The verdict in three sentences
A merchant with no fraud defenses loses on average 2 to 4 % of revenue to unpaid orders, disputes and fake payments. The good news: four simple controls — number verification, velocity limits, risk scoring and 3DS on cards — bring that cost below 0.5 %. All of it wires up in a few days on a well-built store, with no friction for the honest customer.
The fraud signals every merchant must recognize
Mobile money fraud does not look like Western card fraud. It exploits urgency, trust and forged screenshots. A fake Opay, PalmPay or bank-transfer receipt travels in seconds over WhatsApp: the customer shows a screenshot, the seller releases the goods, the money never lands.
| Warning signal | What it reveals | Recommended defense |
|---|---|---|
| Screenshot as "proof" | No real credit on the account | Wait for the official webhook notification |
| 5+ attempts in 10 minutes | Card or number testing | Automatic velocity block |
| Number created under 24 h ago | Disposable account | Risk score + verification |
| Very large basket from a new customer | Laundering or stolen card | First-order cap + 3DS |
| Delivery address != number's zone | Fraudulent reshipping | Manual review |
| Immediate refund request | Overpayment scam | 48 h security hold |
The golden rule: never release a product or service based on a screenshot. Only server confirmation (a signed PSP webhook) counts.
The real cost of an unpaid order and the numbers behind each defense
An unpaid order costs more than the basket. Add the logistics already spent, processing time and sometimes lost goods. 2026 order of magnitude for a Nigerian online store:
| Item | No defenses | Defenses active |
|---|---|---|
| Fraud / unpaid rate | 2 to 4 % of revenue | < 0.5 % of revenue |
| Card chargeback | ~0.5 % of transactions | < 0.1 % |
| Average cost of one unpaid order | basket + NGN 5,000 | prevented upstream |
| Velocity block | none | > 5 attempts / 10 min |
| Number verification (OTP) | no | yes, systematic |
| 3DS on card payments | no | yes, mandatory |
| Annual loss (revenue NGN 60M) | NGN 1.2M to 2.4M | < NGN 300,000 |
The four defenses to wire first: (1) OTP number verification before validation, (2) a velocity limit that blocks past 5 attempts in 10 minutes, (3) a risk score combining account age, amount and geolocation, (4) mandatory 3D Secure on every card payment to shift chargeback liability to the issuing bank.
Mini case study
Chioma runs a cosmetics store in Lagos, monthly revenue NGN 8,000,000. She used to accept screenshots and suffered about 3 % unpaid orders, i.e. NGN 240,000 lost per month, plus 8 fake payments a month at NGN 5,000 logistics cost each, i.e. NGN 40,000. Total: NGN 280,000 / month, about NGN 3,360,000 / year.
After switching on webhook confirmation, OTP and velocity blocking, her unpaid rate dropped to 0.4 %, i.e. NGN 32,000 / month. Net saving: NGN 248,000 / month, about NGN 2,976,000 / year — for a one-off wiring job paid back in under a month.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Is a payment screenshot valid proof?
No, never. A screenshot is forged in 30 seconds. Only the PSP-signed webhook notification confirms a real credit. This is the number-one cause of merchant fraud, responsible for most of the 2 to 4 % losses.
Does 3D Secure scare off honest customers?
Marginally. You see 1 to 3 % extra card abandonment, but 3DS shifts chargeback liability (0.5 % of transactions) to the issuing bank. The balance is strongly positive for the merchant.
What is a velocity limit in practice?
A rule that automatically blocks a customer after 5 failed payment attempts in 10 minutes. It stops stolen-card testing dead, which is a big share of card fraud.
How much does it cost to set up these defenses?
On a well-architected store, wiring OTP + velocity + risk score + webhook takes a few days. It pays back in under a month once revenue passes NGN 6,000,000, given the losses avoided.
Do I need a different module for each operator?
No, if you use a unified payment module: the webhook confirmation, velocity and scoring logic applies the same way across operators, with a single interface to maintain.
Let's talk about your project. We audit your payment flow and wire the anti-fraud defenses sized to your volume. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
