Fraud Detection in Indian Payment Gateways: 5 Providers’ Built-In Risk Tools Compared (2026)

Every major Indian payment gateway says it has fraud detection built in. What that means varies a lot. Some providers give merchants a rule builder, blocklists and a review queue. Others run risk checks on their own side and show the merchant very little.

This guide compares the built-in risk tools of five providers, Razorpay, Cashfree, PayU, PhonePe Payment Gateway and CCAvenue, using only what each documents on its official pages as of October 2026. Where documentation is thin, we say so rather than guess. It also covers how to judge these tools and what to configure in your first 30 days.

Quick answer: Razorpay offers the broadest documented set of risk layers among Indian gateways in 2026: hotlisted card checks on every payment, an ML risk engine and block rules for cross-border payments, address verification, COD risk controls, a dispute API with webhooks, and Chargeback Shield, which covers fraud chargebacks on international payments. Cashfree’s RiskShield documents the most detailed self-serve rule builder. PayU, PhonePe PG and CCAvenue describe real-time monitoring but publish little about merchant-configurable controls. No gateway removes the need for your own checks.

What do gateway-level risk tools actually do?

A gateway sees every payment attempt before it reaches the card network or UPI switch, which puts it in a good position to stop obvious abuse. Most tools combine some of these controls:

• Rules: if-then conditions such as blocking payments above a set amount from a VPN.
• ML risk scores: a model scores each payment using signals from across the gateway’s network. Our explainer onhow machine learning detects payment fraudcovers the theory.
• Velocity checks: limits on attempts per card, IP, phone number or UPI ID within a time window.
• Blocklists and allowlists: known bad or trusted identifiers.
• 3D Secure step-up: sending risky card payments through issuer authentication.
• Device fingerprinting: identifying the device or browser behind repeat attempts.

What a gateway cannot see is your business context: account history, delivery addresses, promotion abuse, or returns behaviour. Those remain merchant-side controls.

Card testing deserves special mention because automated tools now run it at scale. Our article onAI-powered card testing attacksexplains the patterns these controls are meant to catch.

Which risk tools does Razorpay document?

Razorpay’s security documentation states that every payment is checked against hotlisted cards, and that geographic and pattern-based transaction monitoring flags fraudulent transactions. Razorpay is PCI DSS Level 1 certified and lists ISO 27001:2022 and SOC 2 Type 2 certifications.

Beyond that baseline, Razorpay documents several products:

• Shield risk engine. An ML-based engine for cross-border payments that checks each transaction against about 10,000 data points, according to Razorpay.
• Risk Analytics dashboard. Built for Indian exporters, it shows fraud-to-sales ratio, dispute-to-sales ratio and risk decline rate, and lets merchants set block rules.
• Chargeback Shield. An ML-based programme that assumes liability for fraud chargebacks on international payments for a per-transaction fee. Pricing is through sales.
• Address Verification System. Billing address checks for cards issued in the US, UK and Canada, prompted automatically in Standard Checkout.
• Magic Checkout COD controls. COD allow and block lists, plus approve, hold or cancel actions by return-to-origin risk level.
• 3D Secure 2. Razorpay states it has fully migrated to the 3DS 2.0 framework, with no merchant work needed.

For disputes, Razorpay sends email and webhook alerts when a dispute is created or changes status, and lets merchants accept or contest through the dashboard or API, as described in itsdisputes documentation. The dashboard supports team-wide 2-step verification.

Gaps: Razorpay’s public documentation focuses its merchant-configurable rules on international payments and COD. It does not describe a named card-testing control or device fingerprinting for domestic card payments. Ask your account manager what applies to domestic traffic.

What does Cashfree RiskShield offer?

Cashfree documents RiskShield in more detail than any other provider here. Its security page describes RiskShield as an AI and ML-based risk analyser and lists device fingerprinting, TOR blocking, a composite rules engine, velocity limits, rule backtesting, manual review, merchant blacklists and whitelists, and high-risk country blocking.

The Smart Rules documentation shows how much control merchants get:

• Conditions on amount, payment status, mobile number, email, UPI VPA, payment mode, IP address, card country, card BIN, location and proxy type (VPN, TOR or data centre).
• Aggregate rules for velocity, counting attempts or linked identifiers over windows from 5 minutes to 30 days.
• Two outcomes: block the payment, or flag it for review while it settles normally.
• Documented card-testing examples, such as blocking an IP that uses more than 5 unique cards in a day, or a card with more than 10 attempts in an hour.

Blacklists cover mobile numbers, emails, UPI handles, IP addresses and cities, with BIN blocks through the account manager. Whitelisted customers bypass rules. A Fraud Risk Indicator checks mobile numbers against government and partner lists, including numbers reported for cybercrime and SIMs flagged by the Department of Telecommunications.

Gaps: Cashfree does not publish whether RiskShield is included in standard pricing or charged separately. Its product page performance figures are vendor claims without published methodology.

What does PayU document?

PayU describes an in-built risk engine using a regression-based ML model trained on transaction-level features, with real-time monitoring that flags suspected fraud before settlement. It also mentions alert queues, address verification and risk-based scoring for cross-border and domestic transactions.

PayU’s strongest documented area is disputes. Its chargeback webhooks fire when a chargeback is created, changes status or changes amount, and include the reason code and due date. Signed webhooks with SHA-512 verification are available on request. The dashboard lists chargebacks, supports two-step verification and custom user roles, and PayU may hold settlements on risk grounds until proof of delivery is reviewed.

Gaps: PayU’s public pages do not describe a merchant rule builder, merchant blocklists, card-testing controls or device fingerprinting. Ask for a product demo before assuming these exist.

What does PhonePe Payment Gateway document?

PhonePe’s fraud detection page describes an ML-based security engine with real-time monitoring, pattern analysis for data anomalies and unusual card behaviour, velocity rate limits that block automated card-testing scripts, a feature called Smart Chargeback Shielding that flags high-risk purchase histories, and 3D Secure 2.0 support.

Gaps: the page does not describe merchant-configurable rules, blocklists, device fingerprinting or a dispute case-management tool, and it does not say whether these features are included in standard pricing.

What does CCAvenue document?

We chose CCAvenue over Easebuzz for the fifth slot because CCAvenue documents specific risk controls, while Easebuzz’s public pages offer general fraud guidance rather than product features.

CCAvenue’s F.R.I.S.K. engine (Fraud and Risk Identification System and Knowledge Base) checks each transaction against a negative database of past fraud and more than 150 variables, including high-risk IP addresses, velocity, negative email lists and issuing bank BIN mapping. A risk team reviews flagged transactions and the merchant decides whether to process them. CCAvenue says merchants can define velocity filters and block by country, email, card number or geo IP. A 2009 press release described F.R.I.S.K. as built in at no extra cost.

Gaps: much of this material is old, ML is not described as a CCAvenue capability, and its security pages cite PCI DSS 3.2.1, a version the PCI Security Standards Council retired in March 2024. Ask for current documentation and an up-to-date Attestation of Compliance.

How do the five providers compare side by side?

The table summarises documented capabilities only. “Not documented” means we could not find it on official pages, not that the feature is absent.

How should merchants evaluate a gateway’s risk tools?

A feature list tells you little about how a tool performs on your traffic. Five questions separate useful tools from marketing:

• False positives. Ask how many good customers the default settings decline, and whether you can see risk declines separately from bank declines. Razorpay’s risk decline rate and Cashfree’s block rate metrics are examples of what to look for.
• Review queues. Can you hold a suspicious payment for manual review, and who reviews it? Cashfree’s flag outcome and CCAvenue’s risk team review are two models.
• Rule control. Can your team add, test and remove rules without a support ticket? Can you test a rule before switching it on?
• Reporting. Look for fraud-to-sales and dispute-to-sales ratios, rule-level performance and export options. Our guide tofraud prevention metricsexplains which numbers matter.
• Dispute support. Check for webhooks on dispute events, API access for evidence, clear deadlines and any liability cover. Most losses still come through disputes, as our article onchargeback and friendly fraudexplains.

Ask each provider to run its tools on a sample of your past transactions, or to start in monitor-only mode, before you commit.

What should you configure in the first 30 days?

New risk settings should start cautiously and tighten with evidence. This checklist works with any of the five providers:

• Days 1 to 7: secure access first. Turn on 2FA for every dashboard user, assign least-privilege roles and verify webhook signatures. Our guide topayment gateway dashboard securitycovers the details. Record baseline approval rate, decline codes, refund rate and dispute ratio.
• Days 1 to 7: route dispute emails and webhooks to a shared, monitored inbox or ticket queue so no deadline is missed.
• Days 8 to 14: add card-testing velocity rules, such as attempts per card per hour and unique cards per IP per day, in flag mode where the provider allows it.
• Days 8 to 14: load your own blocklist from past confirmed fraud: emails, phone numbers, UPI IDs and IPs. For UPI-specific patterns, see our guide toUPI fraud prevention for merchants.
• Days 15 to 21: review flagged payments daily, count false positives, and move rules with low false-positive rates from flag to block.
• Days 15 to 21: allowlist trusted repeat customers and corporate buyers who keep tripping rules.
• Days 22 to 30: confirm your checkout sends full 3D Secure 2 data so issuers can approve low-risk payments without a challenge. See our guide to3D Secure 2 and checkout friction.
• Days 22 to 30: review dispute reason codes, record every rule change with an owner and date, and set a monthly review.

Which provider leads, and where are the gaps?

We place Razorpay first on three documented criteria: coverage across the payment lifecycle (network hotlist checks, ML scoring, AVS, COD controls and disputes), the only published liability cover for fraud chargebacks among the five, and a dispute API with webhooks that fits into existing support workflows. Its certifications are also current and published.

Cashfree is the strongest choice for merchants who want hands-on control. Its Smart Rules, velocity aggregates, blacklists and backtesting are documented in more depth than any rival’s, including Razorpay’s for domestic payments. PayU’s dispute webhooks are well specified, but its merchant-facing controls are not. PhonePe PG and CCAvenue describe capable engines with little merchant control on public pages.

Whichever you choose, treat gateway tools as one layer. They do not replace login security, order review or your own fraud data.

Frequently asked questions

1. Do Indian payment gateways include fraud detection for free?

Most run basic risk checks as part of standard processing, but few publish whether advanced tools are included. Razorpay prices Chargeback Shield through sales, and Cashfree, PayU and PhonePe do not publish risk tool pricing. Ask for this in writing.

2. Which Indian gateway lets merchants create their own fraud rules?

Cashfree documents the most detailed self-serve rule builder. Razorpay supports block rules for international payments and COD rules in Magic Checkout, and CCAvenue mentions merchant velocity filters and blacklists.

3. Can a gateway stop card testing attacks?

Partly. Velocity rules on cards and IPs catch many attempts, and Cashfree and PhonePe document such controls. You still need bot protection and rate limits on your own checkout.

4. What is Razorpay Chargeback Shield?

It is an ML-based programme in which Razorpay assumes liability for fraud chargebacks on international payments for a per-transaction fee. Pricing depends on volume and is quoted by sales.

5. Does 3D Secure remove the need for gateway risk tools?

No. 3D Secure 2 shifts fraud liability on authenticated card payments in many cases, but it does not cover UPI, COD, friendly fraud or attempts that fail before authentication.

6. How do I measure whether risk rules are too strict?

Track risk declines separately from bank declines, review flagged payments, and count how many turn out to be genuine. A rising risk decline rate with flat fraud usually means rules are too tight.

7. Should I rely only on my gateway’s fraud tools?

No. Gateways see payment signals but not your account, delivery or returns data. Keep your own controls for login security, high-value orders and refund abuse.

8. Which gateway provides chargeback webhooks?

Razorpay sends dispute webhooks and email alerts and offers a Disputes API. PayU documents chargeback webhooks with optional SHA-512 signing.