Click & Collect Fraud

Shopping for goods online is fun and convenient. Tracking packages until they get delivered is not. Shipping delays and porch pirates make waiting the hardest part of e-commerce, but now there’s a way to split the difference between shopping online and grabbing stuff at your local store: click and collect, also known as “Buy Online Pickup In Store,” has become massively popular in the last few years.

The downside is that as convenient as it is, click and collect is vulnerable to various forms of fraud that can be difficult to prevent. What types of click and collect fraud do merchants need to be concerned about?

  1. What is Click and Collect Fraud? 
  2. How Do Fraudsters Exploit Click and Collect? 
  3. How Can Merchants Offer Click and Collect Safely? 
  4. Conclusion 

BNPL E-Guide

While curbside pickup and other click and collect practices were already on the rise prior to 2020, the pandemic worked to cement it as an indispensable way to shop. Click and collect made it possible to minimize the time shoppers actually spend in-store, while allowing them to pick up their purchases immediately. As of last year, more than half of the top 1,000 retail chains in the U.S. offer some form of click and collect fulfillment. 

Click and collect has become an important part of the omnichannel strategy that merchants are now embracing, allowing consumers to pick and choose how and where they engage with their preferred retailers in the hope that effortless shopping and maximized convenience leads to higher sales (which it does—a majority of consumers report making additional purchases when they pick up click and collect orders). 

The trouble with convenience is that it often ends up in a tug-of-war with security. When you minimize the barriers and friction that consumers have to go through in order to place and receive an order, you’re also removing the obstacles that fraudsters have to navigate in order to pull off their scams and theft.

In order to use click and collect to their full advantage, merchants need to understand how cybercriminals and “friendly fraudsters” are abusing it. 

What is Click and Collect Fraud? 

Click and collect fraud refers to methods of fraud exploiting services that allow customers to purchase items online, then pick them up themselves at a physical retail location. 

There are various ways to implement click and collect. Curbside pickup is a widely-used option in which the customer parks outside the store and an employee brings their order out to their car.

Another form of click and collect is BOPIS (Buy Online, Pickup In Store) in which the customer goes into the store to retrieve their order from a customer service counter or a designated pickup area or secure locker. 

How Do Fraudsters Exploit Click and Collect? 

The self-service elements of click and collect remove some of the safeguards that prevent fraud. Click and collect is vulnerable to both true fraud and friendly fraud. 

Manage Chargeback In-House Or OutshoreOne of the best defenses against e-commerce fraud is the shipping address. Fraudsters need some way to collect the goods they’re fraudulently purchasing, but using their own shipping address is risky.

If they use a home or business address, they can be traced and identified once the fraud has been discovered.Inconsistencies between shipping and billing addresses are also analyzed as possible fraud indicators by anti-fraud software.

With click and collect fraud, the shipping address doesn’t matter, because the fraudster is going to pick the order up in person. As long as nobody checks their ID (and many retailers do not), they’re almost sure to get away with the goods. Even if the retailer’s anti-fraud tools flag non-local addresses as a red flag, fraudsters can usually get around it.

Most of them buy their stolen payment credentials in bulk on the dark web, and they can simply select cards with local billing addresses to use for click and collect fraud.

The other prevalent danger is that so-called friendly fraudsters will make click and collect purchases with their own cards, then dispute the charge with their bank with false claims that they never received their order. If the retailer doesn’t verify the identity of the person making the pickup, they won’t have much of a defense to mount against these fraudulent click and collect chargebacks. 

Of course, sometimes these click and collect disputes are based in fact. Just as it’s easy for thieves to walk away with a package left at somebody’s doorstep, it’s easy enough for an opportunistic thief to grab a waiting order at the store counter and walk off with it. Because of this, it can be hard for merchants to tell the difference between legitimate click and collect chargebacks and fraudulent ones. 

How Can Merchants Offer Click and Collect Safely? 

While you don’t want to add too much friction to the click and collect process, a little bit of added security at the right points can reduce the likelihood of fraud and assure your customers that you’re looking out for them. 

Without a doubt, checking ID at pickup is one of the best ways to ensure that the cardholder and the person picking up the order are the same individual—and if you scan IDs or obtain signatures, you’ll have evidence you can use to fight fraudulent click and collect chargebacks. An alternative approach would be to send a confirmation code to the purchaser’s device for them to present upon pickup. 

You can also use your anti-fraud tools to protect you from click and collect fraud at the point of sale. Shipping addresses may be unreliable, but you can analyze lots of other information, such as device ID and behavioral data, to determine whether or not any given transaction appears to be fraudulent. 


Consumers are increasingly desirous of convenient omnichannel shopping experiences, and the ability to choose immediate pickup instead of delivery is a big part of that. To manage the risks, merchants need to find a balance between seamlessness and security that satisfies their customers without compromising protection. 

When it comes to illegitimate click and collect chargebacks, automated defenses alone won’t stop them. You have to be ready to fight back against these chargebacks with compelling evidence and show the friendly fraudsters that you’re no easy mark. 

Thanks for following the Chargeback Gurus blog. Feel free to submit topic suggestions, questions, or requests for advice to:

Chargebacks 101

Ready to Start Reducing Chargebacks?