Can I protect myself from fraudulent card payments on my portal before I issue a ticket?

Yes, to a large extent, but no setup removes the risk completely, so the honest answer is that you can make fraud much less likely rather than impossible. Card fraud worries anyone selling flights online, because a ticket is issued in seconds and the money can be pulled back weeks later, so it is worth putting checks in place from the day you start selling.

The main protection comes from your payment gateway rather than the portal itself. Most gateways offer address checks, card security code checks and a step where the customer has to approve the payment with their bank, usually through a code sent to their phone. When that bank approval step is switched on, the liability for a disputed payment often moves away from you and back to the card issuer, though the exact rules depend on your gateway, your country and the agreement you signed.

On the portal side, the useful habit is to separate taking the money from issuing the ticket when a booking looks unusual, such as a very late departure, a card and a passenger with different names, or several bookings from the same card in a short space of time. You can hold those for a quick manual look before anything is issued, and ask the card holder for photo identification if you are not comfortable. What your portal can do here depends on the supplier and on your plan.

The next thing to do is ask your payment gateway to turn on bank approval for every transaction, get in writing who carries the loss when a payment is disputed, and agree with your team which bookings you will always review by hand.