E-Commerce Fraud Sucks! Hints to Reduce the Rot
By Scott Sanfilippo on Fri (3/14/08) in E-Commerce Operations | 1 Comment
The rate of fraud associated with international orders is over two-and-one-half times that of domestic orders. Merchants also reject international orders at a rate of two-and-one-half times higher than domestic orders.
- CyberSource
No two words set an e-commerce store owner’s blood boiling like “fraud” and “chargeback.” Unfortunately, they’re all too common.
The CyberSource 9th Annual Online Fraud Report estimates that $3.6 billion went to online fraud last year. We’ve all lost our share.
Fraud will continue to grow along with e-commerce unless we stop bad orders before they hit the package car. The question is, how?
Be Wary of Foreign Orders
Merchants surveyed by CyberSource said “the rate of fraud associated with international orders is over two-and-one-half times that of domestic orders. Merchants also reject international orders at a rate of two-and-one-half times higher than domestic orders.”
When I ran our former pet supply division, we had a many international orders and were occasionally burned. We developed a straightforward no-exception international policy:
- International customers must fax a copy of the credit card (front and back) along with a signed copy of the order
- The issuing card bank must verify billing information
- No orders to third-world or developing countries
- Absolutely no orders to Nigeria, the fraud capital of the world
We immediately caught numerous orders before the card was run when customers could not provide information. After we established a relationship with the international customer (at least 2 orders without a problem) we noted their account and streamlined the process.
Shipping to international destinations teaches you which country’s postal systems are corrupt and whose agents steal packages rather than deliver them. You learn which countries let you bypass customs if you mark the package as containing “religious articles.” Sadly, you’ll also learn which countries either hold packages for months or don’t deliver them at all.
Beware of Warning Signs
International fraud may be most prevalent, but we have plenty here at home, too.
The first warning of a fraudulent order is a package with a “ship to” address in a different state than the “bill to” address and is being shipped next-day air. In this case the “perp” will have stolen a credit card. He or she will get the billing address and take delivery at a vacant house, a house known to be empty at a specific time, or an empty lot. Because it’s next day air, the perp stakes out the location, meets the delivery, signs and disappears with the package. Trust me, it happens!
We immediately flagged orders like these and had a CSR contact the credit card’s fraud department to verify if the customer had a valid shipping address on file and if fraudulent activity had previously occurred on the card. We matched the shipping name address to the house registration. Next, we would run the card and match the AVS. Finally, we called the customer for verbal confirmation before releasing the information. It’s not always 100%, but it reduced fraud.
Policies and Procedures Provide Protection
- Always, always, always, use address verification (AVS) with your credit card processor. AVS compares house numbers and zip codes of what you’re sending and what the customers have on file with their card company. If it doesn’t match, proceed with caution. AVS is generally available only for US cardholders in Canada and the UK.
- You are considered a card-not-present merchant and must obtain a card verification number (CVN, CVV2, CVC2, or CID). These three- or four-digit numbers verify that the card is in the possession of the card holder. This verifies, but does not guarantee the card isn’t stolen.
What if I’m a Victim of Fraud?
Usually, you’re out of luck. When a person who had a card used in a fraudulent transaction files a chargeback with the bank, you’re notified and allowed to file a response. Review the documentation with the chargeback notification and file the response even if it appears like fraud. Have it on file. Unfortunately, CyberSource reports that only 40% of chargebacks filed are won. If it’s a clear case of fraud, you won’t win a chargeback. File the paperwork, provide the transaction information and cross your fingers.
Fraud is real and some scams will get through. Still, having policies in place and being diligent are a good start.
How does your business combat fraud?
Contribute your thoughts to our website at our forum.
All posts by Scott Sanfilippo | E-Mail the author
1 Comment to this post
Leave a comment
Subscribe
E-Commerce Resources
Online Market World - The interactive website for business and technology managers involved in driving their online business.
Copyright ©2000 - 2008, eBiz Insider, a division of Solid Cactus, Inc - All rights reserved.
106 South Lehigh Street - Shavertown, PA 18708 - 888-361-9814
Hosted by SingleHop
Mike Wendand responded on Sun (3/23/08) at 2:52 pm
As the longtime owner of a couple of online stores, I’ve learned the hard way - through experience - that online criminals are constantly trying to take advantage of the ease in online shipping to commit fraud.
For consumers whose credit cards are used in online fraud, there’s no loss. The bogus charges are almost always refunded. But for online retailers who get conned into processing the orders, there is no relief.
If it’s fraud, you get a chargeback. You’re out the order, the merchandise you shipped and the online fees charged by your credit card processor.
Those chargebacks are never pleasant. In the early days, I had my share. But after plenty of grumbling, I decided to consider them what financial expert and radio talk show host Dave Ramsey calls a “stupid tax.”
Then, I set my mind to learn from them so I wouldn’t keep paying the “stupid tax.”
I started by making a list of every chargeback I was hit with over a 12-month period. I rigorously examined them, looking for patterns and similarities. As a result, I instituted some security procedures and checklists that have worked well in greatly reducing the fraud losses from my stores.
I still get stung, but very rarely these days. And having Solid Cactus design my main store has helped me get some critical tools that allow me to even further minimize fraud.
The one single step that has most helped reduce fraudulent orders for me and my stores is to eliminate shipping to any location other than North America. I know, that’s a drastic step. But while I no doubt do indeed do lose some legitimate business from overseas customers, it has been my experience that most fraud originates overseas.
And my experience is not unusual. Once recent study I have seen, from Cybersource, notes that fraud rates on overseas orders are four times the level of North American orders. Thus, not allowing orders from places other than the U.S. and Canada helps eliminate many of the problems.
Still, almost every day, some thief still tries to get through. Most of them are from criminals trying to see if a credit card number they have is still good. They’ll place an order and provide a ship-to address in the U.S.
Below are my top 10 suggestions for catching the fraud before you complete the transaction. As many of these flags as you have on an order, the more apt it is bogus:
1) Shipping FedEx overnight is a frequent marker. The thief figures the merchant will move so fast to process the order that there won’t be too much scrutiny. A dead give away and cause for you to seriously question the oder is when the overnight shipping costs approximate the item’s cost.
2) Look at the phone number and e-mail address provided by the customer. Does the area code match the city and state of the customer? If the customer uses a free Yahoo!, Hotmail, or Google account, does it correspond to the customer’s name? Thieves always use these free accounts. So, of course, do many genuine customers. But an e-mail to a domain not associated with free web-based accounts, with a username (the part before the “@” sign) that matches the customer, is usually good.
3) If your store has referrer info on orders, like Yahoo! Stores provides, for example, examine how the customer found you. My store’s order info lists the search phrase they used, or the last page they came from. Thieves tend to search on phrases like “international shipping” or “overnight delivery” instead of the category or keywords products are advertised under.
4) Check the IP address. And IP (Internet Protocol) address is a unique numerical identifier that much like a house address. In this case, it identifies the computer network that the order came from. Your oder processing software should also show you the IP address that the order was sent from. Check it out. On my Yahoo! Stores, all I have to do is click the address and it does a trace, identifying the network location. If it’s overseas, shipping to the U.S., I consider it fraud unless I can call the phone number and talk to a real customer.
5) Beware of mail forwarding operations and shipping to Post Office Boxes. Watch out for mail processing locations. Many thieves order your items from overseas and have them shipped to maildrops. Often, instead of a box number, these locations can be spotted by having a “suite” number under the address line. Miami and Houston have a bunch of maildrops serving South America. Seattle and Los Angeles have them for Asia. New Your City handles Africa and Eastern Europe. If suspicious, run the customer address through Google. Often you’ll see it listed to a service for mail forwarding company.
6) Be suspicious if the shipping address and the billing address on the order are different. At the very least, whenever this happens, don’t process the order unless you call the customer to confirm the order. Some stores even make it a policy to ship only to the billing address listed for the credit card. I get a lot of orders from parents buying my products for their kids who are away at college so that’s not a policy we impose. But we always call when the addresses are different.
7) Always expect fraud when you get multiple orders submitted from the same customer in sequence, using the same credit card, or the same ship-to address.
9) Be skeptical when you get orders with multiple quantities of the same product. It is common for fraudulent orders to be large quantities of a single item.
10) Look for typos, grammar and punctuation errors. Serious customers make mistakes in filling our your oder forms. But not nearly as often as thieves do.
If I had to boil everything down to a single piece of advice, it would be this: When in doubt, try to reach the customer. If the phone is disconnected, mark it as fraud. If there is no answer, leave a message on the answering machine. Then send an e-mail. If after 24 hours the e-mail and the call are not returned, do not process.
These are just some of the fraud indicators and precautions I’ve learned over the years. They are by no means exhaustive. But I have instructed all my employees to filter our orders through skeptical eyes. As a result, we’ve diminished our chargebacks to only two or three cases a year.
The author is the owner of the Online Christian Shopper (http://www.onlinechristianshopper.com) Christian T-Shirt shop and the Christian Jewelry Online (http://www.christianjewelryonline.com) Christian jewelery store.