Credit card fraud - how to prevent ?

Hi folks,

We launched a site in the fall for a fairly high end jewelry store. Business hasn't really taken off real big yet, so every order can be looked at carefully.

They received orders on the 26th and 27th from new customers for mid range products ($350-$375). Nothing remarkable about the orders other than that both were ordered from Los Angeles area addresses and both were sent to different addresses than the billing address. The orders were shipped, fedex 2-day as the customers paid for.

Today they received two more orders from the same customers, three minutes apart, for larger purchases. The store manager began to get suspicious. FedEx delivered the second of the original packages before they were able to put a hold on it.

Each order came from a different IP address. Tracking back on the settled transatactions, we've so far discovered that one of the purchases was definitely fraud.

Meantime, a third customer today made an identical order to the first one. This time in another state. Once again, delivery is to a different address.

All the card info checks out - CVV, address, zip, name on card, expiration, etc. We're using Authorize.net for credit card processing, and since everything on the card is good they let it pass.

We're not shipping any more items on these accounts until we're sure the purchases are clear, and will probably pursue legal action on the delivered goods.

Meantime, are there any suggestions as to what else we can do to keep incidents such as this from occuring again?

There is only one way to stop credit card fraud. Stop taking credit.

But there are ways to reduce credit card fraud.
Look up the customers address on an internet map. Call the customer and explain you are the fraud prevention division of the company. Ask if the order for so and so product was requested from this billing address. If they say yes then ask what the nearest cross street is to the billing address. Look at the map and verify the answer.
Stop shipping via express service. Slowing down shipment reduces the number of buyers who will commit fraud on you.
Wait several days before shipping the order. This gives the credit card owner time to report the card as missing.

For big ticket items, video tape the assembly of the order and delivery to the shipper. This will help the small claims court to see you have the ponderance of the evidence. Showing the product was shipped.

Good luck and I hope others provide more ideas.

Always use a tracking number on your shipment and require a signature on the receipt.

stagebrace:

Look up the customers address on an internet map. Call the customer and explain you are the fraud prevention division of the company. Ask if the order for so and so product was requested from this billing address. If they say yes then ask what the nearest cross street is to the billing address. Look at the map and verify the answer.

I like this idea.. will have to start using it :)

Stop shipping via express service. Slowing down shipment reduces the number of buyers who will commit fraud on you.

Although its a good suggestion.. note that you may be turning away valid orders. Some people prefer to have it overnighted / sent express as they want to get it NOW. What you could do, however, relates to the point he made below it (wait several days). You could put a processing time of 48 hours, which still may not be enough to have the cc owner report it stolen, but gives you some time to contact the issuing bank, etc to see if any unusual activity has gone on with the account.

With the business I'm in.. people want it NOW.. people want it shipped TODAY. So its hard to me to require a 48 hour processing time and remove express service.. as I would be turning away a good chunk of my business by doing that. My "red flag" so to speak is whenever anyone checks out with a credit card that doesn't have their name on it. Sure.. name usually isn't checked during the instant payment process.. but if its different and the shipment is going to a different address.. I usually pick up the phone and ask to speak with the cardholder :)

Take a look at the MaxMind Credit Card Fraud module:
http://www.zen-cart.com/forum/showthread.php?t=55599

The address verification over the phone is a great idea for high dollar orders, part of the module adds a google maps link under the billing and shipping address for quick access.

ses707:

Take a look at the MaxMind Credit Card Fraud module:
http://www.zen-cart.com/forum/showthread.php?t=55599

The address verification over the phone is a great idea for high dollar orders, part of the module adds a google maps link under the billing and shipping address for quick access.

Hey, thanks for the pointer. Wish I had seen this one come in earlier this month - probably got gobbled up by the anti-spam server.

Anyway, it looks like a great mod. I actually found MaxMind yesterday by another route (we had another round of suspected fraud), and was thrilled to see that there's already a Zen mod for it. Thanks for doing that!

I checked a handful of buyers on the site in question, and the known and suspected fraudsters came in between 9.68 and 10, where the real customers came in below 1. Looks like a VERY useful tool.

This is becoming a real problem for lots of people. Enough so that many web stores will no longer ship to an address other than the billing address.

We recently had our first fraudulant purchase (almost $2000) and it was approved through Linkpoint without a hitch ---- because we were allowing the product to be shipped to another address in Zen Cart. We always do the detective work when an order is shipped to a different address than the billing, but previously they all checked out OK.

Fortunately on this one, we were able to find a phone number to match the billing address that wasn't even close to the phone number the buyer gave us (1st red flag). The name at that address didn't match the buyers name even remotely (2nd red flag). The buyer ship to address was in another state (3rd red flag). A phone call was made to the phone number that we found on the web and the card holder confirmed that it was fraud.

We had the credit card process set to capture the sale automatically so the fraudulant sale was already charged to the real cardholder before we could void it. The transaction took place less than 20 minutes before the automatic batch time.

We have since then removed the additional address options in Zen Cart and have also set the credit card process to authorize only so that fraudulant purchases can be voided before they are batched. We have added instructions to the buyer that if they want to have the item shipped to a different address they will need to contact us first for approval.

Yes, it is going to turn some buyers away but since most of our products are over $1K, it isn't worth it for us. Unlike PayPal, you don't get a buyer history when they use their credit card which can be very helpful in deciding whether or not to allow the order to be shipped to another address besides the billing.

Interestingly, we have NEVER had a fraudulant purchase through PayPal for many years now. (gently knocking on wood :frusty: )

It doesn't matter where you ship the item to i had two charge backs and we only ship to the billing address on file with the credit card company. If someone doesn't want to pay for the item they can say one they never received it, never authorized the purchase. Online retailer have no signed receipt for purchase so you can not prove the person actually made the purchase, this is a new scam people place orders online for big ticket items and them once they receive them they claim they never made the purchase, since credit card companies are in favor of the owner the merchant is stuck with the charge back i have stop accepting credit card, i only use paypal and google check out and i only ship to confirm address. Yet google and paypal are not the safest way to go but at least your not paying the costly monthly fees for a merchant account + processing fees.
and as you mention we have NEVER had a fraudulent purchase through PayPal or now the new google check out, yes we loose sale but the cost is great than the lost of a sale for a charge back because you loose the Item and the money so your out on both ends Charge back are always on the merchant i would recommend NOT taking credit cards online, take them by fax WITH SIGNATURE or over the phone and have a recording system in place let your customers know the phone call is record for security reasons..

I hope this helps

LRS:

This is becoming a real problem for lots of people. Enough so that many web stores will no longer ship to an address other than the billing address.

We recently had our first fraudulant purchase (almost $2000) and it was approved through Linkpoint without a hitch ---- because we were allowing the product to be shipped to another address in Zen Cart. We always do the detective work when an order is shipped to a different address than the billing, but previously they all checked out OK.

Fortunately on this one, we were able to find a phone number to match the billing address that wasn't even close to the phone number the buyer gave us (1st red flag). The name at that address didn't match the buyers name even remotely (2nd red flag). The buyer ship to address was in another state (3rd red flag). A phone call was made to the phone number that we found on the web and the card holder confirmed that it was fraud.

We had the credit card process set to capture the sale automatically so the fraudulant sale was already charged to the real cardholder before we could void it. The transaction took place less than 20 minutes before the automatic batch time.

We have since then removed the additional address options in Zen Cart and have also set the credit card process to authorize only so that fraudulant purchases can be voided before they are batched. We have added instructions to the buyer that if they want to have the item shipped to a different address they will need to contact us first for approval.

Yes, it is going to turn some buyers away but since most of our products are over $1K, it isn't worth it for us. Unlike PayPal, you don't get a buyer history when they use their credit card which can be very helpful in deciding whether or not to allow the order to be shipped to another address besides the billing.

Interestingly, we have NEVER had a fraudulant purchase through PayPal for many years now. (gently knocking on wood :frusty: )