B2B ecommerce payment fraud prevention in Montréal (2026)

The verdict in three sentences

Fraud on a B2B ecommerce store selling IT equipment almost always follows the same pattern: a new account, a real company being impersonated, a shipping address that differs from head office and an order for laptops or graphics cards that resell easily. A four layer setup, 3-D Secure 2, a fraud scoring tool, business rules and business registry checks, brings fraud under 0.1% without driving loyal customers away. Setup costs a 2026 range of CAD 10,000 to 25,000, against CAD 65,000 lost in a year.

Where fraud gets through today

Canada has no equivalent of the European strong authentication mandate, so many merchants leave 3-D Secure off to avoid friction at checkout. That is where most card fraud gets through: without authentication, the chargeback liability stays with the merchant. Visa and Mastercard programs also penalize merchants whose dispute ratio climbs above roughly 0.9 to 1%.

In B2B a second gap appears: invoice or net-30 payment on an account opened with a fake purchase order. The fraudster uses a real company name and registry number, an email on a lookalike domain, and asks for delivery to a freight forwarder or a self-storage unit.

The four layer setup and its cost

The first layer is 3-D Secure 2 turned on for new and risky orders, with frictionless flow for customers who already have at least 3 clean orders. The second is a scoring tool (Stripe Radar, Signifyd, Kount, Riskified) that rates each transaction from hundreds of signals, for CAD 0.05 to 0.15 per transaction as a market range. The third is a set of business rules specific to your catalogue. The fourth is business registry checks through the Registraire des entreprises du Québec, Corporations Canada and GST/QST number validation before any credit terms are opened.

Kolonell builds these controls into its ecommerce projects and can audit an existing store with our cybersecurity team. Pricing comes in a written quote based on your payment provider and back office.

Mini case study

Isabelle Gagnon, CFO of an IT distributor in Montréal, runs CAD 13,000,000 in online revenue, about 3,200 orders at CAD 4,100. Fraud cost her CAD 65,000 in goods, plus CAD 20 in fees on each of 18 chargebacks and about 40 hours of handling.

• Current fraud rate: 65,000 / 13,000,000 = 0.5%.
• Target rate: 0.1%, so CAD 13,000 of residual losses and CAD 52,000 avoided per year.
• Scoring cost: 3,200 x CAD 0.12 = CAD 384 per year.
• Manual review: 2% of 3,200 = 64 orders x 8 minutes = about 9 hours a year.
• Setup: CAD 18,000.

The setup pays for itself in about 4 months. Isabelle also tracks checkout abandonment: if it rises by more than 1 point after 3-D Secure goes live, the frictionless rules for repeat customers should be widened.

FAQ

Will 3-D Secure hurt conversion?

With 3-D Secure 2, authentication is often invisible or a single tap in the banking app. Observed conversion loss usually sits around 1 to 3%, and frictionless rules for loyal customers reduce it further.

Who pays when fraud hits an authenticated transaction?

If the transaction was authenticated with 3-D Secure, liability generally shifts to the card issuer. Without authentication, it stays with you.

Do corporate cards change anything?

Corporate and purchasing cards used by procurement teams carry their own data fields and often lower fraud. They frequently make up 10 to 20% of card payments for a B2B distributor.

Is a registry check enough?

No, because fraudsters often use a real company. Cross-check the registry number with the email domain, the shipping address and a callback to the company's official phone number for first orders above CAD 4,000.

How long does setup take?

Allow 4 to 6 weeks, including 2 weeks in observation mode where scoring rates orders without blocking, to calibrate thresholds before going live.

Let's scope your project. We audit your payment flows and roll out 3-D Secure, scoring and review rules in 4 to 6 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.