E-Commerce Fraud Attack Rates Hit New Highs in 2017

by Traci Krepper 5 min read April 10, 2018

e-commerce attacksWith 16.7 million reported victims of identity fraud in 2017 (that’s 6.64 percent of the U.S. population), it was another record year for the number of fraud victims. And as online and mobile transaction growth continued to significantly outpace brick-and-mortar growth, criminal attacks also grew rapidly. This past year, we saw an increase of more than 30 percent in e-commerce fraud attacks compared with 2016.

As we’ve done over the past three years, Experian® analyzed millions of online transactions to identify fraud attack rates for both shipping and billing locations across the United States. We looked at several data points, including geography and IP address, to help businesses better understand how and where fraud is being perpetrated so they can better protect against it.

The 2017 e-commerce fraud attack rate analysis shows:

  • Delaware and Oregon continue to be the riskiest states for both billing and shipping fraud.
  • Delaware; Oregon; Washington, D.C.; Florida; and Georgia are the top five riskiest states for billing fraud.
  • Delaware, Oregon, Florida, New York and California are the top five riskiest states for shipping fraud, accounting for 50 percent of total fraud attacks.
  • South El Monte, Calif., is the riskiest city overall, with an increase in shipping fraud of approximately 230 percent.
  • Shipping fraud most often occurs near major airports and seaports due to reshippers and freight forwarders that receive domestic goods and often send them overseas.
  • When a transaction originates from an international IP address, shipping fraud is 6.7 times likelier than the average, while billing fraud becomes 7.1 times likelier.

Where is e-commerce fraud happening?

Typically, the highest-risk areas for fraud are in ZIP™ codes and cities near large ports of entry or airports. These are ideal locations to reship fraudulent merchandise, enabling criminals to move stolen goods more effectively.

Top 10 riskiest billing ZIP™ codes   Top 10 riskiest shipping ZIP™ codes
97252 Portland, OR 97079 Beaverton, OR
33198 Miami, FL 33122 Miami, FL
33166 Miami, FL 91733 South El Monte, CA
33122 Miami, FL 97251 Portland, OR
77060 Houston, TX 97250 Portland, OR
33195 Miami, FL 33166 Miami, FL
97250 Portland, OR 97252 Portland, OR
97251 Portland, OR 33198 Miami, FL
33191 Miami, FL 33195 Miami, FL
97253 Portland, OR 33192 Miami, FL
Source: Experian.com Source: Experian.com

What’s more, many of the riskiest ZIP™ codes and cities experience a high volume of transactions originating from international IP addresses. In fact, the top 10 riskiest ZIP codes overall tend to experience fraudulent activity from numerous countries overseas, including China, Venezuela, Taiwan and Hong Kong, and Argentina. These fraudsters tend to implement complex fraud schemes that can cost businesses millions of dollars in fraud losses. Additionally, the analysis shows that traffic coming from a proxy server — which could originate from domestic and international IP addresses — is 74 times riskier than the average transaction.

The problem

The increase in e-commerce fraud attacks shouldn’t come as a huge surprise. The uptick in data breaches, merchants’ continued adoption of EMV-enabled terminals to protect against counterfeit card fraud and the abundance of consumer data on the dark web means that information is even more accessible to criminals. This enables them to open fraudulent accounts, take over legitimate accounts and submit fraudulent transactions. Another reason for the increase is automation. In the past, criminals needed a strong understanding of fraud methods and technology, but they can now bring down an entire organization by simply downloading a file and automating the submission of thousands of applications or transactions simultaneously.

Since fraudsters need to make these transactions appear as normal as possible, they often leverage the cardholder’s actual billing details with slight differences, such as e-mail address or shipping location. Unfortunately, the mass availability of compromised data and the abundance of fraudsters makes it increasingly challenging to identify and separate legitimate customers from attackers across the country. Because of the widespread prevalence of fraud and data compromises, we don’t see billing fraud concentrated in just one region of the country. In fact, the top five states for billing fraud make up only about 18 percent of overall fraud attacks.

Top 5 riskiest billing fraud states   Top 5 riskiest shipping fraud states
State Fraud attack rate State Fraud attack rate
Delaware 93.4 Delaware 195.9
Oregon 86.1 Oregon 170.1
Washington, D.C. 46.5 Florida 45.1
Florida 39.2 New York 37.3
Georgia 31.5 California 32.6
Source: Experian.com Source: Experian.com

Prevention and protection need to be the priority

As businesses get a better understanding of how and where fraud is perpetrated, they can implement proactive strategies to detect and prevent attacks, as well as protect payment information. While no one single strategy can address the entire scope of fraud, there are advanced data sets and technology — such as device intelligence, behavioral and physical biometrics, document verification and entity resolution — that can help businesses make better fraud decisions.

Fortunately, consumers can also play a major role in safeguarding their information. In addition to regularly checking their credit reports and bank/credit card statements for fraudulent activity, consumers can limit the data they share on social networking sites, where attackers often begin when perpetrating identity fraud.

While we continue to help both organizations and consumers limit their exposure to e-commerce fraud, we anticipate that criminals will attempt more sophisticated fraud schemes. But businesses can stay ahead of the curve. This comes down to having a keen understanding of how fraud is being perpetrated, as well as leveraging data, technology and multiple layered strategies to better recognize legitimate customers and make more precise fraud decisions.

View our e-commerce fraud heat map and download the top 100 riskiest ZIP codes in the United States.

Experian is a nonexclusive full-service provider licensee of the United States Postal Service®. The following trademark is owned by the United States Postal Service®: ZIP. The price for Experian’s services is not established, controlled or approved by the United States Postal Service.

Related Posts

Ask the Expert: The Future of Lending Starts With Identity With Shawn Rife and Brian Cardona

Identity intelligence and alternative data can help lenders validate consumers and support more informed decisions across the customer lifecycle.

September 16, 2026 by Julie Lee
Financial Institutions Are Rethinking Customer Acqusition

Customer acquisition strategies are constantly evolving toward more precise targeting. From a marketing lens, you can track every step, optimize communication channels and still miss the person most likely to convert. Attribution can tell us which channels work and automation can make marketing spend more efficient. But both assume we know who is actually on the other end. Financial institutions are learning that finding audiences and targeting them is no longer the biggest challenge. As acquisition optimization marketing becomes more sophisticated, teams can measure and act on more signals than before. What they can't always know is whether the person on the receiving end is real. Customer acquisition has evolved into an identity problem. The challenge is not that every questionable signal represents malicious activity. It's that acquisition systems must make increasingly intelligent decisions with an imperfect understanding of who they're actually engaging. When identities are fragmented, duplicated, temporary or synthetic, optimization becomes a question of trust as much as targeting. When your signals don't reliably identify customers The customer journey often includes searching, filling out a form, creating an account, requesting a quote and subscribing. All of these signals work well when identity is relatively stable.  However, financial institutions are finding that these signals are becoming less reliable. A single person can operate across multiple personas, devices, browsers, aliases, accounts and intermediaries while several apparent “people” may actually represent one underlying actor. Financial instituions are finding: Fragmented customer signals Difficulty distinguishing an old account from a new one Different digital pathways associated with the same individual Signals that are generated by automation Real customers getting flagged because signals are too thin to evaluate confidently Legacy signals continue to be challenged Marketing has historically treated intent as a valuable signal because intent was relatively difficult to produce. A search required human intent. A form required someone to fill it out. An inquiry implied a meaningful amount of human effort. Financial institutions are already combating AI-enabled fraud, and now marketing teams are starting to face it on a massive scale. AI can mimic human behavior by researching products, comparing prices, filling out forms, creating accounts and signing up for services. A valid email address is no longer enough. Marketers need to know: How long has it existed? How recently has it been active? Does its activity appear consistent or suddenly anomalous? Has it gone dormant and returned? Is it associated with patterns that suggest stability or unusual behavior? How to build on your strongest signal Email remains one of the most persistent identifiers in digital commerce, following people across devices, platforms, transactions, subscriptions, accounts and years of activity. For over two decades, this has shaped how AtData thinks about identity. Now, as part of Experian, it’s shaping how an entire platform and team approach identity. A marketer doesn’t need every prospect to have existed online for twenty years. But understanding whether a newly acquired prospect has meaningful identity context can dramatically improve the quality of the decision being made around it. Better identity intelligence can help organizations reduce unnecessary friction by improving their ability to recognize legitimate customers. With a strong identity foundation, marketing teams can better address: Which audiences are more likely to convert? Which leads are high quality? Which channels are driving incremental growth? What do the best prospects look like? The value isn't simply having an email address. It's understanding the history and behavioral context associated with it. That context can provide a stronger digital identity signal, helping marketers understand how long they have been active, whether its behavior is consistent with that of a real person and whether current activity aligns with past patterns. It continues to be one of the most persistent identifiers in digital commerce. An infrastructure built for what's coming The acquisition of AtData by Experian reflects a fundamental shift in how identity infrastructure needs to work. Experian's scale and decisioning capabilities, combined with AtData's real-time email intelligence, create a strong platform. Read more about the why behind the acquisition and see how email works as an identity anchor for fraud prevention. Contact us to learn about our customer acquisition solutions

September 15, 2026 by Zohreen Ismail
As Electric Vehicle Adoption Eases, Dealers Can Find New Opportunities To Reach Consumers

After years of rapid growth, new electric vehicle (EV) registrations have moderated, and the EV market has entered a new chapter. But slower growth shouldn’t be mistaken for disappearing demand, with data suggesting the reality is much more nuanced. According to Experian Automotive’s Automotive Consumer Trends Report: Q2 2026, battery EVs accounted for 8.21% of new retail registrations in the last 12 months, down from 9.23% a year earlier. However, consumers aren’t simply walking away from electrification. In fact, more than one million new EVs were registered during the past 12 months and the used EV market recorded more than 540,000 registrations over the same period. The opportunity may be less about waiting for the EV market to grow and more about understanding where EV demand is present, who is driving them, and how to reach those consumers more effectively. Who is likely to purchase an EV and what vehicle types are they interested in? Understanding who’s in the market for an EV can allow dealers to position themselves around consumers’ needs as they choose a vehicle that fits their everyday lifestyle. In the second quarter of 2026, Millennials and Gen X accounted for 67.83% of new EV registrations, nearly 10 percentage points above their combined share of all new, retail registrations. Millennials were also the largest generational audience across both new and used EV market share, coming in at 35.76% and 38.42%, respectively. It’s important to consider that the EV shopper isn’t necessarily looking for an unfamiliar or new type of vehicle. In many cases, they’re seemingly looking for an electric version of the practical vehicle they already know. For instance, SUVs accounted for 77.47% of new EV registrations in Q2 2026, which was similar to SUVs’ 63.49% share of all new retail registrations. For these shoppers, creating messaging around value, practicality, and available choices may resonate differently than premium technology messaging aimed at some new-EV prospects. The more precisely dealers can identify those audiences, the less they need to depend on broad EV market momentum to generate demand. To learn more about EV insights, view the full Automotive Consumer Trends Report: Q2 2026 presentation.

September 15, 2026 by Kirsten Von Busch

Subscribe to our Newsletter

Enter your name and email for the latest updates.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Subscribe to our Newsletter

Don't miss out on the latest industry trends and insights!
Subscribe