Fraud follows growth. A few habits keep most problems away.
For store owners
- Take payments only through a trusted gateway.
- Ship only after the gateway confirms payment, not after a screenshot.
- Review orders with mismatched addresses, unusually large quantities or rushed shipping.
- Give each staff member a separate admin login with two-step verification.
For buyers
- Check the web address and contact details before paying.
- Never share an OTP, PIN or password with anyone, even someone claiming to be support.
If something goes wrong
Stop contact, save evidence, tell your bank and report it officially. Speed matters.
Why online stores attract fraud
Online selling removes the face-to-face moment that quietly protects physical shops. You cannot see the person, check a signature or feel the notes. Fraudsters know this, and they target stores in predictable ways: stolen cards, fake payment confirmations, account takeovers, refund abuse, reseller scams and impersonation of the store itself. At the same time, customers face their own risks: fake shops, copied websites, fraudulent payment links and messages pretending to be from couriers or support.
Good news: most fraud follows patterns, and a handful of habits stops the large majority of it. The sections below cover the main types of fraud, how to spot them and what to do, first for owners and then for buyers.
Fraud aimed at store owners
Stolen card orders and chargebacks
A criminal uses a stolen card to buy goods, ideally items that are easy to resell. Weeks later the real cardholder disputes the charge, the payment is reversed and you lose both the money and the goods, plus a fee. Warning signs include unusually large orders from new accounts, shipping to an address different from billing, several attempts with different cards, rush shipping requests and mismatched email, name and location.
What helps: use a reputable gateway with built-in risk screening, enable address and card security code checks, review high-value or unusual orders before shipping, set limits on quantity and value for new customers and keep proof of delivery. For expensive items, use signature on delivery.
Fake payment confirmations
A buyer sends a screenshot of a transfer or a payment-app confirmation and asks you to ship. The screenshot is edited or the payment was never completed. What helps: never rely on a screenshot. Confirm the amount inside your own bank or gateway dashboard before dispatching, and be especially careful when someone claims to have sent too much money and asks you to refund the difference.
Overpayment and refund scams
The buyer “accidentally” pays more than the price and asks for a refund of the extra amount. Later the original payment fails or is reversed, and you are out of pocket. What helps: refund only to the original payment method, only after funds have cleared and only for the exact excess.
Account takeover
Criminals use passwords leaked from other sites to log in to customer accounts, steal saved addresses and place orders with saved details. What helps: rate-limit login attempts, support two-step verification, notify customers of new logins and require re-confirmation before changing addresses or payment details.
Refund and return abuse
Some buyers claim items never arrived, return empty boxes or swap products. What helps: clear return rules, photo evidence for damage claims, serial numbers for high-value goods, tracked delivery and a record of every case so repeated offenders are visible.
Impersonation of your store
Scammers copy your website, buy lookalike domains or run social media accounts that use your name and logo to collect money. What helps: register obvious variants of your domain, monitor search results and social platforms for copies, report fake sites to hosts and platforms and tell customers where your real accounts are. Put your official links on your invoices and packaging.
Staff and insider risks
Shared passwords, former employees who still have access and staff who can issue refunds without limits all create openings. What helps: separate logins, role-based permissions, approval for large refunds, logs of who did what and immediate removal of access when someone leaves.
Software vulnerabilities
Attackers also go after the store itself, as seen in the October 2026 PHP alert. An unpatched server or plugin can let someone steal data or plant malicious code. What helps: keep the platform, plugins and server language updated, remove unused software, scan regularly and keep tested backups off the server.
Fraud aimed at buyers, and how stores can help
Customers who get scammed in your name blame you, even when it was not your fault. Help them protect themselves:
- Publish your official website, WhatsApp number, email and social links on one page and on every invoice.
- State clearly that you will never ask for OTPs, passwords or card PINs and that payment happens only on your checkout.
- Warn customers about fake delivery messages that ask them to pay a small fee to a link.
- Use a payment page hosted by your gateway so customers see a familiar, secure screen.
Practical safety checklist for store owners
- Use a trusted payment gateway and never store full card numbers yourself.
- Turn on fraud tools: address checks, security code checks and rules for high-risk orders.
- Ship only after funds are confirmed in your dashboard.
- Review orders that look unusual before dispatching.
- Give every staff member a separate login with limited permissions and two-step verification.
- Keep PHP, your platform and plugins updated and take off-server backups.
- Protect your domain and email accounts with strong passwords and two-step verification, because losing them means losing control of your store.
- Monitor for lookalike domains and fake social accounts.
- Keep delivery proof and customer communication records for disputes.
- Write an incident plan so everyone knows who to call and what to do.
What to do if you are scammed
Time matters, so act in this order.
- Stop. Do not reply further, send money, share codes or click new links.
- Preserve evidence. Save screenshots, emails, chat messages, phone numbers, transaction IDs and order records.
- Contact your bank or gateway immediately. Ask whether the payment can be held, reversed or flagged. The first hours are the most useful.
- Secure your accounts. Change passwords and keys if there is any chance they were exposed.
- Report it. Use your country’s official cyber-crime portal or helpline and, where appropriate, local police. Many places have dedicated reporting channels for online financial fraud.
- Inform affected customers if their data or orders may be involved.
- Learn and adjust. Update your rules so the same trick fails next time.
Building a store customers trust
Trust is the best long-term defence. Show a real business address, working contact channels, clear policies and honest reviews. Respond fast, resolve problems fairly and keep your promises on delivery. A store that looks and behaves like a real, reachable business is harder to impersonate and easier for customers to defend against scammers.
How NNT Mart helps
NNT Mart builds online stores and Android and iOS apps with trusted payment gateways, role-based admin access, order review rules and maintenance plans that include patching, backups and monitoring. If you want a security review of your store or help setting up fraud rules and a safer checkout, contact us through the form or WhatsApp. We reply within minutes.
How NNT Software can help
On NNT Mart stores we use gateway-hosted payment pages so card numbers never touch your server, role-based admin access so each staff member has their own login, and order review rules for unusual baskets. Under a support plan we also handle patching, off-server backups and monitoring. If you suspect a problem on a store we did not build, we can review users, files and logs and tell you what we find.