Loading...

E-commerce fraud rates spike 33% in 2016

by Guest Contributor 6 min read March 28, 2017

Florida, Delaware, Oregon and New York were the riskiest states for e-commerce fraud

e-commerce fraudMiami accounted for the most ZIP Codes ranked across shipping and billing fraud.

Where is e-commerce fraud taking place? Everywhere.

Last year we reported that 2016 e-commerce fraud attack rates were on pace to surpass the 2015 totals. At the time, the fraud attack rates for the first half of 2016 appeared to be at least 15% higher than the 2015 total. That percentage turned out to be much higher as e-commerce fraud increased to 33% in 2016 compared to 2015 according to Experian data.

View our e-commerce fraud heat map
See the top 100 riskiest cities in the United States.
Download the list today

Experian analyzed millions of e-commerce transactions from our 2016 client data to identify fraud attack rates for both shipping and billing locations across the United States. The data reveals the increase of e-commerce attacks in 2016, the geographical differences, and whether a credit card has been stolen or personal credentials have been compromised. Fraud attack rates represent the attempted fraudulent e-commerce transactions against the population of overall e-commerce orders.

The 2016 e-commerce fraud attack rate data shows:

  • Miami, FL., is where the riskiest ZIP™ Code comes from for both shipping and billing e-commerce fraud. Miami accounted for 17 of the top 100 ZIP™ Codes for shipping fraud and 20 of the top 100 for billing fraud.
  • 70% of e-commerce billing fraud came from three states – Florida, California and New York – based on the sum of fraud attacks
  • Delaware, Oregon, and Florida were the top-ranked states for billing and shipping e-commerce fraud in 2016
  • Oregon and Delaware saw an increase in e-commerce billing fraud attacks of over 200%.

Many of the higher-risk ZIP™ codes and cities are located near a large port-of-entry city or airport, making them ideal locations for reshipping fraudulent goods. This includes Miami, Houston, New York City, and Los Angeles, perhaps allowing criminals to move stolen goods more effectively. All those cities are ranked among the riskiest cities for both measures of fraud attacks.

Top 10 riskiest Billing ZIP™ Codes for 2016
33198 Miami, FL
33192 Miami, FL
33195 Miami, FL
33166 Miami, FL
91733 South El Monte, CA
33191 Miami, FL
91746 La Puente, CA
17064 Port Reading, NJ
66025 Eudora, KS
89423 Minden, NV
Source: Experian.com
Top 10 riskiest Shipping ZIP™ Codes for 2016
33198 Miami, FL
33166 Miami, FL
33191 Miami, FL
33195 Miami, FL
77036 Houston, TX
33192 Miami, FL
91733 South El Monte, CA
91746 La Puente, CA
66025 Eudora, KS
62694 Winchester, IL
Source: Experian.com


What is driving credit card fraud trends?

The biggest component of this trend is the fact that 2016 was a record year for data breaches. There were 1,093 data breaches last year, a 40% increase from 2015, according to the Identity Theft Resource Center. The recent Federal Trade Commission (FTC) 2016 Consumer Sentinel Network Data Book, announced a jump in consumers who reported that their stolen data was used for credit card fraud, from 16% in 2015 to more than 32% in 2016. The record number of data breaches is a signal that future fraudulent activities will take place. This is further reflected by the increase of consumers reporting credit card fraud to the FTC in 2016. So far in 2017, that same trend continues as the total number of breaches has increased 56% compared to the same time in 2016.

See our 2016 e-commerce fraud infographic
Compare fraud attack rates — and more — from 2015 to 2016 in our latest infographic.
Download today

Why are there geographical differences in ecommerce fraud?

Most e-commerce merchants have basic controls in place to validate that transaction billing information matches a particular account holder using things like the address verification service. So from a billing or victim perspective, attackers typically leverage the legitimate cardholder billing details in a fraudulent order. In order to maximize successful fraud attacks, they need to make the transaction appear as normal as possible. But from a shipping perspective, those same fraudsters often can’t rely on shipping to the cardholder’s address and trying to intercept the package. To acquire the proceeds of their fraudulent transactions, this is where attackers get creative, often using re-shippers or shipping “mules”, freight forwarders, or delivery addresses that do not raise suspicion but are nearby international ports or airports so the fraudulent order can be quickly picked up and shipped to its final destination (often overseas). That’s why we see such a big disparity between attacks by a victim or billing address being mostly evenly spread across the country vs. shipping attacks, which are mostly concentrated in coastal states with major port cities and airports. Delaware and Oregon are two exceptions to this flattening of victim attacks, as both states saw a more than 200% increase in billing attacks with only modest increases in shipping attacks. From a shipping perspective, 10 states saw at least a 100% increase in fraudulent orders, having a significant impact on the overall population attack rate.

Top 5 riskiest Billing fraud States
State Fraud Attack Rate
Delaware 69.0
Oregon 65.7
Florida 41.1
New York 28.0
Nevada 27.0
Source: Experian.com
Top 5 riskiest Shipping  fraud States
State Fraud Attack Rate
Delaware 44.8
Oregon 43.2
Florida 34.2
Alaska 26.2
Washington, D.C. 25.8
Source: Experian.com

Has the EMV switch affected fraud ecommerce rates at all?

The increase in e-commerce fraud follows a similar trend pattern from countries that previously rolled out EMV cards – UK, France, Australia, and Canada – that also saw gradual increases in card-not-present fraud. We suspect that the EMV liability switch and increased adoption by merchants of chip-and-pin enabled terminals have had a profound impact on driving up e-commerce attacks. Fraudsters that typically relied on committing counterfeit fraud have shifted their focus to the digital channels where they could have more success.  As more fraud attackers enter a rapidly growing mobile and online commerce space, that makes it even more difficult for merchants to differentiate their good customers from the sophisticated fraud attackers.

Our annual fraud attack rate data brings to light the increase of e-commerce attacks over the last year across the US. This latest data is a strong indicator that other types of fraud have already occurred and can help businesses understand how to better protect themselves and their customers. Whether a credit card has been stolen or personal credentials have been compromised.  Businesses need to expect an increase of e-commerce fraud over time and to be prepared.

If I run an ecommerce business what should I do to prevent fraud attacks like this?

Businesses need to anticipate an increase of e-commerce fraud over time and to be prepared.  The value of employing a multi-layered approach to fraud prevention especially when it comes to authenticating consumers to validate transactions cannot be understated. By looking at all the points of the customer journey, businesses can better protect themselves from fraud, while maintaining a good consumer experience.  Most importantly, having the right fraud solution in place can help businesses prevent losses both in dollars and reputation.

That layered fraud solution should pair transactional data elements with details about the user (and their previous history and behaviors), the device (and how they typically interact with the business and even understanding what the customers are purchasing and how it relates to the overall population of orders. Machine learning and automation are great complements in a holistic hybrid approach that pairs human intelligence and business rules with machine-based recommendations. We highly recommend that organizations partner with fraud experts who have visibility across peer organizations, the challenges facing the industry, and have been instrumental in solving those problems alongside merchants.

Related Posts

Fraud is evolving faster than ever, driven by digitalization, real-time payments and increasingly sophisticated scams. For Warren Jones and his team at Santander Bank, staying ahead requires more than tools. It requires the right partner. The partnership with Santander Bank began nearly a decade ago, during a period of rapid change in the fraud and banking landscape. Since then, the relationship has grown into a long-term collaboration focused on continuous improvement and innovation. Experian products helped Santander address one of its most pressing operational challenges: a high-volume manual review queue for new account applications. While the vast majority of alerts in the queue were fraudulent and ultimately declined, a small percentage represented legitimate customers whose account openings were delayed. This created inefficiencies for staff and a poor first impression of genuine applicants. We worked alongside Santander to tackle this challenge head-on, transforming how applications were reviewed, how fraud was detected and how legitimate customers were approved. In addition to fraud prevention, implementing Experian's Ascend PlatformTM, with its intuitive user experience and robust data environment, has unlocked additional value across the organization. The platform supports multiple use cases, enabling collaboration between fraud and marketing teams to align strategies based on actionable insights. Learn more about our Ascend Platform

by Zohreen Ismail 6 min read February 18, 2026

For lenders, the job has never been more complex. You’re expected to protect portfolio performance, meet regulatory expectations, and support growth, all while fraud tactics evolve faster than many traditional risk frameworks were designed to handle. One of the biggest challenges of the job? The line between credit loss and fraud loss is increasingly blurred, and misclassified losses can quietly distort portfolio performance. First-party fraud can look like standard credit risk on the surface and synthetic identity fraud can be difficult to identify, allowing both to quietly slip through decisioning models and distort portfolio performance. That’s where fraud risk scores come into play. Used correctly, they don’t replace credit models; they strengthen them. And for credit risk teams under pressure to approve more genuine customers without absorbing unnecessary losses, understanding how fraud risk scores fit into modern decisioning has become essential. What is a fraud risk score (and what isn’t it) At its core, a fraud risk score is designed to assess the likelihood that an applicant or account is associated with fraudulent behavior, not simply whether they can repay credit. That distinction matters. Traditional credit scores evaluate ability to repay based on historical financial behavior. Fraud risk scores focus on intent and risk signals, patterns that suggest an individual may never intend to repay, may be manipulating identity data, or may be building toward coordinated abuse. Fraud risk scores are not: A replacement for credit scoring A blunt tool designed to decline more applicants A one-time checkpoint limited to account opening Instead, they provide an additional lens that helps credit risk teams separate true credit risk from fraud that merely looks like credit loss. How fraud scores augment decisioning Credit models were never built to detect fraud masquerading as legitimate borrowing behavior. Consider common fraud scenarios facing lenders today: First-payment default, where an applicant appears creditworthy but never intends to make an initial payment Bust-out fraud, where an individual builds a strong credit profile over time, then rapidly maxes out available credit before disappearing Synthetic identity fraud, where criminals blend real and fabricated data to create identities that mature slowly and evade traditional checks In all three cases, the applicant may meet credit criteria at the point of decision. Losses can get classified as charge-offs rather than fraud, masking the real source of portfolio degradation. When credit risk teams rely solely on traditional models, the result is often an overly conservative response: tighter credit standards, fewer approvals, and missed growth opportunities. How fraud risk scores complement traditional credit decisioning Fraud risk scores work best when they augment credit decisioning. For credit risk officers, the value lies in precision. Fraud risk scores help identify applicants or accounts where behavior, velocity or identity signals indicate elevated fraud risk — even when credit attributes appear acceptable. When integrated into decisioning strategies, fraud risk scores can: Improve confidence in approvals by isolating high-risk intent early Enable adverse-actionable decisions for first-party fraud, supporting compliance requirements Reduce misclassified credit losses by clearly identifying fraud-driven outcomes Support differentiated treatment strategies rather than blanket declines The goal isn’t to approve fewer customers. It’s to approve the right customers and to decline or treat risk where intent doesn’t align with genuine borrowing behavior. Fraud risk across the credit lifecycle One of the most important shifts for credit risk teams is recognizing that fraud risk is not static. Fraud risk scores can deliver value at multiple stages of the credit lifecycle: Marketing and prescreen: Fraud risk insights help suppress high-risk identities before offers are extended, ensuring marketing dollars are maximized by targeting low risk consumers. Account opening and originations: Real-time fraud risk scoring supports early detection of first-party fraud, synthetic identities, and identity misuse — before losses are booked. Prequalification and instant decisioning: Fraud risk scores can be used to exclude high-risk applicants from offers while maintaining speed and customer experience. Account management and portfolio review: Fraud risk doesn’t end after onboarding. Scores applied in batch or review processes help identify accounts trending toward bust-out behavior or coordinated abuse, informing credit line management and treatment strategies. This lifecycle approach reflects a broader shift: fraud prevention is no longer confined to front-end controls — it’s a continuous risk discipline. What credit risk officers should look for in a fraud risk score Not all fraud risk scores are created equal. When evaluating or deploying them, credit risk officers should prioritize: Lifecycle availability, so fraud risk can be assessed beyond originations Clear distinction between intent and ability to repay, especially for first-party fraud Adverse-action readiness, including explainability and reason codes Regulatory alignment, supporting fair lending and compliance requirements Seamless integration alongside existing credit and decisioning frameworks Increasingly, credit risk teams also value platforms that reduce operational complexity by enabling fraud and credit risk assessment through unified workflows rather than fragmented point solutions. A more strategic approach to fraud and credit risk The most effective credit risk strategies today are not more conservative, they’re more precise. Fraud risk scores give credit risk officers the ability to stop fraud earlier, classify losses accurately and protect portfolio performance without tightening credit across the board. When fraud and credit insights work together, teams can gain a clearer view of risk, stronger decision confidence and more flexibility to support growth. As fraud tactics continue to evolve, the organizations that succeed will be those that can effectively separate fraud from credit loss. Fraud risk scores are no longer a nice-to-have. They’re a foundational tool for modern credit risk strategies. How credit risk teams can operationalize fraud risk scores For credit risk officers, the challenge isn’t just understanding fraud risk, it’s operationalizing it across the credit lifecycle without adding friction, complexity or compliance risk. Rather than treating fraud as a point-in-time decision, credit risk teams should assess fraud risk where it matters most, from acquisition through portfolio management. Fraud risk scores are designed to complement credit decisioning by focusing on intent to repay, helping teams distinguish fraud-driven behavior from traditional credit risk. Key ways Experian supports credit risk teams include: Lifecycle coverage: Experian award-winning fraud risk scores are available across marketing, originations, prequalification, instant decisioning and ongoing account review. This allows organizations to apply consistent fraud strategies beyond account opening. First-party and synthetic identity fraud intelligence: Experian’s fraud risk scoring addresses first-payment default, bust-out behavior and synthetic identity fraud, which are scenarios that often bypass traditional credit models because they initially appear creditworthy. Converged fraud and credit decisioning: By delivering fraud and credit insights together, often through a single integration, Experian can help reduce operational complexity. Credit risk teams can assess fraud and credit risk simultaneously rather than managing disconnected tools and workflows. Precision over conservatism: The emphasis is not on declining more applicants, but on approving more genuine customers by isolating high-risk intent earlier. This precision helps protect portfolio performance without sacrificing growth. For lenders navigating increasing fraud pressure, Experian’s approach reflects a broader shift in the industry: fraud prevention and credit risk management are no longer separate disciplines; they are most effective when aligned. Explore our fraud solutions Contact us

by Julie Lee 6 min read February 18, 2026

For many banks, first-party fraud has become a silent drain on profitability. On paper, it often looks like classic credit risk: an account books, goes delinquent, and ultimately charges off. But a growing share of those early charge-offs is driven by something else entirely: customers who never intended to pay you back. That distinction matters. When first-party fraud is misclassified as credit risk, banks risk overstating credit loss, understating fraud exposure, and missing opportunities to intervene earlier.  In our recent Consumer Banker Association (CBA) partner webinar, “Fraud or Financial Distress? How to Differentiate Fraud and Credit Risk Early,” Experian shared new data and analytics to help fraud, risk and collections leaders see this problem more clearly. This post summarizes key themes from the webinar and points you to the full report and on-demand webinar for deeper insight. Why first-party fraud is a growing issue for banks  Banks are seeing rising early losses, especially in digital channels. But those losses do not always behave like traditional credit deterioration. Several trends are contributing:  More accounts opened and funded digitally  Increased use of synthetic or manipulated identities  Economic pressure on consumers and small businesses  More sophisticated misuse of legitimate credentials  When these patterns are lumped into credit risk, banks can experience:  Inflation of credit loss estimates and reserves  Underinvestment in fraud controls and analytics  Blurred visibility into what is truly driving performance   Treating first-party fraud as a distinct problem is the first step toward solving it.  First-payment default: a clearer view of intent  Traditional credit models are designed to answer, “Can this customer pay?” and “How likely are they to roll into delinquency over time?” They are not designed to answer, “Did this customer ever intend to pay?” To help banks get closer to that question, Experian uses first-payment default (FPD) as a key indicator. At a high level, FPD focuses on accounts that become seriously delinquent early in their lifecycle and do not meaningfully recover.  The principle is straightforward:  A legitimate borrower under stress is more likely to miss payments later, with periods of cure and relapse.  A first-party fraudster is more likely to default quickly and never get back on track.  By focusing on FPD patterns, banks can start to separate cases that look like genuine financial distress from those that are more consistent with deceptive intent.  The full report explains how FPD is defined, how it varies by product, and how it can be used to sharpen bank fraud and credit strategies. Beyond FPD: building a richer fraud signal  FPD alone is not enough to classify first-party fraud. In practice, leading banks are layering FPD with behavioral, application and identity indicators to build a more reliable picture. At a conceptual level, these indicators can include:  Early delinquency and straight-roll behavior  Utilization and credit mix that do not align with stated profile  Unusual income, employment, or application characteristics High-risk channels, devices, or locations at application Patterns of disputes or behaviors that suggest abuse  The power comes from how these signals interact, not from any one data point. The report and webinar walk through how these indicators can be combined into fraud analytics and how they perform across key banking products.  Why it matters across fraud, credit and collections Getting first-party fraud right is not just about fraud loss. It impacts multiple parts of the bank. Fraud strategy Well-defined quantification of first-party fraud helps fraud leaders make the case for investments in identity verification, device intelligence, and other early lifecycle controls, especially in digital account opening and digital lending. Credit risk and capital planning When fraud and credit losses are blended, credit models and reserves can be distorted. Separating first-party fraud provides risk teams a cleaner view of true credit performance and supports better capital planning.  Collections and customer treatment Customers in genuine financial distress need different treatment paths than those who never intended to pay. Better segmentation supports more appropriate outreach, hardship programs, and collections strategies, while reserving firmer actions for abuse.  Executive and board reporting Leadership teams increasingly want to understand what portion of loss is being driven by fraud versus credit. Credible data improves discussions around risk appetite and return on capital.  What leading banks are doing differently  In our work with financial institutions, several common practices have emerged among banks that are getting ahead of first-party fraud: 1. Defining first-party fraud explicitly They establish clear definitions and tracking for first-party fraud across key products instead of leaving it buried in credit loss categories.  2. Embedding FPD segmentation into analytics They use FPD-based views in their monitoring and reporting, particularly in the first 6–12 months on book, to better understand early loss behavior.  3. Unifying fraud and credit decisioning Rather than separate strategies that may conflict, they adopt a more unified decisioning framework that considers both fraud and credit risk when approving accounts, setting limits and managing exposure.  4. Leveraging identity and device data They bring in noncredit data — identity risk, device intelligence, application behavior — to complement traditional credit information and strengthen models.  5. Benchmarking performance against peers They use external benchmarks for first-party fraud loss rates and incident sizes to calibrate their risk posture and investment decisions.  The post is meant as a high-level overview. The real value for your teams will be in the detailed benchmarks, charts and examples in the full report and the discussion in the webinar.  If your teams are asking whether rising early losses are driven by fraud or financial distress, this is the moment to look deeper at first-party fraud.  Download the report: “First-party fraud: The most common culprit”  Explore detailed benchmarks for first-party fraud across banking products, see how first-payment default and other indicators are defined and applied, and review examples you can bring into your own internal discussions.  Download the report Watch the on-demand CBA webinar: “Fraud or Financial Distress? How to Differentiate Fraud and Credit Risk Early”  Hear Experian experts walk through real bank scenarios, FPD analytics and practical steps for integrating first-party fraud intelligence into your fraud, credit, and collections strategies.  Watch the webinar First-party fraud is likely already embedded in your early credit losses. With the right analytics and definitions, banks can uncover the true drivers, reduce hidden fraud exposure, and better support customers facing genuine financial hardship.

by Brittany Ennis 6 min read February 12, 2026