12 replies to this topic

[licensed2kill]

Hi All,

Recently, I've been hit by fraudulent credit card orders.


So first thing install the CVV and the IP tracker packages, and it's a bit under control.

But, I do want those who do this get a message. Is there any way I do to scare the hell out of these people legally?

One thing: My credit module is not automated. I collect the info and process it offline. You think this is much more safer than the automated if these are stolen cards?

I'm also looking for the discovercard website with customer service, but I don't think there's one after searching for it on the net.

Thanks very much.
Jey

Edited by licensed2kill, 07 February 2004, 07:11.

[daisuke]

I had a bad run in with fraudulent credit card orders and I believe it's all a matter of which credit card processor you choose. Before, I used a credit card service with no fraud protection system and their service was were really bad. After getting $1700 in frauds I canceled them, and signed up with one that had a strong credit card verification system which checks the billing address to the card owners address and the rates were even cheaper! Now I've been doing good business and the service is up to par with my standards.

So when looking for CC processors look for:
1) Credit Card Verification via Billing Address, CVV2, Card Holder name
2) Competitive rates
3) Good reviews from other merchants.

Kevin

[TerryK]

licensed2kill, on Feb 7 2004, 07:11 AM, said:

One thing: My credit module is not automated. I collect the info and process it offline. You think this is much more safer than the automated if these are stolen cards?

When processing orders manually, there are a couple of steps you can take to protect yourself from fraud:

1. You should *always* use the address verification system to ensure that the billing address provided by the customer matches the billing address on record with the financial institution.

There is a toll-free number in North America for checking Visa and MasterCard addresses (not sure about Amex as I don't accept it). Ask your bank for the number.

Through that number, you can also obtain the phone number of the cardholder's issuing bank. If you can't verify the address automatically, you can call the financial institution, identify yourself as a merchant trying to do an address verification, and ask them to confirm the information you have. They will ask you to provide the cardholder name and address, and just confirm whether it matches or not. They will not give you the correct information if the info you provide is wrong. (Note: Some banks have updated their policies and will not provide confirmation, but many still will.)

2. Seriously consider restricting the countries you offer service to. I've had far more fraudulent order attempts from countries like Nigeria, Indonesia and Malaysia than others, but there are many more. Read up on credit card fraud and you'll find much information on this.

3. Follow your gut instinct. If you've got a bad feeling about it, refuse to process the order -- especially if you get clues that don't match as in #1 and 2 above!

In 7 years of being online, I've only been hit a couple of times with fraudulent orders because I'm so vigilant. Yes, I've frustrated a couple of customers, but my bank account has remained intact.

HTH,

Terry

[licensed2kill]

Thank you Terry and Kevin for sharing your experience.
But, how can I as a seller take legal action against these online buyers who repeatdly come after me with their fraud cards?

I've installed a CVV field, installed an IP dection and also have a Collection agency in hand.

Thanks guys.
Jey

[daisuke]

I have the same question as licensed2kill. Does anyone have experience on this?

[dalaca]

Quote

When processing orders manually, there are a couple of steps you can take to protect yourself from fraud:

I have a tip that works for me... and it doesn't take to much time. If you get the GUT instinct that something isn't right and you have a lot of orders to process. Wait a day before running the card # in for that certain order. Sometimes the card would already be cancelled and you didn't have to wait on hold for 15 mins to find out.

thats just my two cents

D

[smash123]

Terry, You said "you can also obtain the phone number of the cardholder's issuing bank" Can you tell me what is the phone #? I'm facing a customer for ordering order $5000 and I did check his card issuer and confirmed this is a stolen card. Now, he is still keep ordering using fake card. According from your experience, what should I do? I mean should I tell him that we know you're using fake card or just tell him your card can't go through? Is there anywhere I should report this fraud ? Thank you

[TerryK]

I'm in Canada, and the phone numbers I was given may not be the same as what you need.

When I set up my merchant accounts, Visa and MasterCard both provided me with their support numbers, including the number for Address Verification (AVS). Within AVS, at least with Visa, I believe Option 2 is the one to use to obtain the phone number of the issuing bank. With MasterCard, I have to call the MasterCard Global number, push-button my way to the Merchant Account area, then there's an option to obtain issuing bank number.

When I receive an order that appears to be fraudulent, I call the issuing bank to see whether the billing information matches. If it doesn't, I suggest they contact the customer about potentially suspicious activitity. For orders coming from Nigeria and other fraud hotbeds, I start the conversation by indicating I think I may have received an attempted fraudulent transaction.

When I receive confirmation from the issuing bank that the transaction is fraudulent, I send an Email something like this to the 'customer' (a loosely used term...):

Quote

Thank you for your order.

This transaction appears to be fraudulent. As a result, your order
has been cancelled, and the information reported to the credit card
company.  

If they're legitimate, I'll bet they'll be contacting you. In my case, I've never received a reply to this type of Email, and no more orders have come through from the same person.

HTH,

Terry

Edited by TerryK, 26 June 2004, 16:16.

[smash123]

Terry, thank you for your reply. I don't know if you heard about VISA VBV. I'm using VBV and with this system VISA card buyer needs to enter a password in order to use his card online if the card issuser bank joined this function. If his card issuer not joined then my web won't pop up the password windows. According from the sale of my merchant account, he said if the bank has not joined the VBV then case like stolen card, not auth. of using card libility swift to the card issuer. So, from what I understand I don't have to take the libility in this case. Because VISA said only card holder is able to use VISA buying stuff online. In fact, I see most of my transactions and not go throguh VBV, that means most bank ha snot joined this yet. I already shipped out over $3000 to his guy, I don't know what this sale person told me is true. I will know about this soon.

Welcome any suggestion or your though

[japreja]

I would not notify the card user, instead contact the FBI's tips line at https://tips.fbi.gov Just fill out the form and submit it, you will be contacted in a few days or hours. Be shure to give them all the credit card information and IP addresses from your log files, infact make a backup and copy the information to a safe location, the FBI will want it!
By doing this you will legaly be able to be reimbursed for any and possably all fraudulant purchases made by the user.

[fgwhite]

I use the following text whenever I suspect a bad order or the AVS doesn't match:

We are declining to fill your order because the billing address does not match the billing address held by your financial institution. These measures are intended to protect you, the cardholder.

You may contact your financial institution to investigate why your billing address does not match your current address.

Finally, you may select to pay by check or money order, or via Paypal should you choose to re-order your merchandise. If you select an alternative payment method you *MUSt* re-order your merchandise.

Thank you

[fgwhite]

Hell... I can't read that.. so again:

We are declining to fill your order because the billing address does not match the billing address held by your financial institution. These measures are intended to protect you, the cardholder.

You may contact your financial institution to investigate why your billing address does not match your current address.

Finally, you may select to pay by check or money order, or via Paypal to re-order your merchandise. If you select any of the alternative payment methods you must re-order your merchandise.

Thank you

[fgwhite]

I can tell you the FBI doesn't handle credit card fraud. You'll need to contact the secret service in your state.

I had the same issue. The FBI referred me to the Secret Service. The Secret Service agent was to arrange to have another agent at the delivery destination for a controlled package. In my case the controlled shipment never took place because the destination agency did not think it was worth the effort (so I surmised).

You may be able to get the agency to go through with the controlled shipment and catch the crook(s) when they pick-up the package at the ship to destination.

For online merchants we're in a catch 22 situation: To be sucessful, it's important to ship quickly - especially overnight orders. But shipping quickly present the greatest risk.

I now do the following for all high dollar items:
Require AVS match
Call for verification
Never ship Electronics overnight

It's been suggested that I PDF a form and get a signature faxed back - but I think that might cause the loss of legitimate sales.