New merchants face fraud within weeks, Fraudio finds

Fraudio has published analysis showing that 10.5% of newly observed merchants encountered fraud within their first 90 days of trading. The study was based on more than 127.5 million transactions across a global sample.

The data suggests fraud often appears before a merchant has built enough transaction history to establish normal customer behaviour. Among 3,923 merchants whose first recorded transaction took place in 2025 and who had not previously appeared in the dataset, the median time to first fraud was 33 days.

A quarter of affected merchants encountered fraud within nine days, while three quarters did so within 61 days. The figures also show that 20% of merchants hit by fraud in that early period saw their first fraudulent transaction within the first week, and 47% within the first 30 days.

The concentration was strongest at the start of the trading period. Adjusted for the different lengths of each time band, first frauds occurred at almost three times the daily rate during the first week as in days 31 to 90.

The analysis also examined whether individual payments appeared suspicious when viewed on their own. It found that 82% of fraudulent transactions looked ordinary when judged only by amount, currency and payment channel against a merchant's typical activity.

That was close to the figure for legitimate transactions, where 84% appeared similarly unremarkable on the same measures. The result suggests those transaction-level attributes alone offer little distinction between fraudulent and genuine payments.

Early exposure

Another measure in the study found that the fraud rate per transaction was 2.9 times higher during a merchant's first 90 days than among payment programmes more than a year old. That points to a heavier fraud burden in the early stage of a merchant relationship rather than a simple build-up of incidents over time.

Fraudio also looked at links between transactions across the wider dataset. It found that 30% of fraudulent transactions involved a card already connected to an earlier fraud, compared with 0.075% of legitimate transactions.

Fraudio noted that this was a retrospective measure because fraud labels may only be confirmed after the original transaction, including through chargebacks. Even so, the contrast illustrates the value of historical links between cards and earlier fraud cases in understanding risk patterns.

The findings are likely to interest acquirers, processors and payment platforms, which often rely on behavioural history to distinguish normal activity from anomalies. For new merchants, that history may be limited or absent during the period when exposure is highest.

João Moura, Chief Executive Officer and Co-Founder of Fraudio, said: "Fraudsters don't wait for a business to build six months of transaction history before they begin attacking it. Our data shows the opposite can happen: fraud can emerge within days, at exactly the point when a merchant has the least historical information available to understand what normal behaviour looks like.

"The other challenge is that fraudulent payments frequently don't look unusual when viewed on their own. The amount may be normal, the currency may be normal and the payment channel may be normal. What increasingly matters is the context around that transaction - what has happened before, how different entities are connected and whether apparently ordinary behaviour forms part of a wider pattern.

"Payment companies should not have to learn what fraud looks like by experiencing losses first. Fraud prevention needs to start with context from day one."

The dataset covered transactions sampled between January 2025 and April 2026. The merchant cohort for the 90-day analysis included businesses first observed in 2025, allowing Fraudio to track how quickly fraud appeared after trading began.

The figures add to a broader debate in payments about how fraud controls should work for businesses with limited operating history. If early-stage merchants face higher attack rates and many fraudulent payments resemble ordinary activity, risk models based mainly on a merchant's own past transactions may miss signals when they are most exposed.

Across the sample, 10.5% of new merchants experienced fraud within 90 days, and the median time to first fraud among those affected was 33 days.