Who eats the loss? Fraud, disputes, and compliance across alternative payment methods

Cards have shaped how businesses think about online payment risk. Merchants know what a chargeback is, who's involved when a transaction is disputed, and what recourse may be available.

That picture becomes less straightforward when businesses add instant bank transfers, digital wallets, vouchers, and other local payment methods. Each can have different rules around authentication, disputes, fraud, refunds, and liability.

For marketplaces, the problem is even harder to untangle. A single transaction can involve a buyer, seller, platform, PSP, and payment provider across several countries. If something goes wrong, it may not be obvious who is responsible for the loss or whether the money can be recovered at all.

Keeping track of those differences, method by method and market by market, is what Ale Aznar does as Founder of Payment Methods List, a human-curated, granular database of local and alternative payment methods. We spoke with him about what changes when marketplaces move beyond cards, how limited recourse affects fraud prevention, and what businesses need to understand before adding a new payment rail.

THE SUMSUBER: Hello Ale, thank you for joining us today. Cards have given merchants a fairly standardized expectation around fraud and disputes. What changes when a marketplace starts accepting local bank transfers, wallets, vouchers, or other alternative payment methods?

ALE: The biggest change is that “payment accepted” no longer means the same thing across payment methods.

With cards, merchants have spent decades building processes around a relatively standardized framework. You have authorization, clearing and settlement, chargebacks, reason codes, issuer/acquirer responsibilities, fraud liability rules, authentication mechanisms such as 3DS, and established operational processes for representing a transaction when it is disputed.

When you move into alternative payment methods, that consistency disappears.

A bank transfer, a wallet, a voucher, a BNPL product, and a cash-based payment method can all sit under the umbrella of “APM”, but from a fraud and dispute perspective they can be completely different products.

For example, with a bank transfer, the customer may push the money rather than the merchant pulling it. With an instant payment rail, settlement can happen in seconds. With a wallet, the wallet provider may have its own authentication, fraud engine, dispute process, and contractual protections. With a voucher or cash-based method, the concept of chargeback may barely exist.

The more useful question is what happens if a transaction turns out to be fraudulent, unauthorized, executed incorrectly, or if the underlying purchase is disputed.

For a marketplace, more parties are involved. You have the buyer, seller, platform, potentially a PSP, and sometimes another payment-method provider. The marketplace therefore needs to know what happens after the payment is accepted and the seller has been paid. Can the money actually be recovered? The answer can differ widely from one payment method to another.

THE SUMSUBER: Can you walk us through a few examples of how recourse differs across payment rails – for example, a card payment versus an instant bank transfer such as Brazil’s Pix or a wallet payment? Where does the ability to dispute or recover funds actually disappear?

ALE: I think the easiest way to understand this is to separate payment finality from commercial dispute resolution.

With a card transaction, the fact that the transaction has settled doesn't necessarily mean the merchant has final economic certainty. The card schemes have established mechanisms through which a cardholder can dispute a transaction later, and funds can potentially be reversed through the chargeback process.

That gives the merchant a relatively well-understood, although certainly not unlimited, form of recourse.

With something like Pix, the mechanics are different.

Pix is an instant account-to-account payment rail. There isn't a card-style chargeback process that you can simply assume exists for every transaction. Brazil does have specific mechanisms for fraud-related returns, including the MED (Mechanism for Special Return), so it would be wrong to say Pix has absolutely no recovery mechanism.

But the recovery process is different from a card chargeback. The circumstances in which money can be returned, the institutions involved, and the chances of recovering the funds all depend on the specific situation.

Wallets can vary even more. Some offer fairly sophisticated buyer protection or dispute mechanisms, while others provide much more limited recourse. They may also treat account takeover, fraudulent merchant transactions, refund disputes, and claims that goods or services were not received differently.

A transaction can be technically reversible but still be practically impossible to recover. The recipient may already have withdrawn the money, moved it to another account, or be operating in another jurisdiction. So, the point at which recourse disappears isn't necessarily a single moment.

THE SUMSUBER: When there is little or no chargeback mechanism, does fraud prevention effectively have to move further upstream? What should change in the way a business assesses a transaction when the payment, once authorized, may be practically irreversible?

ALE: Absolutely: if the chances of recovering the money after settlement are low, you can't rely on the payment decision alone.

With cards, businesses have historically been able to accept some residual risk because there’s a relatively mature dispute process behind the transaction. With an irreversible or hard-to-recover payment, you have to address more of that risk before the money moves.

That means looking at the wider context of the transaction. How old is the customer account? What has the customer done previously? Has the customer's behavior changed suddenly? Is the payment method consistent with their previous behavior? Is the seller new, or have their payout details recently changed?

You also need to assess the recipient. Is this a new beneficiary? Have they received payments from multiple unrelated users? Are they linked to known fraud, mule activity, risky devices, or suspicious accounts? In irreversible payments, recipient risk can be just as important as sender risk because a legitimate customer may still be paying a fraudster or mule.

Device intelligence adds another layer of context: a payment from a new or high-risk device, especially when combined with account changes, unusual velocity, or a new recipient, can justify additional checks before authorization or payout.

You also want to look at the relationship between the buyer and seller, previous refunds or disputes, and whether the transaction itself makes commercial sense. Authentication doesn't answer all of those questions.

A customer can successfully authenticate themselves and still be involved in a fraudulent transaction. The less opportunity there is to recover money afterward, the more important those checks become before authorization and before the seller is paid.

For marketplaces, the payout itself can also provide another opportunity to manage risk. If the payment is irreversible but the seller isn't paid immediately, there’s still time to identify problems before the funds leave the platform.

THE SUMSUBER: Payment-method adoption also means onboarding different providers and meeting different KYB and compliance requirements. Where do you see the biggest gaps between the information a marketplace has about its payment partners and the information it actually needs to understand its fraud exposure?

ALE: This is one of the areas where I think the industry has a significant information problem.

A marketplace can tell you that it supports Pix, for example. But that doesn't tell you very much about the actual risk involved.

You need to understand how the payment is being delivered: which PSP or payment institution is involved, who owns the customer relationship, who performs the relevant KYC or KYB, who monitors the transactions, who is responsible for fraud, and what happens when a payment is reported as fraudulent.

The same applies to the recovery process: you should know what happens if the beneficiary has already received the money and what happens to funds held by the marketplace. Another question is what happens if the payment provider itself sits behind another provider.

So payment-method information needs to go beyond a list of available methods. Businesses need to understand how those pieces fit together.

The gap I see most often is that companies have commercial information about their payment partners but insufficient risk information about the underlying payment flow. They know the price, the market coverage, and how difficult the integration will be. They might know much less about what happens when a transaction goes wrong. That's when gaps in the original assessment tend to become visible.

THE SUMSUBER: When fraud happens through an alternative payment method, who should ultimately absorb the loss – the merchant, PSP, payment provider, or another party? And how does that calculation change when the merchant is a marketplace sitting between a buyer and a seller?

ALE: I don't think there’s a universal answer. It comes down to where the risk was created, who could control it, and what the parties agreed on in the contract.

If a PSP has taken fraud liability in certain circumstances, that should be reflected in the economics. If the merchant owns the customer relationship and ignores clear risk signals, it's harder to argue that the PSP should automatically absorb the loss. The payment method's rules also need to be taken into account.

Marketplaces add another layer because several different sources of loss are possible.

The buyer or the seller could be fraudulent, or could be working together. An account could have been compromised. The payment could be legitimate while the seller fails to deliver. A buyer could abuse a refund process. The marketplace could release the seller's funds too quickly. Failures can also occur further down the payment chain.

I wouldn't reduce liability to whoever processed the payment. It should reflect the responsibilities each participant had for managing the relevant risk.

It's also useful to distinguish between payment fraud and marketplace fraud. A payment can be authorized and still fund a fraudulent seller. Conversely, the payment itself can be legitimate while the buyer later abuses the marketplace's refund process. The risk doesn't stop when the payment is authorized. It continues through the rest of the transaction.

THE SUMSUBER: Marketplaces can have a buyer, seller, payment provider, and platform operating across several jurisdictions. How does that multi-party structure change the fraud picture? For example, when the buyer and seller are colluding, a seller is fraudulent, or someone abuses refunds?

ALE: It fundamentally changes the fraud picture because the marketplace is no longer assessing a transaction in isolation. You're assessing relationships between entities. This is where I think traditional transaction-level fraud models can struggle.

Buyer-seller collusion is a good example. The buyer or the seller may look legitimate on their own. The payment may look normal, and the transaction amount may not raise any obvious concerns.

But when you look at the relationship between them, things can start to look different. Shared devices or IP addresses, common bank accounts or addresses, repeated interactions, unusual transaction patterns, or similar refund behavior can reveal a connection that isn't visible at the individual transaction level.

Seller fraud can develop in a similar way. A seller may pass KYB and behave normally for some time, build a transaction history, receive higher limits, and only later start abusing the platform. That means passing the initial onboarding checks isn't the end of the assessment – seller behavior needs to be monitored over time.

Refunds create another set of problems. These can include false non-delivery claims, repeated refund requests, refunds to alternative destinations, collusion between buyers and sellers, refunds after the seller has already received the funds, promotional-credit abuse, or people using multiple accounts to exploit the same policy.

Then there is geography.

If the buyer is in one country, the seller in another, the PSP is licensed elsewhere, and another entity operates the payment method, recovering the money can become much harder. For that reason, companies should treat cross-border recoverability as part of the risk assessment.

The amount at risk isn't determined only by how likely a transaction is to be fraudulent. It’s dependent on how much money is involved and how likely the money recovery is.

THE SUMSUBER: As instant payments and local payment methods become more widely adopted, what should marketplaces be checking before they add a new payment rail in terms of fraud exposure, dispute mechanisms, and who carries the loss when something goes wrong?

ALE: I would make a mandatory payment-method risk assessment before launch, and I wouldn’t let the commercial team answer it alone.

The starting point is understanding how the money moves from the payer to the marketplace and then to the seller. The payment method affects what happens if the transaction later turns out to be problematic.

Then you need to understand how final the payment actually is. Calling something an instant payment doesn't tell you whether you can recover the funds after settlement. You need to know what circumstances allow the money to come back and how that process works.

The same applies to disputes. Businesses should know what can be disputed, for how long, who handles the dispute, and when money can be returned.

Liability should also be clear before launch. Different situations – an unauthorized payment, account takeover, fraudulent seller, payment error, and so on – may result in different parties carrying the loss.

One question I'd put high on the list is what happens if the seller has already been paid. A payment can be technically recoverable, but the marketplace may not be able to recover the money in practice.

It's also worth looking at the data available from the payment provider. A payment method may look attractive from a commercial perspective but provide very little information that can help a marketplace identify suspicious activity.

So before scaling a new payment method, a marketplace should understand how the payment works, where the fraud controls sit, what happens when something goes wrong, and who bears the loss. That gives businesses a much clearer picture than looking at payment-method availability or conversion in isolation.