Fraud Prevention Tips for Ecommerce Merchants

Who pays for online fraud? If you are an ecommerce merchant, you already know the answer. It is the merchants that bear the brunt of the expenses for online fraud. It may be hard to believe, but in addition to the lost merchandise and cost of shipping, it is the merchants that lose out on the money, pay fees on the initial charge and then up to $50 per charge back on top of the loss, in addition. Most consumers do not know what happens when their credit card is used fraudulently. After the consumer gets everything resolved with the credit card company and once they learn they are not responsible for any charges, it is soon a thing of the past, and no longer an ordeal for them. The credit card issuing banks and the merchant banks do not absorb any of the cost; it all falls on the merchants. Therefore, it is imperative for merchants to know what to look for in an effort to make sure that all orders received are legitimate orders and can be verified in some way before they are shipped.

Here are some tips for merchants to help screen orders received online.

AVS Codes

These codes are put in place to help protect merchants and identify actual card holders. Do not let the acronyms confuse you. AVS stands for Address Verification System. There are a series of codes that let merchants know if the address listed on an order as the billing address matches what the bank has on file for their card holder. It checks for several parameters and can also let merchants know if there is a partial match or a full address match. The problem comes in if the address verification system is not supported by the issuing bank, which is likely the case in most countries outside of the United States. If you do not accept orders from outside the United States, then you do not have to worry about that.

However, if you do not want to miss out on international sales, then you can always call the issuing bank and attempt to confirm the address and verify the sale with them. It might take some time, as they might need to contact the card holder. Also take into consideration the time difference; you will need to call during their banking business hours. Of course, the address verification system for the billing address does not help if the customer is having their order shipped to a different address. Perhaps it is a gift, or being shipped to their place of business so that they are there to accept the package when it arrives. Most banks do not even allow their card holders to list additional addresses on file, which would help eliminate the issue for merchants that get a large majority of orders shipping to a different address than the billing address, such as their work. If that is the case, you would also need to consider the security number match and other signs as listed below before deciding if a different shipping address makes an order a problem or not.

CVV or CID Codes

CVV or CID codes are the extra security numbers that are printed on the credit cards. By now most everyone is familiar with them, but for identification purposes, they are the last 3 digits on the back of Visa and Master Cards and the 4 digits on the front of an American Express card. There are several things wrong with this type of “security” system. If a person’s card is stolen, the thief has those numbers. The numbers often get rubbed off or become unreadable in many cases and card holders do not want to go through the hassle of ordering a new credit card because of it. That leaves merchants likely declining legitimate orders for those situations and accepting orders for the other scenario. The key is putting together all the clues from the different tips here to see if they add up to be suspicious or not.

Some Tell-Tale Signs

Over the years of being a merchant some signs and patterns become evident as commonly used for fraud. What to do when some orders have a billing address match and security code match but are still fraudulent? Some patterns or factors to look for:

• Is the order requested to be shipped to an alternate address other than the billing address?
• Is next day shipping or express shipping chosen?
• Is a free email service being used?
• Is it shipping to a freight forwarding or mail box company?
• Is this a large order that is out of the ordinary from the norm for your company?
• Unfortunately, there is no single tell-tale sign, or even combination of events, but any of these factors present on an order should raise the red flag and warrant further investigation.

What further investigation can you do? (A.K.A. How to Be an Internet Detective)

• Use Google. Google is your friend. There is a large amount of information available when you Google a name, email address or physical address it can tell you a lot about the person or at least the address on the order. When you use Google Maps to search an address you can see the surrounding area and the street view. Is there a big million dollar house at that address? It is less likely to be fraud in that case.
• Search for information on the address. Zillow.com will actually tell you how much a house is worth in addition to facts like if it is for sale, or even in foreclosure. Is the address an empty lot? It is very likely to be fraud in that event, and yes, that does happen!
• Check the Phone Number Area Code. Is the billing information actually attached to the card holder? Check the location of the area code of the phone number and Google will tell you what city that is in. Additional resource is the Yellow Pages online and other sources that come up during a Google search of the phone number.
• Evaluate the email service provider. Yahoo and Hotmail free email services have the highest frequency in online fraud orders received. This does not rule out Gmail, however it is used less for fraudulent orders because of Google’s invasive nature connecting too many dots about users. If a Gmail email address is used, when you search that, if an active Google profile or an active Google Plus profile comes up, it is not very likely to be fraudulent.

Freight Forwarding and Mail Box Companies

Sometimes searching for the address or email address in Google might return results from other merchants warning about fraud. That is, of course, your telltale sign and you are done with your investigation. In some cases the shipping address is a freight forwarding company or a mail box location. That should definitely throw up the red flags.

However, it does not always mean that it is definitely fraud. A quick call to the freight forwarding or mail box company should give you enough information and insight as to whether the order is for a legitimate client of theirs or if it is committing credit card fraud. If the manager at the freight forwarding company says that there are a ton of boxes from all different companies arriving for this client he is not familiar with, you can be pretty sure that is fraud. If the manager can tell you that this is for a long standing client he has dealt with for years, then your order is probably safe. There are not always those two extremes for all cases, but a little investigating goes a long way. Who knows, you might make a business connection with a freight forwarding company that can result in a mutually beneficial relationship for you both.

Calling the Issuing Bank or Card Holder

With today’s high level of encryption the merchant, website owner, webmaster, or developer does not have access to the credit card number that is used to place orders online. The merchant does usually can only see the last 4 digits identifying the card holder’s account and also the first 5 digits of the credit card which identifies the issuing bank. If you are unsure about an order you received, call the issuing bank. In some cases, the banks are so cautious they will not give any details or even confirm any details. However, if the bank will call their card holder, then the order can still be verified that way. In some cases, they can tell you if the billing or shipping address is on file with them, and in some cases they can give the card holder’s contact information or verify the information you have is connected to the card holder so that the merchant can then call to verify the order.

As you can see, there is a great deal of investigative work that can be involved with verifying an order. When fraud does happen, often the merchant is not notified of the fact until months later when a dispute is issued. In any case, there is almost never a notification before the merchandise is shipped out and lost. Small businesses that sell online have been paying for online credit card fraud for years. The merchants are punished for accepted credit cards issued by other companies that are not properly policed by those companies. Therefore, if small business merchants do not want to lose money due to fraud, they can follow some of these guidelines from seasoned online merchants to mitigate some of the fraud that comes across their online shopping carts. In the event that fraud does come through your system, you can always report it to the police department of the card holder, issuing bank and there is an FBI website http://www.fbi.gov/scams-safety/fraud/internet_fraud merchants can log the information on and report it to the government directly.