Online Fraud out of control?

[robhs]

Tweet

We have just launched our new designersunglasses.co.uk website and am suprised at the level of fraud we have already encountered. Well at least I was suprised, until I spoke to Barclays Merchant Services - whose attitude was so disinterested I thought maybe I should go on an online spending spree with a few credit cards myself!

I am interested to hear other merchants experience of fraud and what can you do to minimise it without losing too many genuine sales.

Kind regards

Rob Halliday-Stein
DesignerSunglasses.co.uk

[GW-Sean]

Hi Rob,

I used to work for an online computer components site....the fraud levels were crazy...and you're right - the banks show very little interest (because the chargeback ultimately come back to you.... you have to foot the bill! )

We got around the fraud with a load of checks ...check landline numbvers against credit card numbers, against address details and post codes... request REAL email address's (no hotmail accounts etc.)

This will have an impact on the volume of sales you get (as the added security will put off some of the more impatient customers)... but you have to work out for yourself if the extra sales are worth the fraud risk

Hope this helps

Sean
sean.carter@mvmediagroup.co.uk
0161 242 7282

[accelerator]

Does your payment processor have any additional security features?

WorldPay seems quite good at flagging up potentially dodgy transactions even in standard mode. I believe ProTx has a paid for "ThirdMan" service. Look in to what your payment processor can do, you might find something of value.

Rgds

Accelerator

[3wdl]

As Accelerator says, there are a number of methods to cut down on the amount of fraud received. Things like Riskguardian (by Bank of Scotland I believe) are able to cut down on the amount of fraud that you will receive - they use a central database to look at IP addresses, postcodes, email addresses, etc and analyse the "risk" to the merchant for accepting that transaction. They work quite well and can cut down on the amount of chargebacks received.

[dmorison]

If it's out of control with regards the purchase of physical goods then it is completely out of control in respect of digital products - i.e. music and software downloads.

Google will make them listen - you watch! I'm keeping a close eye on their plans for an online payment system, which is almost certain to include user verification in which you have to prove your association with a particular card before you can make online payments with it. PayPal do this now with their verified account status but I can understand why many retailers are not keen on PayPal because of the brand / somewhat "amateurish" perception. This "stigma" may not exist with a Google backed verified buyer system, and thus retailers of physical products would be more inclined to offer it as a payment mechanism.

I think it is also likely to include an integrated Affiliate scheme, whereby AdWords advertisers can offer CPA deals to AdSense publishers. With that, and verified buyer status, merchants of digital products will drop direct association with Mastercard and Visa faster than you can possibly imagine. Then they might do something about online fraud. The Adult entertainment industry are seriously lobbying Google for this, and we all know how much $$$ is involved there.

To quote a recent headline:

"Google to compete with PayPal? No. They want Visa."

[redken]

Any merchants here experienced fraud relating to their affiliate programs?

It would be great if the networks could build some sort of feedback or trust counter for affiliates (like on eBay) so merchants could keep a check on the reliability of their affiliates - too many black marks and they could be removed.

Come to think of it the same thing could be introduced for merchants.

[deadgoodundies]

We've had some fraud on our site but it's pretty easy to spot now which are the fraudulent orders and which are real, the fraudsters have a certain pattern of what they order.

We use protx as our CC processor so find the thirdman service quite usefull and as you can accept or reject payments based on a rule system (i.e if the CVV2 number is wrong or invalid then the order is rejected).

We also use a live help system on our site so i can monitor the site 24 hours a day for any suspicous orders and then query them with the customer if need be (usually I will phone them up a couple of days later and ask them to repeat their card details).
Funnily enough we haven't had ANY fraudulent orders from the UK but countries to look out for are any part of Africa, Singapore, Malyasia and Thailand - every fraudlent order we have ever had have come from those countries.

Regarding fraudulent affiliate activity we have only found one affiliate that every order that comes through them is a fraud (so we have suspended the affiliate) , every time the person will order £200+ worth of goods and use the cheque payment facility as payment, needless to say that the cheque never arrives so within 30 secs of me getting the sale notification through AW im rejecting it (im sure it's just someone arseing around)

End of the day spotting fraudulent orders comes down to a lot of just plain common sense.

[gareth]

Something that we did which had quite a dramatic effect in terms of reducing the number of attempted fraudulent orders was to simply remove the dodgy countries from the site.

For example, now when you register with us, you cannot enter certain countries such as Nigeria, Indonesia, etc, and we state that if the country isn't listed then we don't support orders to there. It's simple and easy to do, but it now saves so much time in not having to deal with them. Even when the dodgy orders are easy to spot, it still takes time to deal with them.

[robhs]

We only allow UK orders and always do address and CVC checks. My suprise was at the amount of attempted fraud that passed the CVC checks. I think that and the banks total lack of interest is a disgrace even when one joker used 8 c cards all with correct CVC numbers. I called them to tell them i was very suspicious about one case after talking to the customer and going to refund the order and not ship the product. They pretty much refused to take the card numbers and investigate but offered to charge me £4 for an address check which i knew it would fail from our ST account. These cards will almost certainly be used on another less wary merchant and I think the bank have no right to recharge merchants when they show a total lack of interest in blocking cards which are clearly stolen.

The only option for us is going to enforce address validation on every order and remove the alternate delivery address options. It is really annoying because this will obviously lose us genuine business, but we simply haven't got the time to sort through the transactions. It is surely the banks fault the situation has become so bad becuase fraudsters know they have almost zero chance of getting caught!

[KirstyM]

Regarding fraudulent affiliate activity we have only found one affiliate that every order that comes through them is a fraud (so we have suspended the affiliate) , every time the person will order £200+ worth of goods and use the cheque payment facility as payment, needless to say that the cheque never arrives so within 30 secs of me getting the sale notification through AW im rejecting it (im sure it's just someone arseing around)

Yep. Petplanet and Greenfingers get similar dodgy cheque transactions. I think what's happening is that they are counting on some merchants missing some of these transactions, or not being organised enough to check their affiliate programme sales every month. I see lots of applications from these types of affiliate, but they have become easy to spot so we don't have too many problems with them any more.

[3wdl]

I've had affiliate fraud quite a bit - in pretty much every affiliate program i've run - maybe i've been unlucky

Always find em though. Networks are pretty good at it too.

[kier]

Any merchants here experienced fraud relating to their affiliate programs?

It would be great if the networks could build some sort of feedback or trust counter for affiliates (like on eBay) so merchants could keep a check on the reliability of their affiliates - too many black marks and they could be removed.

Come to think of it the same thing could be introduced for merchants.

Paid On Results have a system whereby you can leave comments on affiliates for others to see. Never seen it used hugely but certainly a good idea.

[glennjo]

hello rob
i also have a designerwear site and the amount of fraud is phenomenal out of 2500.00 of orders i am lucky if i get 250.00
there is only one thing you can do scan them properly if addresses dont match check them i always call worldpay if in doubt to check whether they have used their card before
worldpay is by far the best to deal with as they give phone numbers so you can call but usually fraud is a mobile phone and free hotmail account
it is a big hassle but comes with the site i guess
glenn johns
designerclothinglondon.co.uk

[gareth]

out of 2500.00 of orders i am lucky if i get 250.00

OMG!

It sounds like you need to get some better checks in place to stop those dodgy orders getting through - that must be wasting so much of your time...

I don't know what WorldPay offer, but I'd suggest you do the following if you can:

• Don't accept orders from countries with high levels of fraud (e.g. Nigeria).
• Enforce the use of the CV2 number and only accept orders where they match.
• Automatically check the invoice address given against the card.

Beyond that there is a whole bunch of things you can do to give more or less confidence in an order such as checking the IP address against the specified country/previous orders, checking whether a landline/mobile number was given, checking the type of email address given etc.

Hope that helps

[deadgoodundies]

Also a good one if anyone happens to be dealing with outside the UK is to accept American Express , unlike visa or mastercard their AVS and CV2 checks work in a lot more countries (visa and mastercard AVS outside the UK is useless - which is a real bugbear of mine, why can't they just all work together)

Regarding blocking high level of fraud countries, best way to do this is do a total IP block ban using .htaccess - of course this doesn't block those fraudsters using a proxy but make sure you remove them from the list of countries that you supply within your ecommerce software as well.