working together: native controls (AVS, CVV, reCAPTCHA, velocity limits), a 3D Secure 2 flow that shifts chargeback liability to the card issuer, and a machine-learning decision platform such as Signifyd, Riskified, or NoFraud that scores every order and, on the paid tiers, guarantees the ones it approves. The hard part is adding that protection without slowing the Hyva checkout you paid to make fast.
High-volume merchants lose more to fraud than the raw refund suggests. Recent LexisNexis True Cost of Fraud research has put the fully loaded cost at roughly four dollars for every one dollar of fraud once you count chargeback fees, re-shipping, restocking, and the staff hours spent fighting disputes. A store clearing seven figures a month cannot treat this as a checkbox. This guide covers what Magento gives you natively, where the paid platforms earn their fee, how each pricing model actually works, and the Hyva-specific engineering that keeps fraud scoring off your critical rendering path.
The three-layer fraud stack for Magento and Hyva
Think of fraud defense as layers, each catching what the one before it misses.
Layer one is native and free. Magento Open Source and Adobe Commerce both ship gateway-level Address Verification Service (AVS) and CVV checks, native Google reCAPTCHA on login, registration, and checkout, two-factor authentication for the admin, and order-status rules you can use to hold suspicious orders for manual review. None of this costs a license. Most stores under-configure it.
Layer two is authentication. 3D Secure 2 (3DS2) asks the card issuer to authenticate the shopper during payment. When authentication succeeds, liability for a fraudulent chargeback shifts from you to the issuing bank. Modern 3DS2 is risk-based, so the majority of genuine customers are approved frictionlessly and never see a challenge screen. This is the single highest-impact control most merchants skip because they fear it hurts conversion. On a well-tuned flow, it usually does not.
Layer three is a decision platform. Signifyd, Riskified, Sift, NoFraud, and MaxMind minFraud score each order in real time using device fingerprinting, IP intelligence, email and phone reputation, and models trained across large merchant networks. On guarantee tiers, the vendor reimburses you for any approved order that later charges back as fraud. This is where high-volume stores get the most protection and the biggest bill.
The layers are additive. Native controls stop the crude attempts, 3DS2 moves liability on the risky-but-genuine orders, and the decision platform makes the approve/decline/review call on everything else and stands behind it financially.
What Magento gives you before you buy anything
Before evaluating a platform, exhaust the native toolkit. On most stores it is doing half its job.
- AVS and CVV mismatch rules. Configure your gateway to decline, not just flag, hard AVS and CVV mismatches for card-not-present orders.
- reCAPTCHA everywhere it matters. Magento’s native reCAPTCHA belongs on login, create-account, checkout, and coupon apply. Carding attacks and credential stuffing hit these endpoints first.
- Velocity limits. Cap orders per card, attempts per IP, accounts per device, and redemptions per coupon. Card testing shows up as a spike in tiny declined authorizations. Rate limiting at your WAF or CDN, plus these caps, blunts it.
- Manual review states. Use a held order status for anything your rules flag, and give your team a clear queue rather than letting borderline orders auto-ship.
If you are running the store yourself and unsure whether these are configured correctly, a review of your payment and checkout configuration is part of a standard Magento hardening pass. Bemeir handles this alongside broader security work as the USA’s first Hyva Gold Partner.
Signifyd vs Riskified vs NoFraud vs the rest
The decision platforms differ less in what they claim and more in how they price and where they excel. None publish a public rate card; all require a sales conversation. The comparison below reflects how each is positioned and typically deployed.
| Platform | Guarantee model | How it prices | Best fit | Notes |
|---|---|---|---|---|
| Signifyd | 100% financial guarantee on approved orders | Percentage of covered order value | Enterprise and high-volume merchants wanting broad coverage and deep manual-review capacity | Natively integrated with Payment Services for Adobe Commerce |
| Riskified | Chargeback guarantee on approved orders | Percentage of approved order value | High-volume stores that optimize hardest for approval rate | Incentive aligns to approving more good orders, recovering false declines |
| NoFraud | Guarantee with human review on borderline orders | Transparent tiers from a low monthly floor | Mid-market merchants wanting predictable pricing without a fraud team | Human-in-the-loop review claws back false declines |
| Sift | Risk scoring (guarantee optional) | Usage / order volume | Teams that want to build custom risk rules on top of scores | More platform than turnkey guarantee |
| MaxMind minFraud | Risk score only, no guarantee | Per-query | Merchants who want a cheap scoring signal and own the decision | Pairs well with in-house review rules |
The economics are simple to reason about. A guarantee provider absorbs your fraud chargebacks in exchange for a percentage of GMV. If your fraud losses plus the labor to fight disputes exceed that percentage, the guarantee pays for itself and removes the operational drag. If your fraud rate is already low and your team is fast, a score-only tool like minFraud plus tight native rules can be far cheaper. The wrong move for a high-volume store is doing neither and eating the chargebacks.
One nuance on Riskified’s model: because it charges on approved order value, its commercial incentive is to approve as many good orders as it safely can. For a store whose real pain is false declines, good customers wrongly turned away, that alignment matters more than a headline guarantee rate.
The Hyva problem: fraud scripts on your critical path
Here is where platform choice meets frontend engineering. Every decision platform loads a device-fingerprinting script to collect signals: IP, browser, operating system, screen resolution, and behavioral data. Loaded carelessly, that script blocks rendering and taxes the exact Core Web Vitals a Hyva theme exists to protect.
On a Hyva storefront, the rules are strict for a reason. Hyva ships with a Content Security Policy and, on Hyva Checkout, Alpine CSP compliance using nonce-based inline scripts. A fraud vendor’s tag that is not CSP-aware either gets blocked outright or forces you to loosen the policy, which is the wrong trade. Well-built fraud integrations for Hyva, including CyberSource-style payer authentication modules for Hyva Checkout 1.3 and later, handle 3DS2 inline during place-order and stay strict-CSP and Alpine-CSP compliant.
The engineering patterns that keep fraud scoring fast on Hyva:
- Load the fingerprint script asynchronously and defer it so it never blocks Largest Contentful Paint on the checkout entry.
- Fire the risk decision at place-order, not on page load. You do not need a verdict until the shopper commits. Scoring earlier just adds a network round trip to a page you want interactive.
- Keep the tag CSP-compliant. Use the vendor’s Hyva-ready module or wrap the script with the correct nonce rather than adding
unsafe-inlineto your policy. - Cache what you can. The decision call is dynamic and private, so keep it out of full page cache and treat it like any other private-content fetch on Hyva.
If a fraud vendor tells you their only integration path is a synchronous tag in the head with a relaxed CSP, that is a signal to pick a different vendor or a Hyva-compatible connector. Bemeir routinely adapts third-party modules to Hyva and keeps payment and fraud flows on the fast path; that adaptation work is the same discipline behind our technology partner integrations, where fraud, payments, and personalization vendors all have to coexist without degrading the storefront.
Chargebacks: prevention, representment, and friendly fraud
Stopping fraudulent orders is half the battle. The other half is managing disputes that arrive anyway, including chargebacks from real customers who simply forgot a purchase or want a refund the easy way. That last category, friendly or first-party fraud, is now one of the largest dispute sources and is not stopped by any pre-authorization tool.
Two habits protect you:
- Keep evidence for representment. For every order, retain AVS/CVV results, 3DS2 authentication data, device and IP records, delivery confirmation, and customer communication. When a chargeback is friendly fraud, this package is what wins representment with the issuer. Guarantee platforms handle this for orders they approved; for everything else, your team needs the documentation ready.
- Watch your dispute ratio. Card networks run monitoring programs, Visa’s Acquirer Monitoring Program and Mastercard’s Excessive Chargeback Program among them, and merchants who cross the dispute-ratio thresholds face fines and, at the extreme, processing restrictions. A high-volume store should track its ratio monthly, not discover a problem when the acquirer emails.
Representment is winnable more often than merchants assume, but only when the evidence was captured at order time. Design your order data retention for the dispute you hope never comes.
B2B fraud is a different shape
If you run wholesale on Adobe Commerce B2B, your fraud profile is not the consumer one. Card testing matters less; account takeover, fraudulent net-terms applications, and unauthorized purchasing on company accounts matter more. Controls shift toward company-account approval workflows, spending limits per buyer, and verification at credit-application time rather than per-transaction card scoring. If net terms and company credit are part of your model, the controls that protect you live in the payment-on-account and company-credit workflow as much as in any fraud-scoring tool.
Platform note: this is not only a Magento concern
Fraud strategy travels across platforms. The layered model, native controls, 3DS2, and a decision platform, applies whether you run Magento, Shopify, BigCommerce, or Shopware. What changes is the integration surface: how the fingerprint script loads, how 3DS2 is invoked, and how private the decision call has to stay. On Hyva the bar is higher because the theme is strict about CSP and protective of Core Web Vitals, which is exactly why the vendor’s integration quality, not just its guarantee rate, should drive your choice. For the full picture of how Bemeir builds and secures ecommerce storefronts, start at our homepage.
Frequently asked questions
Does Signifyd work natively with Adobe Commerce?
Yes. Signifyd integrates its Commerce Protection Platform with Payment Services for Adobe Commerce, so it is an integrated fraud-protection provider for merchants on that payments path. On its guarantee tier, Signifyd provides a 100% financial guarantee against fraud on the orders it approves. On Magento Open Source you connect it through its extension rather than the native Payment Services path.
Will 3D Secure hurt my conversion rate?
Usually not, if it is tuned. 3DS2 uses risk-based authentication, so most genuine shoppers are approved without a challenge. The upside is large: when authentication succeeds, chargeback liability for that transaction shifts to the card issuer. Poorly configured 3DS1-style flows that challenge everyone do hurt conversion, which is why the version and configuration matter.
How do I add a fraud tool to Hyva without slowing checkout?
Use a Hyva-compatible, CSP-aware module, load the device-fingerprint script asynchronously and deferred, and fire the risk decision at place-order rather than on page load. Keep the decision call out of full page cache as private content. Avoid any vendor whose only option is a synchronous head tag that forces you to weaken your Content Security Policy.
What is the real cost of a chargeback?
More than the order. Recent LexisNexis True Cost of Fraud research has put the fully loaded figure at roughly four dollars for every dollar of fraud once you add chargeback fees, re-shipping, restocking, and dispute-handling labor. High dispute ratios also risk card-network fines under programs like Visa’s Acquirer Monitoring Program.
Signifyd or Riskified for a high-volume store?
Both guarantee approved orders. Choose Signifyd for broad enterprise coverage, deep manual-review capacity, and the native Adobe Commerce Payment Services integration. Choose Riskified if your primary pain is false declines and you optimize hardest for approval rate, since its pricing on approved order value aligns it to approving more good customers. For mid-market stores wanting predictable pricing, NoFraud is worth a look.
Can I just use MaxMind minFraud and skip the guarantee?
Yes, if your fraud rate is low and your team can review borderline orders quickly. minFraud gives you a risk score per query at low cost and leaves the decision and the liability with you. The guarantee platforms cost more but remove both the decision burden and the chargeback risk, which is usually the right trade once fraud losses and review labor exceed the vendor’s percentage of GMV.
The takeaway
Fraud protection on Magento and Hyva is a stack, not a product. Configure the native controls you already own, turn on a properly tuned 3DS2 flow to shift liability, and add a decision platform sized to your volume and your tolerance for false declines. Then make sure whichever platform you choose integrates the Hyva way: CSP-compliant, asynchronous, and decided at place-order, so the protection never costs you the speed. If you want that built and verified by a team that adapts fraud and payment modules to Hyva every week, that is the work Bemeir does.
