Find the right balance in payment fraud risk management, choosing tools and rules that protect revenue without adding unnecessary friction for real bookers.
There’s no one-size-fits-all solution to managing payment fraud in your theatre, museum, or arts centre. You need legitimate customers to come through the virtual gates and buy tickets, and you want to deliver a welcoming, frictionless experience from the moment they interact with your organisation.
At the same time, you want to limit fraudulent transactions and chargebacks, which are expensive and time-consuming for your team to handle.
Unfortunately, the measures you put in place to reduce fraud often add friction to the purchase pathway. There are many tools available to reduce the risk of problem transactions, but with every layer of protection, you may also prevent some genuine sales from going through.
That’s why this article recommends a strategy centred on payment fraud risk management, rather than aiming for complete fraud elimination. As you build your fraud protections, you’re continuously navigating the push and pull between risk and friction.
Here, we’ll unpack what that can look like for your organisation. You’ll learn more about the payment fraud mitigation options available to you, the trade-offs involved, and the data you can use to inform your decisions.
The trade-offs in payment fraud risk management
There are rules you can put in place within your payment process to help verify the legitimacy of each transaction. The rules available to you will vary based on the payment methods you accept.
However, it’s not as simple as applying every measure available to you. Each of these measures may help reduce problem transactions, but each also adds friction to the payment process.
The measures you choose should be based on an evaluation of your payment fraud risk and your understanding of your audience demographics and expectations.
Payment fraud mitigation options
Apple Pay with fingerprint or Face ID
- Risk: Lower
- Friction: Lower
If your payment processor allows you to accept Apple Pay, it can be an easy win – adding a layer of security with fingerprint or Face ID, shifting liability for any fraudulent transactions that do slip through away from your organisation, and reducing friction for many customers. One theatre saw 49% of customers choosing Apple Pay within weeks of its introduction. However, it’s unlikely that every customer will use Apple Pay, especially if your audience demographic is older, and you may need to combine this with additional security steps for traditional card payments.
Address verification system (AVS)
- Risk: Lower
- Friction: Higher
Your payment processor will check that the billing address in your system matches the cardholder details held by the bank. This is fairly common in the US, UK, and Canada, but doesn’t work so reliably for cards issued in another country or for cards other than Visa, MasterCard, Discover, and American Express.
For most customers this adds little friction, but it is less reliable for certain address types, like flats, than for standard street addresses. If you’re a city-centre venue, or welcome a high proportion of student audiences, this may not be the right choice for you.
Card verification value (CVV2)
- Risk: Lower
- Friction: Higher
This is a three- or four-digit security code, often found on the back of a debit or credit card. While long card numbers can be stored by merchants, the CVV must be entered for every transaction. This adds an extra layer of security with minimal effort on the part of consumers.
3D Secure
- Risk: Lower
- Friction: Higher
3D Secure is a more complex security check involving the merchant, card issuer, and cardholder. After entering their card details, patrons see a secure page where they’re asked to enter a code or password, or use fingerprint or Face ID, to verify their identity. It’s only when that step has been completed that the transaction is approved.
This is mandated in the UK and EU for everything other than the lowest-value transactions, but it adds a significant extra step that’s less common in the US and Canada.
Blocking cards issued in specific countries
- Risk: Lower
- Friction: Much higher
If you identify fraudulent activity originating in a specific country, most payment providers give you the option to block cards issued in that location. That can be useful for venues with a mostly local audience, but it’s a blunt tool for identifying risk. If you welcome even a small number of international visitors, it can prevent genuine purchases.
You may also have the option to block all cards issued internationally, but that’s a big step – one that will almost certainly block purchases by genuine tourists and foreign residents.
It’s up to you to make a decision here about risk tolerance, based on your knowledge of your patrons and your payment fraud data. Is it worth risking a decrease in transactions and a weaker customer experience in a quest to eliminate chargebacks?
The good news is that you have the flexibility to choose which measures to implement and how to combine them to meet the needs of your organization. Some solutions can even adapt in real time for each individual transaction, offering additional or varying security measures depending on the situation.
Ticketing v marketing?
Sometimes, in discussions around fraud, frustrations can build between different teams in an organisation, so it’s worth taking a moment to address that.
Every role naturally brings a different perspective to the challenge.
A finance director or box office manager might deal directly with the time, effort, and revenue lost to chargebacks, and feel that fraud protection is urgently needed.
Meanwhile, a marketing or development director might look at the potential for friction in the sales process and worry about deterring legitimate customers.
But is it really as simple as ticketing v marketing? Not at all. These concerns are all legitimate and often complex. Your team may have different priorities, but ultimately, you’re united around the goal of protecting revenue and making sales smoothly.
Start by understanding your event ticketing fraud prevention strategy as a shared effort to strike the right balance, and seek tools that are sophisticated enough to help you thread the needle.
Using data to manage payment fraud
Your data has a lot to tell you. In addition to ticketing fraud detection metrics that can alert you to a payment fraud problem, you can monitor your own numbers to understand the impact of fraud on your business.
Indicators that your fraud prevention rules are too permissive:
- A high or increasing chargeback rate.
- Revenue lost to chargebacks.
- Time lost to handling chargebacks.
Indicators that your fraud prevention rules are too strict:
- A low or reducing authorisation rate.
- Revenue lost due to failed transactions.
- Time lost to fixing failed online transactions.
- Customer complaints about your processes.
Keep in mind that conditions are always changing. Check your metrics at least once a month, and make a plan to assess your payment fraud risk management strategy at least every six months – or more often if you notice a significant change.
If you’re still building your understanding of the risks involved, this overview of the types of payment fraud affecting ticketing can help add useful context.
For audience-facing advice on avoiding ticket scams at live shows and games, you can share this consumer alert on ticket scams from the North Carolina Department of Justice.
If you use Spektrix with our in-house payment solution, that work happens for you – metrics are continuously monitored across hundreds of organisations, and the team will reach out with suggestions if something looks concerning.
