Credit Card Fraud

[JEccles]

OK - I'm really frustrated today. I had an order come in that is obviously fraudulent (multiple cards/numbers used until accepted, Nigerian IP). The phone number given is fraudulent and I cannot get a phone number on the address listed. Trying to get to anyone who cares about the card is nearly impossible. I'm stuck until PayPal (we use their PayPal Pro) contacts me (that's a laugh) and can tell me who the issuing bank was since I only have the first and last four digits of the card. I also find it hard to believe that they authorized the card since the CVV code given as 6 digits long (both alpha and numeric). That is another issue I have to discuss with them. I wish there were ONE central place that you could go to.

[JPnyc]

I know this may be interpreted as racist by some, but it's worthwhile to block Nigerian IP addresses. The frequency with which you're going to get a legitimate customer versus the amount of time you're going to get scammers, it just isn't worth it. I'd wager it's the leading scam nation on the planet.

[JEccles]

Yes, I did block it on all of my sites. In the mean time I also keep getting these very badly worded "business" letters wanting to know if we carry X product. You can tell that the product name has been added after the fact since it is in a different font. <sigh>

[BasicECommerce]

Wow, JEccles. I can almost see the vein popping out of your forehead just from reading the posts. Friday will be here soon enough.

-BEC

[JEccles]

Wow, JEccles. I can almost see the vein popping out of your forehead just from reading the posts. Friday will be here soon enough.

-BEC

Nothing that a stiff drink won't cure.

[JPnyc]

Just one? I must be strung tighter LOL

[JEccles]

Did I say how big the drink was?

[JPnyc]

LOL good point, you didn't. I like to make them really large and heavy, so I can consider it my workout.

[JEccles]

Ya know.........Kool Aid is not half bad if you add a little vodka to it <hic>

[JPnyc]

"Kool-Aid's here, bringing you fun. Kool-Aid's got thirst on the run."

[marc77]

Trying to get to anyone who cares about the card is nearly impossible.

This remembers me to situations we experienced in the very beginning of our online business history. At this time, we received many fraudulent orders (well, we also made a lot of mistakes that helped such people to fool us, but this is a different topic).

Our payment processor has a special abuse report hotline we called each time such an attempt was made (from a Chinese "Mr. John Smith" to an order placed by "Darth Vader").

Well, I printed each of these orders, did some investigations of my own regarding the used e-mail address (we are shipping digital goods) and the origin IP address. Then I called this hotline, waited typically a quarter of an hour to get connected - and in most cases I just was asked for the card number - no IP, no amount we attempted to charge, no need for sending a copy of the order receipt as proof.

And interestingly in one case, the same credit card number was used a few days (!) later again, although there was enough time to investigate the issue saving the card owner (or a merchant that not recognizes the fraud event and processes such an order) a huge amount of money.

It appeared to me that the "fraud hotline" itself was a fraud... well, the payment processor also makes a small fortune on frauds, at least this is the situation in Germany - for each chargeback we not just have to pay back the charged amount in full, but also have to pay a service fee (punishment fee would be more correct) of around 25 to 50 Euro (depending upon the card type). And this for a period of usually six weeks (AmEx tried to expand this period for an unlimited time, but luckily was stopped in a lawsuit initiated against them).

Finally I stopped reporting frauds and we worked out internal methods to detect and prevent loss from abusers.

Summarized: Even a fraud order is a good order if you detect it before shipping ;-)