What Would Your Next Steps Be? Dealing with chargeback fraud.

We have an online store and a brick and mortar store. The online store accepts credit cards through Linkpoint.

We received a transaction over $500 at the online store. The AVS code was YYYM. The card was with Bank of America. The customer wanted Next Day delivery. Next Day delivery is generally a red flag. We called Bank of America (BOA) (proof on our call logs) and spoke to a BOA rep who did a name and address verification. Everything matched (name and billing address). We shipped to the billing address with UPS. We obtained signature on delivery. The signature was a different name than what is on the transaction.

The customer disputed the transaction stating it was fraud. We submitted all documentation to fight the chargeback claim and won. It was reversed back in our favor.

One month later (this month) after winning the chargeback dispute it is now reversed in the cardholder's favor. This cardholder is stating that it was not their signature. This is their argument.

We contacted Linkpoint. They were useless. They stated that because you are an online merchant you can bear 100% loss. Is this true?

We did everything right. The AVS code is YYYM. We even called and did a name and address verification and obtained the name of the BOA rep that verified that the info the person entered was correct and matched. We shipped to the billing address only. We used a reliable shipping company. We requested signature. We obtained a signature at delivery.

What is our next recourse? Linkpoint states we need to go after the cardholder. However, shouldn't we sue BOA? They verified the information was correct and sent the YYM avs code.

This seems like real bull:censored:. It is 2009, not 1909. You can not force a person to sign their correct name at delivery or use their "valid" signature at delivery.

If we go after the cardholder to sue them. How do we obtain their correct information? They have a very common name. We do not have their SSN. Would we sue the cardholder in our state or their state?

It is not fair that as an online merchant, people can come online and buy whatever the :censored: they want, be valid and then claim it is fraud. We covered all of our bases. We went above and beyond in preventing fraud and in the end still get :censored: by those with power.

This is a huge learning lesson. The managers are contemplating only accepting PayPal or Amazon Checkout and doing away with credit card processing. At this point AVS Codes, shipping to the billing and signature at delivery seem like a complete joke.

I hope people respond as to what they would do in this scenario.

Perhaps you should make it policy to call the purchaser for all sales over a certain amount? You could also ask for a signed invoice for all purchases over a certain amount, via email or fax.

Thanks for your reply Kim. Most people give us cell phone numbers. The telephone number on file may not be the telephone number the bank has on record. Generally people have at least three different telephone numbers. What if they give you a work number but the bank doesn't have their work number on file and the AVS Code is great (YYYM) and the name and address matches, do you not ship?

Additionally, during a chargeback dispute the telephone number has nothing to do with the fight.

I think that was just a little upfront checking for yourselves,

you could also ro a reverse address check on the address and phone they give you make sure thye match for large orders

Calling the customer has nothing to do with AVS - Call the customer to verify they placed the order and if the order is over a certain amount do not ship the order until you have a signed copy of the invoice.

Kim:

Calling the customer has nothing to do with AVS - Call the customer to verify they placed the order and if the order is over a certain amount do not ship the order until you have a signed copy of the invoice.

Kim, I understand your logic. However, your signed invoice will not win a chargeback. Your credit card processing company will advise this to you.

Merlinpa1969:

I think that was just a little upfront checking for yourselves,

you could also ro a reverse address check on the address and phone they give you make sure thye match for large orders

Our upfront checking was calling the credit card issuing bank and verifying that what they had on file matched what the cardholder entered as the billing. There is really no more up front checking that a merchant can do. Linkpoint agreed. However, they can not and will not fight for merchants. They only check that your dispute is legible and pass it on to the appropriate party. This is from Linkpoint's lips to my ears and fingers to this screen.

I would have done exactly what you did, and would have ended up eating the $500 loss, as I suspect you will.

It isn't right, but the CC processors don't really care (as you've found out), and it isn't enough money to warrant legal action.

As for offering only Paypal, I've heard similar stories about them. As angry as I would be in your position, cost of doing business, I guess.

Do you sell products that expensive, or did the thief load up his cart with smaller items? Might be a possibly helpful answer there.

stevesh:

I would have done exactly what you did, and would have ended up eating the $500 loss, as I suspect you will.

It isn't right, but the CC processors don't really care (as you've found out), and it isn't enough money to warrant legal action.

As for offering only Paypal, I've heard similar stories about them. As angry as I would be in your position, cost of doing business, I guess.

Do you sell products that expensive, or did the thief load up his cart with smaller items? Might be a possibly helpful answer there.

Hey Steve,

Our flagship product starts around $400. This transaction was over $700. It is a normal transaction size based on what we sell.

We have actually had great experience with PayPal. We only ship to confirmed addresses and get proof of delivery with signature (depending on what they order and order total).

I did get a chance to participate in an Amazon webinar and they basically eat the chargebacks. We are installing Amazon check out on our new site now. Our tech guy is trying to work out the bugs we are running into at the moment.

I don't think we will eat the charge. I think we will sue the customer. Maybe a judge will understand responsibility. This transaction was definitely not fraudulent. The issuing bank verified the information on file was correct.

What if there was a merchant association consisting of online merchants that were just as if not more powerful than a bank and would protect merchants in cases such as this one? I would pay membership dues to participate. Anyone one to start one?

One more thing. When I looked at the chargeback dispute, this customer was ripping off American Airlines, Steve Madden (shoes), Delta Airlines and a Music company in Chicago.

Folks,

You are missing my point - The merchant account provider is not in business to protect you - They are in business to make money, just like you. They make money by providing a way to collect your payments and transfer them to you. The fees are collected from the merchants and interest and fees are collected from the consumers. They are not going to eat the loss when a consumer disputes a charge. That is just the way life is.

YOU have to protect yourself, if you don't you are taking potentially large risks and while you may be fine for a while, eventually taking those risks will bite you.

Kim:

Folks,

You are missing my point - The merchant account provider is not in business to protect you - They are in business to make money, just like you. They make money by providing a way to collect your payments and transfer them to you. The fees are collected from the merchants and interest and fees are collected from the consumers. They are not going to eat the loss when a consumer disputes a charge. That is just the way life is.

YOU have to protect yourself, if you don't you are taking potentially large risks and while you may be fine for a while, eventually taking those risks will bite you.

Your point is not being missed. You stated a few "precautions to take in order to avoid chargebacks." I am advising you that the "precautions" you advise do not avoid chargebacks. If you contact the issuing bank for a name and address verification, and they verify that the information provided is correct and a customer is still allowed to basically not pay their charge a signed invoice means nothing. Signed invoice...bank verification... bank verification trumps the signed invoice and if the bank states they do not want to pay, they do not have to pay.

It is a matter of being fair. The bank is out to protect and keep their customer, the cardholder. The merchant only has the merchant processing company and themselves. The merchant processing company does not care and will not assist. So in the end...

1. The AVS Code the merchant processing company tells you to covet is a joke.
2. The shipping to a billing name with billing address with signature on delivery the merchant processing company tells you to covet is a joke.
3. The name and address verification a merchant does to "protect themselves" is a joke.
   Kim, I think you are not seeing the point. All bases were covered. There is nothing more we could have done shy of flying to the customer's state, asking for ID and using a carbon copy to imprint the card. Wait... because the transaction was on the Internet... the bank would have agreed with their customer.

Everyone can buy what they want on the Internet, have the AVS Code be YYYM, have the merchant contact their bank and have the bank agree that the information matches what they have on file "in their highly secured" databases, have it shipped to them at their home which is on file with their bank that the merchant verified and sign it as "Betty Boop" when it is delivered...contact their bank and say... "It was not me".

Ultimately, there is no way to protect yourself. This case is a fine example.

Going forward... this thread was not created to "teach us how to avoid a chargeback". This thread was created to ASK what would your NEXT steps be in regards to handling this fraudulent customer.

Again, thank you in advance for what you believe we "should have done".

*Moderator Note
*In terms of next steps, I will advise you that this forum is not the place to plan or drum up support for or to strategize how to sue anybody. If you choose to go that route, please do so privately and not on this website.

DrByte:

In terms of next steps, I will advise you that this forum is not the place to plan or drum up support for or to strategize how to sue anybody. If you choose to go that route, please do so privately and not on this website.

I was not looking to "drum up support" or a cheering squad. I was looking for previous experiences and how others went about handling it. The forum I posted in was a valid forum. It was a business to business discussion. If I was an outsider looking in I would think that my post would be a valuable, educational, learning lesson based on the experience of another.

If people sit quietly and do not share their total business experience in the "right" forum then others do not learn on how to be successful or minimize failure.

Thank you for showing me that a "real" discussion that is off Zen Cart topic and in the right location are not welcomed.

The sad reality is that if the card is not present and swiped at the time of purchase, you - the merchant - accept 100% of the liability if the cardholder says "It wasn't me".

I've taken credit cards both in store and MOTO (mail order - phone order) since 1970 and now on the internet. I've fought the same battles only to be angry, frustrated and poorer because you will seldom if ever, win.

My advice is to mark up your items a tiny percentage to cover the potential chargebacks -a kind of insurance policy to cover potential bad debt.

pdxdoug:

The sad reality is that if the card is not present and swiped at the time of purchase, you - the merchant - accept 100% of the liability if the cardholder says "It wasn't me".

I've taken credit cards both in store and MOTO (mail order - phone order) since 1970 and now on the internet. I've fought the same battles only to be angry, frustrated and poorer because you will seldom if ever, win.

My advice is to mark up your items a tiny percentage to cover the potential chargebacks -a kind of insurance policy to cover potential bad debt.
Hey Doug,

It is funny that you mention that. We discussed this today and have decided this is what we need to do as a possible recourse. I remember hearing over the years, "Because of fraud everyone pays" or something along that line. The unfortunate part is that it kinda makes you not as competitive price wise but hopefully customers will see the benefit in the fast shipping and the service. Thank you for your idea.

Rabbcon,

My company is a payment service provider in the UK. For transactions of your size you really need to be doing 3D Secure as the security check. You can buy card data from crooks online that come complete with AVS & CV2. It is one of the most easily spoofed security checks there is. AVS & CV2 should only be used as an indicator and never relied upon as being accurate in any way shape or form.

The only way to shift liability away from you to the card holder is 3D Secure. Its that simple.

I also think you will be waisting your time trying to get your money back. Take it as a lesson. Use the time you would have spent chasing this person on implementing 3D secure and move on.

Hope this helps.

Have you considered hiring a PI to prove the sig did come from that household. Then sending that to the CC company to dispute the dispute?

stagebrace:

Have you considered hiring a PI to prove the sig did come from that household. Then sending that to the CC company to dispute the dispute?

We contacted a private investigator. He stated hiring him would supersede the amount lost. We have decided to take the customer to court for the amount owed and if ruled in our favor and not paid requesting a judgment.

IridiumCorpSupport:

Rabbcon,

My company is a payment service provider in the UK. For transactions of your size you really need to be doing 3D Secure as the security check. You can buy card data from crooks online that come complete with AVS & CV2. It is one of the most easily spoofed security checks there is. AVS & CV2 should only be used as an indicator and never relied upon as being accurate in any way shape or form.

The only way to shift liability away from you to the card holder is 3D Secure. Its that simple.

I also think you will be waisting your time trying to get your money back. Take it as a lesson. Use the time you would have spent chasing this person on implementing 3D secure and move on.

Hope this helps.

We are a U.S. based company. This option would not work for us. Additionally, the UK will not do a name and address verification for anyone. This would be a big hassle for us. Thank you for your recommendation. However, we will pursue them in a court of law in the U.S.

Going forward, what will you be doing to manage your risk? Will you ship overnight again? If the resident was in fact not involved in the purchase, the following is what happens. An I can imagine there is a whole industry around this fraud.

1. Card data is stolen
2. House is watched to see if anyone is home in the early hours.
3. If no one is home in the early hours, then the overnight order is placed.
4. Fraudulent customer waits in the neighborhood or even the front porch for the early delivery.
5. Signs for delivery, and drives away with it.

Regular ground shipment is harder to predict what time of day the delivery will occur. A no return address snail mail letter to the resident with a code to call your company before shipment will also reduce the chance of the fraud shown above.

When GPS package tracking devices become cheap enough you can build that into the product. But the fraudulent people will learn how to remove it before leaving the resident it was delivered to.