Fraud Data Sharing Is Back in Focus: Should Your Business Join In?

A fraud data sharing consortium can flag repeat fraudsters your own data misses. See how it reaches small merchants and which terms to check first.

Adrian ReyesSenior Payments & Fintech Editor

October 31, 2026 · 8 min read

Hand pointing at colorful speech bubble graphics over a blurred group of coworkers talking in an office meeting

Photo: Pixabay

On this page 6 sections

What PaymentsJournal Reported on Fraud Data Sharing (Oct. 30, 2026)
Why One Merchant's Data Misses Repeat Fraudsters
How a Fraud Data Sharing Consortium Already Reaches Your Store
What You Can and Can't Share: Privacy Laws and Card Network Rules
Contract Terms to Check Before Joining a Merchant Fraud Consortium
A Starter Plan for Small and Mid-Size Online Sellers

Key takeaways

Card networks already score many of your orders with pooled data on the bank's side, and you can't see those scores. Ask your processor which scores you can see.
Before you pay for a consortium tool, run it in shadow mode for 30 days. Count the fraud it would have caught, the good orders it would have blocked and its fees, all in dollars.
Card numbers stay inside your PCI-scoped payment flow. Customer details like email and device fall under state privacy laws that vary, so have a lawyer review the program before you share anything.
The contract clauses that matter most say whether the vendor can reuse your data in other products and whether it deletes your data when you leave.

Most online sellers already benefit from a fraud data sharing consortium without signing anything. The card networks, your processor and many fraud tools pool what they see across many merchants and use it to score your orders. The real decision is whether to add a consortium-based fraud tool that takes your customer data too. That usually pays off once card testing or fraud chargebacks cost more than the tool, and only if the contract limits what the vendor can do with your data.

On Oct. 30, 2026, PaymentsJournal staff writer Wesley Grant published "Why Breaking Down Data-Sharing Barriers Is Critical to Fighting Fraud." It ran under fraud and security and was tagged as a fraud consortium story. The publication has covered this theme all year. Earlier in 2026 it reported on an International Monetary Fund technical note. The note named siloed data as the main obstacle in the fight against fraud and urged banks to share transaction and threat data. That coverage also explained why banks hold back: competitive concerns and regulatory constraints. On Oct. 7, PaymentsJournal ran a piece on organized fraud rings. It quoted a source on the growing need to understand "the threats that your peers are seeing."

Nearly all of that discussion is about banks. Merchants sit on the other end of the same transactions, and the same logic applies. A fraudster blocked at one store moves to the next one, and the next store has never seen him.

Why One Merchant's Data Misses Repeat Fraudsters

Your fraud rules learn from your own history: your chargebacks, your refunds, your repeat customers. That works well for spotting a stranger who behaves differently from your regulars. It works badly against a professional who is new to you but not new to the internet.

A first-time fraudster at your store looks exactly like a first-time customer. The email address is new. The billing ZIP code matches because the stolen card came with it, and the security code passes. Your data can't show that the same device, phone number or shipping address has been used with a dozen different cards at other stores this week. Shared fraud intelligence sees that pattern because it watches across stores. The same is true of card testing, where bots run small charges on many sites to find cards that still work. It also applies to account takeover, where logins stolen from one site are tried on yours.

Here is the decision in dollars. This example is illustrative; every number is an assumption, not a benchmark. Assume a store selling digital gift cards does 3,000 orders a month at an average of $80. It runs a consortium tool in "shadow mode" for 30 days, which means the tool scores orders but doesn't block any. Afterward the store checks the scores against what actually happened:

30 orders the tool would have blocked turned into fraud chargebacks. Each one cost the $80 sale plus an assumed $20 chargeback fee from the processor, so $100 apiece, or $3,000.
12 orders the tool would have blocked came from real customers. That is $960 in lost sales.
The tool costs an assumed $0.10 per screened order, or $300 a month.

Net benefit: $3,000 minus $960 minus $300 equals $1,740 a month. The store also gets 30 fewer disputes counting against its chargeback ratio. If the test had flagged $960 of fraud and $3,000 of good orders, the answer would be no. Run the test before you pay for a full rollout, because the right answer depends on your own fraud, not the vendor's average.

Shared data makes its own mistakes. Households share devices and offices share IP addresses. Travelers and VPN users can look like they're somewhere they shouldn't be. A score built on other merchants' bad experiences can decline your good customer. Our guides on what AI fraud detection catches and what it misses and fixing false declines to improve authorization rates explain how to keep track of that cost.

Shared data reaches a small merchant in three main ways, and you probably use at least one today.

Network Scoring on the Issuer Side

When your customer's bank (the issuer) decides whether to approve your sale, it may rely on the card network's own scoring. Visa Advanced Authorization gives issuers a real-time risk score for transactions across VisaNet. Visa says the score uses its global fraud data and up to two years of account history, and checks hundreds of details per transaction. You don't buy this and you can't see the score. It still affects your approvals. That's why some declines reflect what happened at other stores, not anything at yours.

Merchant-Side Fraud Tools Built on Pooled Data

Some tools give the shared view to the merchant directly. Visa's Decision Manager is a fraud management platform for merchants and acquirers. It scores each transaction from 0 (low risk) to 99 (high risk), and Visa says the score draws on billions of VisaNet transactions. Many gateways and independent fraud vendors also run their own consortium fraud scoring across their merchants. Each provider sets its own prices and features; none of that is a network rule. Ask your processor which scoring model, if any, checks your transactions now. Also ask whether you can see the score and the reason codes in your payment gateway.

Authentication Data You Send to the Bank

3-D Secure 2 lets you send device, account and login details to the issuer during checkout. PaymentsJournal's Sept. 18, 2026 piece on 3-D Secure described a merchant sending login history, IP address and device details "in the background to the card issuer." That is fraud prevention data sharing, one transaction at a time, within the network's own system. It is also a core part of card-not-present fraud prevention. If you don't use it yet, start with 3-D Secure authentication for card-not-present sales and our explainer on how 3-D Secure 2 cuts fraud chargebacks with less friction.

Three separate sets of rules apply here, and it helps to keep them apart.

Card network rules and PCI DSS cover card data. Your merchant agreement binds you to the network rules. PCI DSS strictly limits how card data is stored and sent, and some of it can't be kept after the sale is approved at all. A reputable consortium tool gets card data through the payment system you already secure for PCI DSS, or it works from tokens and scrambled (hashed) identifiers. Raw card numbers should never go into a spreadsheet or shared database outside that system.

Privacy law covers the customer details: email, phone, IP address, device data and, with some tools, location or behavior data. The U.S. has no single comprehensive consumer privacy law. State laws differ on fraud and security uses, required notices, and what counts as selling or sharing data. Sensitive data such as precise location raises the bar further. Our primer on location data in fraud prevention covers the trade-offs.

Bank-side rules often cause confusion. Section 314(b) of the USA PATRIOT Act lets financial institutions share information voluntarily and gives them legal protection when they do. FinCEN guidance from December 2020 confirmed that fraud is a permitted topic. The law was written for financial institutions. Don't assume it covers one retailer swapping notes with another.

The riskiest setup is the informal one: a group chat or shared list of "bad customers" among sellers in the same niche. Nobody checks it for accuracy. A customer flagged by mistake has no way off the list, and no contract says who is responsible. This section is general information, not legal advice. Have a privacy attorney review any program before you send customer data to it, and update your privacy notice to match.

Contract Terms to Check Before Joining a Merchant Fraud Consortium

The sales pitch will focus on how many merchants are in the network. These terms decide whether the deal is safe.

Term	What to ask	Why it matters
Data contributed	Which fields leave your systems, and are identifiers hashed?	Less raw data means less exposure if the vendor is breached
Use of your data	Can the vendor use it for its other products or to train models it sells to others?	Your customer list could feed a competitor's tools
Role under privacy law	Is the vendor acting as your service provider or using data for its own purposes?	Under some state laws, this changes what you must tell customers
Retention and exit	How long is data kept, and is it deleted when you cancel?	Leaving shouldn't mean your data stays in the pool
Explanations	Do you get reason codes, not just a score?	You can't fix false declines you can't explain
Disputed flags	How are records corrected when a good customer is flagged?	Bad data spreads to every member
Liability	Does any chargeback guarantee have exclusions or caps?	Guarantees can exclude whole types of disputes

A Starter Plan for Small and Mid-Size Online Sellers

List the fraud tools you already have. Ask your processor which network and consortium scores check your transactions and whether you can see them. You may already have tools you never set up.
Send better data before buying more tools. Full 3-D Secure data, address verification and device data help the issuer decide, with no new contract risk.
Stop card testing with your own rules. Velocity limits cap how many attempts a card, device or IP address can make. They are your first defense against bot attacks, especially on free-trial and subscription sign-ups.
Test any consortium tool in shadow mode for 30 days. Compare the fraud it caught with the good orders it blocked, in dollars, as in the example above.
Finish the privacy review before you turn the tool on, including the contract terms in the table.

How much this matters depends on what you sell. Digital products and gift cards are delivered instantly, so there's no time for a manual review, and signals from other stores carry more weight. Travel businesses see expensive bookings made weeks ahead, often by one person for another traveler, which trips up simple rules. There, a shared view of the booker's history helps more than your own thin data. Marketplaces face fraud from both buyers and sellers, so ask whether a vendor scores both. Subscription businesses need card-testing defenses at sign-up more than at renewal.

The most useful next step is a short email to your processor this week. Ask what fraud scoring you already have and what it reports to you. MannyPay offers online payment processing, gateways and 3-D Secure authentication. Request a free quote and a MannyPay specialist will respond within one business day. The open question to watch is whether the networks and processors start giving merchants more of the shared data they already use, or keep it mostly on the bank's side.

Sources

About the author

Adrian Reyes

Adrian Reyes is Senior Payments & Fintech Editor for Beyond the Swipe, covering credit card processing, merchant accounts, payment technology and processing fees.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.