Should there be any follow up on fruadulent orders?

We have recently had a spike in fraudulent orders. Although they have perfect credit card info, they are usually pretty easy to spot: expensive items that we don't sell a lot of, different billing and shipping address (often in different states), bogus phone numbers, completely fake emails or easily forged emails(ie. customername######################).

Whenever possible, we have been getting in contact with the card holder, though it is usually pretty hard to find a phone or email unless they purposely list it online. Otherwise, we just refund/void the order immediately and don't ship it.

The shipping addresses are always different, so I assume it is some sort of dropship scam. Is there anything else we can do other than just keep cancelling the orders when they come through and hope the scammers give up eventually?

Thanks for any advice.

I welcome the feedback of others who would chime in on this too.

I usually just do the same as you've described. I try to void the transaction whenever possible, as that makes the charge never show up on the purchaser's card (and I pay less fees). A refund will show up (and I pay a fee for doing it). Granted, if the card was stolen then usually the bank will simply be grateful that the refund was done so they don't have to chase you down to fix it after the card is reported.
I've sometimes called my bank to report a certain transaction as suspicious, and then just let them take charge of whatever they want to do with it from there. They've always been willing to receive my report, but never seemed to say "thanks for letting us know". So maybe they don't care. But worth considering.

If there's a pattern of bad transactions from certain IP addresses or regions, you could consider blocking those. Depends how big a problem it is.

#1, it is hardly perfect credit card info. unless you are doing an AVS check against the shipping address, and that comes back as having checked out as well. in which case the fraudulent perps have somehow infiltrated the issuing bank's systems.

#2, while voiding/refunding the card is not a bad idea; actually i think it's a bad idea. credit card fraud is a self-closing loop, if you void the transaction, you've left the loop open. indulge me for a second, it is RARE that a merchant will report their systems as having been compromised and credit cards stolen. even those merchants that figure it out, they would rather not tell anyone. so when a store owner, such as yourself gets a transaction that you feel/know is fraud, you void the transaction. now the party that ALWAYS reports the fraud is the injured party, ie the card holder. you have now not provided that information as you voided the transaction and the card holder now does NOT know that their card is compromised. you have kicked it down the line to the next merchant. if you were to leave the transaction as open, and NOT ship the goods, you have now alerted the card holder and protected yourself. (or maybe it is a good order?!?)

in addition, once a cardholder reports unauthorized transactions, the card gets cancelled. at this point, Visa/MC employ some sophisticated algorithms to try and determine where the stolen credit cards came from, ie which merchant's systems got hacked. they then notify the merchant, and at that point the merchant sends out a mea culpa to all customers who purchased, injured customers now get your year free of credit monitoring, and trustwave gets sued... or something like that... and the merchant says we are upgrading our systems despite having them certified as being PCI-DSS compliant. bunch of crap like that....

bottom line, my opinion is to leave the transaction in place and not ship the goods.

Except, Carl, that you'll be stuck with the $30 chargeback fee if you don't void or refund. The provider does not care about the merchant. At all. Ever. They always favor the card holder and sticking the merchant for fees wherever possible. Always. AVS isn't foolproof by any means so a fraudster doesn't have to have infiltrated anything. We can pretty easily spot the fraud orders now although every once in a while (once or twice a year) we still get burned. The thing for us is almost always international orders. We've blocked all of the countries that the majority came from so now the new scam is using freight forwarders. Luckily for us it's only around 1 order out of an average of 1200 per month so it's not too much hassle and we usually laugh and joke about the lame thief when we spot them. One employee has suggested we prank them by shipping a package and send the thief the tracking number. Only the package is full of poo. But I digress... Fraud is part of selling things and at least we don't have to worry about shrinkage since we are just ecommerce.

I've tried reporting to the local authorities when the thief was in our country (US), but after several dozen reports and 0 requests for anything which indicates 0 action on their part, I stopped wasting my time.

If you want to help close the loop, don't void and do a refund instead so it shows up on the victim's statement and you avoid a chargeback fee. If you get charged a lot for refunding and money is tight then voiding might be the best option for you. It's been a long time since we used a straight merchant provider so I forget how the charges/fees work for refunds. We use Paypal Payments Pro and can't void. With Paypal I think we end up paying like 60 cents for a refund, 30 for the payment and 30 for the refund but I'd have to check that to be sure.

Also, every time you get a chargeback you are putting black marks on your record with the provider and can find that at the worst you get dropped or your rates can go up or at least you can't get better rates as volume and history increases. Protect yourself first, always.

To the OP, there are a couple of ways to minimize fraud occurring. The first is to require the billing and shipping to be the same, depending on your customer base this could hurt your legitimate sales. Blocking the IP also helps after the fact. If it's international fraud, you can block those countries where it's happening unless you get a decent amount of orders from legitimate customers. Your merchant provider might have advanced fraud filters for an extra monthly fee and depending on your level of sales and the PITA factor of dealing with refunds/voids it may or may not be worth it. I know Paypal offers this for like $20 a month. For us it isn't worth it since it doesn't happen as much anymore once we blocked the countries that 99% of the fraud was coming from, plus we wouldn't have our laughs and scheming up ideas about pranking the losers. Good luck!

carlwhat:

so when a store owner, such as yourself gets a transaction that you feel/know is fraud, you void the transaction. now the party that ALWAYS reports the fraud is the injured party, ie the card holder. you have now not provided that information as you voided the transaction and the card holder now does NOT know that their card is compromised. you have kicked it down the line to the next merchant.

Just like what lankeeyankee said above, the moral victory of allowing the person to see that their card had been compromised is often not worth the fee we are charged for the chargeback, and the stained record of receiving the chargeback.

If I have time, I try to sleuth out the card holders phone number and contact them directly, but this is often very hard or impossible. Sometimes the phone number is easy to find, like in one case we had where the stolen credit card info, name and billing address lined up perfectly with a dentist at their office. So their name and office contact info were plastered all over their website. I called the office, it took me a couple minutes to explain to the receptionist, but she seemed to understand, even if she was quite skeptical, she relayed the info to the card owner. 20 minutes later, the dentist calls me back, still kinda skeptical, so I read her the billing address, the last four digits of her credit card, I tell her who and where they were trying to ship the item to, and I say, "Look, I'm not trying to get any information from you, I'm just trying to do you a favor and tell you that you need to call your bank and cancel this card." Then she said thanks and we hung up.

So I get to do a good deed, and in the best case scenario, it only wasted 40 minutes of my day.

A few years back, when I hadn't become jaded to the credit card companies and the banks, I tried calling the card issuer directly to tell them that a person's card info had been compromised. I said, "This is your customer, here is their name, address, and the last 4 digits of the card number. I am 99% sure their card info has been stolen, can I have their phone number to contact them and let them know?"

"Of course we can't give you any customer info."

"Ok, so will you at least contact them and let them know? At least send them an email or at letter or something to let them know that you know that their card has been stolen?"

"No, we can't do that."

:frusty:

i forgot about the chargeback fee.... my mistake....

the banks do not make it easy, that is for sure....

best.

We are having a similar but slightly different issue with the stolen credit cards. We are a club and accept memberships thorough our store. We are getting dozens of memberships purchased with stolen credit cards. It seems that they are just using our site to figure out which cards are viable and which aren't.

We have been refunding the orders. We would like to stop these scum from creating the orders at all. I have tried Fraudlabs, but all it does it tell us the likelihood that an order is fraudulent. I don't need help with that. I need to stop the order in its tracks. If Fraudlabs held the order until it was approved or disapproved that would be great, but it doesn't and they tell us that they can in most other shopping cart programs, but not ZenCart.

There are two keys we have found that can identify the fraudulent orders. The first six digits of the phone number are always the same, and the IP address in the order shows as two different IP addresses instead of the same IP shown twice. IP Address: 207.199.173.135 - 134.73.83.30.

If we could key on either the phone number, or the mismatch IP addresses and report back that the card was declined it would keep them from trying to use the card elsewhere or selling it as a good card. It would also save us doing refunds that cost us $2.22 each.

My Access Blocker (https://www.zen-cart.com/downloads.php?do=file&id=2237) plugin would "do the trick". Besides preventing SPAM emails, you can identify specific IP addresses for which a login and/or account-creation are denied.

More blocking ideas (including access blocker) are provided in the documentation.

https://docs.zen-cart.com/user/troubleshooting/blocking_attacks/

badbuyerlist and badbuyer have quite extensive databases of vendor reported fraud attempts. I've caught a few that way over the years. Do the rest of the world a favor and report yours too.

Telephone numbers are usually the first step in figuring out if all is not as it seems. Call and ask for the person who made the purchase, if the line is even a real one.

Also, understand how forwarders work, and that if the mailing address is a forwarder or a shared office center, that deserves further examination.
Don't be afraid to send a credit card authorization form, and require that and a picture of both the card used and the buyer's ID if you just don't feel good about the transaction. Square has a sample credit card authorization form, and you can likely find them elsewhere as well.
I talk to another member of my industry about this quite a bit, and we both ended up with a copy of the same driver's license, with two different names on it. But you will seldom get that and the credit card if its real.