E-commerce: Card Fraud, how to fight it!

Paddy Furn

Our e-commerce have been targeted by fraudsters over the last few years, but since 3D secure has been become more common, fraud attempts have really fallen. But in the last month we have had a few fraud attempts, now they are ordering over the phone (by passing 3d secure)

We have tried report to the bank that we suspect/ know its a fraud, but the don't care and won't even report it to the customer.


At this stage we have a list of numbers and address for fraud attempt, I we were wondering would it be worth setting but a fraud attempt user base so that if other business get suspected fraud they can cross reference as they tend to hit as many people as they can.

Is this anyone else would be interest in? Is there any Legal issue with doing something like this?

sandin

Banks usually pick up on these within 24-48 hours.

There are so many and the system is so automated, it simply is not worth their while to take a single individual card details down and bypass the automated system.

Simplest thing is to have your own system and keep your business safe - e.g, check for dodgy addresses (never send to dominick street), double check dodgy nigerian names - soory to decent nigerians but your fellow countrymen are famous for frauds. Be suspicious for multiple numbers of a single item especially from new customers.

If suspicious, ask for other identificationwith name and address - a smart phone photo of a bill emailed to you will suffice (this really gets them)

Paddy Furn

I should have been more clearer, I don't mean collecting card info (legal repercussions would be huge) I meant a database of (delivery) addresses. Its seems these guys try alot of different cards but get delivered to the same address, yes banks will pick up on each card but they ignore delivery addresses.

What I'm suggesting is when you get a fraud order that the delivery address is entered into a common database for e-commerce sites to check off. So if they get a match you know to look more closely at the order.

We do have are own check list ( and procedures when we get suspicious), but I'm just thinking of another way to "flag" up an order as suspicious.

Paddy Furn

Someone suggested Trustev, they seem to be only in beta at the moment, but I think they check for a customer social footprint and then give them a score, another layer for checks, looks promising

TheCostumeShop.ie: Ronan

Trustev making a lot of noise and is very promising, it's early days though so it's not an immediate or catch all solution. It's technology is based on tracking ones online reputation - and not everyone likes or has an online footprint, but Pat and his team seem to have the most promising anti-fraud tech available. (Disclosure I used to be in business with one of the founders).

Merchants banks and retail banks don't really discourage fraud, in my opinion, as they have beefy admin charges if they get one and the retailer is completely fiscally responsible. In other words they do profit from it. They are required to verify address checks if you are suspicious of an order.

A database of (delivery) addresses, actually this is in place among larger e-com companies but the tech isn't shared with smaller companies. It is full of problems, for example if someone is doing fraud they tend to be moving from rented address every month. So the next person that moves in has problems. There is also some data protection issues here and problems with false accusation.

GoodBridge

I've been massively frustrated (even shocked) by how fraud is handled by the banks and authorities: the payment processor will just say void it, the Gardai don't want to know, your business bank doesn't want to know and the card-issuing bank doesn't want to know. Why? Like Ronan said, it's no skin of their noses and maybe they do even profit from it.

I've tried implementing 3DSecure before but it resulted in an unacceptable increase in the number of drop-offs at the checkout page so, all things considered, it made sense to back it out. I might try it again at some stage though.

Letting these people away with attempted fraud with nary but a cancelled order actively encourages them IMO.

To answer your questions, Paddy: it is something I would be interested in and I've thought about it before but, no, I've no idea about the legalities of it.

johnmurph01

Any facility for you to take order over the phone and then email customer link for payment (thus forcing them into 3D secure?)

Paddy Furn

A database of (delivery) addresses, actually this is in place among larger e-com companies but the tech isn't shared with smaller companies. It is full of problems, for example if someone is doing fraud they tend to be moving from rented address every month. So the next person that moves in has problems. There is also some data protection issues here and problems with false accusation.

What I suggesting is not to cancel an order based on address, but just a flag them, so it comes to your attention, it would be just the address, (the customer name would be irreverent away so no point recording)

Any facility for you to take order over the phone and then email customer link for payment (thus forcing them into 3D secure?)

not a bad idea, but some (genuine) customers just prefer to order over the phone, also from a sales point of view its better to "close" the sale asap. Still an option if you have half a suspicion.