I'm guessing this has been asked before, but why not just use a credit card processor that handles all of that stuff for you. Seems like they are in the business of selling Japanese candy, not preventing CC fraud.
Am I being naive here?
Am I being naive here?
Full Disclosure: Not based on first hand experience, as the project is not launched yet.
They don't eat the loss; the card network does.
The best option is to get a PSP that will let you do selective fraud detection. Then you funnel large order and first time orders through the fraud detection, and skip it on repeat customers. Otherwise it can become an expensive service.
At $DayJob we have a similar process [e.g. Accept any card that passes the checksum, hand out rejections on a 24 hour delay after we've handled our fraud signals and processed the charge with the gateway]
The credit card processors aren't particularly interested in handling this for you and you [the merchant] pay the price if you gave the processor stolen card numbers.
Services like these:
https://www.signifyd.com/pricing/ [1% per transaction]
https://www.maxmind.com/en/minfraud-services [ $0.005 ]
would have no customers if you could get a reliable partner to handle this all for you for free-ish.