homepage Welcome to WebmasterWorld Guest from
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member
Home / Forums Index / WebmasterWorld / Ecommerce
Forum Library, Charter, Moderators: buckworks

Ecommerce Forum

This 35 message thread spans 2 pages: 35 ( [1] 2 > >     
Fradulant transactions
Nigerian scam

 2:59 pm on Mar 16, 2005 (gmt 0)



I would like to know what the maximum amount of time that can go by before I bank contacts you to request a chargeback from the transaction date?


A few weeks ago we had our first fraudulent transactions through our website, at first we didn't know and were generally excited about a large order. Basically what happened was that an order for several thousands pounds was put through and a dispatch address that was not valid was given (we only ship to uk), the phone number was also invalid, when our courier couldn't ship goods we had them returned. Next contact customer by email and we get the story that they are now back in Nigeria and could we ship there instead. So we have the money (from a stolen card obviously). We contact our bank and they suggested a refund which contradicted advice from our payment processor. As this is only one customer from thousands we have held onto the money and are currently waiting a chargeback letter which may or may not come. We reported this to the police here and have a crime number (not that they will do anything about it)

A few days later we had 2 new transactions go through (we even found the original fraudster had emailed another Nigerian at an IT firm and that he contacted us from a Yahoo mailbox). Again we have the money and didn't even bother to try and ship to bogus UK address.

Since this we have implemented several new strategies that will stop any further transactions from either going as we use our own bespoke shopping cart and can make the required mods, for example any transaction over a certain value will go in and be pending until we manually authorise whilst we check email address and possibly phone customer.

The mods will avoid chargebacks in the future and negate this whole process, however I presume there must be a time that after which a bank will not be able to reclaim the funds. Is this correct?



 3:11 pm on Mar 16, 2005 (gmt 0)

credit card refunds are 6 months i think in the uk.


 3:16 pm on Mar 16, 2005 (gmt 0)

But chargebacks in the case of fraud can be a lot longer (in the UK it is illegal to profit from fraud/crime - I believe the US is the same). So you will not be able to hold onto the money - the chargeback will come if you don't refund. It's more a case of 'when' than 'if'.


 3:31 pm on Mar 16, 2005 (gmt 0)

Amex chargebacks can occur months from the time of purchase


 3:32 pm on Mar 16, 2005 (gmt 0)

of course it is fair to point out that nobody has told us that it is fraud, it is only our own internal observations that have pointed to it. Hence at this present time nothing is illegal. I am sure that we will get the chargeback request, but if we haven't in a years time?


 3:46 pm on Mar 16, 2005 (gmt 0)

My merchant credit card account is Cardnet, they operate a three month chargeback period...however, the chargeback happens before the letter.

If a credit card customer queries a transaction, doesn't recognise the merchant on his statement and queries it. Cardnet do a chargeback until the item is verified ...and then take forever to re-credit.

Anyway, LloydsTSB Cardnet 12 weeks


 3:51 pm on Mar 16, 2005 (gmt 0)

so in your case with Lloyds any money given to you is 100% yours after 12 weeks?


 3:56 pm on Mar 16, 2005 (gmt 0)

I'm not sure I understand why you haven't reversed the charge and issued a refund.

The money in your account from these transactions doesn't belong to you.


 4:01 pm on Mar 16, 2005 (gmt 0)

> nobody has told us that it is fraud

But from your original statement:

> So we have the money (from a stolen card obviously)

That is fraud (the person using the card).

As is any order from a Nigerian using a Yahoo email address, false address and false telephone number.

You'll learn from experience!


 4:04 pm on Mar 16, 2005 (gmt 0)

From a technical point of view we do not know 100% if it is fraud. We have been advised by our payment processor not to do a refund because there could be problems through thier site.

Also if the card is stolen and yet to be reported then if we could refund the card they might be able to carry on using it somewhere else.

Also this has never happend before so would like to know what will happen during the chargeback process for future reference.


 4:04 pm on Mar 16, 2005 (gmt 0)

I've just looked back at my first ever chargeback (for a stolen card). The transaction was in August, the chargeback in the following February.


 4:07 pm on Mar 16, 2005 (gmt 0)

Why did your payment processor tell you not to refund? [I would also go ahead and refund in this situation, but I am not an expert in the area]


 4:09 pm on Mar 16, 2005 (gmt 0)

August to feb is quite a long time. I have put these down to experience and will be prepared to get a request for anyting up to a year.

From an admin point of view we have set up a seperate account to put the whole amount into so that when the request comes through we are not bitten on the arse so to speak.


 4:15 pm on Mar 16, 2005 (gmt 0)

Have you called up the issuing bank for the credit card and discussed the situation with them?


 4:16 pm on Mar 16, 2005 (gmt 0)

The payment processor origianally said that we couldn't refund a card if it had been stopped and that we should wait for the chargeback - however I have since been told by my merchant bank that this is false info in that you can always credit a stopped card you just cannot debit it. (Of course it could just be their system not working correctly).

Should anything slip through our new updated cart as possible fraud in the future then I am sure we will automatically try and refund. However in this case I would like someone in authority to say, sorry this is not correct here is a chargeback - rather than for us to take educated guesses.


 4:18 pm on Mar 16, 2005 (gmt 0)

You didn't deliver the goods, the money doesn't belong to you.

You have the card number. Call the credit card issuer and tell them you suspect someone is trying to purchase something from you using a stolen card. They will call the card holder and determine if it is in fact a valid purchase.

Why not do the right thing?



 4:23 pm on Mar 16, 2005 (gmt 0)

> Have you called up the issuing bank for the credit card and discussed the situation with them?

Have called our merchant bank - tried to do a code 10 on the origianal transaction but instead they didn't understand that it was a website transaction and they kept saying we should keep the card

Have called our payment processor

Have called the police

Have called the fraud department based in london and left message and also emailed info through

We have not called the issuing bank, are we obliged to do so? I presume our payment processor will have info on the issuing bank which I beleive will be in another country/time zone.

I have to say that not once have we ever been called all current activities have been initiated by us.


 4:31 pm on Mar 16, 2005 (gmt 0)

If someone stole your card number and started buying things left and right wouldn't you appreciate one of the sellers making the call to the card issuer?

Yes you've done a few things to show some due dilligence but you haven't done the one thing that will lay the matter to rest.



 4:43 pm on Mar 16, 2005 (gmt 0)


So I need to call my payment processor, he will give me details of the issuing bank. I then find out they are in another country. I have to make an international call, try and get through to someone that speaks english, and ask them about the transaction. All of this is going to take time and hence more money from me to deal with. I have already spent a good number of hours dealing with this (as this is our first). For your information I beleive the cards are already stopped from my code 10 calls.

Or I could just sit back do nothing and wait for the automated processes to catch up and deal with it and get on with dealing with the 100's of legitimate transactions going through our system.

I don't believe I am doing anyting wrong. From my point of view nobody in authority i.e. bank as contacted me to tell me what to do and when I have contacted anyone they don't want to know.

As a side issue is there anywhere in the UK or the world for that matter actually doing any work to curb fraud from Nigeria and other known sources?


 5:53 pm on Mar 16, 2005 (gmt 0)


You are free to do as you wish of course. Having dealt with attempted fraudulent CC orders for years I have learned to smell them coming and deal with them in the most expedient manner. The most expedient manner I've found is to contact the card issuer and have them confirm with the card holder. Every issuer I've had to call has had an international toll-free number available when required.

With regards to dealing with orders from fraudulent countries, we have terms in place that specify prepayment by money-order is required and no shipment will be made until it has cleared the bank if your goods are being shipped to (insert troublemakers here). We also have terms in place requiring that orders can only be shipped to the actual CC billing address for the card holder (although we don't enforce it unless we smell a rat).

We may piss off and loose a few (very few) legitimate customers but in most cases they already know they are located in a fraud cesspool and are willing to jump through the hoops we have layed out for our own protection.



 6:02 pm on Mar 16, 2005 (gmt 0)

Had a lot of Fraud on our site which basically lead me to utilise geo-ip a listing of IP and the country of origin.. We basically refused checkout pages to any that can under nigera, indonesia and a rook of others..

Rann it for a few weeks and it seems to have scared of a few wouldbe fraudsters, but found a nice bug that reports some UK surfers orignating from Czhec Republic, so removed it...

But the basics are there...

Stick to UK, customer or cheques from international..


 6:56 pm on Mar 16, 2005 (gmt 0)

"I don't believe I am doing anything wrong." It is wrong for you to keep money when you are not going to deliver the goods. So follow the advice that has been given here.


 8:20 pm on Mar 16, 2005 (gmt 0)

Depending on your payment processor, sometimes it is better to let the normal charge back process to work, rather than doing a reversal yourself.

Several times, I have credited for fraudulent transactions, only to find the payment processor doing a chargeback anyways a few weeks latter.

A few faxes and weeks latter, I get my money back.

If a purchase is flagged for fraud, we don't ship and wait for positive confirmation of the fraud or valididation of sale. We then let the bank do the chargeback if it actually was fraud.


 9:08 pm on Mar 16, 2005 (gmt 0)

Contact the issuing bank, and then wait for the chargeback. It should take about a month but in some cases 6-8 months.

I believe you have no intention of keeping the money-obviously.

There is nothing more you can do unless you can obtain the actual cardholder's information and contact them yourself.

In my experience, the most efficient way to proceed is to wait for the chargeback, it will come.

If you're still holding it in ten years, give it to charity, plus interest.


 8:51 am on Mar 17, 2005 (gmt 0)

>> lgn1 & akmac

Thats what I am going to do in this case.


 10:36 am on Mar 17, 2005 (gmt 0)

I just want to pick up on something that has been raised here, I am also in the UK and have had simmilar problems when contacting my mechant account provider and also card issuers. I've got absolutely nowhere try to get them to confirm card holder addresses or anything like that, my mechant account provider, like the The_Tank's, didn't understand what I was trying to do, when contacting the card issuer I just got the standard "I'm sorry sir but we cannot give out our customers details", I tried to explain to them that I was trying to protect their customers from a potential fraud but they simply were not interested, am I ringing the wrong department or speaking to the wrong people?

It sounds to me that in the US it is a well established procedure for Merchants to contact card issuers to confirm transactions but here in the UK this process just doesn't (from my experience) seem to exist. Can anyone who is a UK merchant confirm that they are regularly able to contact UK card issuers and get help with confirming transactions? If so do they have a special number that you ring other than the general customers services number? Are we allowed to share these UK card issuers phone numbers here in the forums or is that against the TOS?



 11:14 am on Mar 17, 2005 (gmt 0)

in the uk, amex will confirm an address over the telephone for free. (if you have an amex merchant account)

barclays merchant services (a card processor) will confirm the address of a visa/mastercard holder for a fee ( fee varies depending on how many you want to confirm ) - you can also have permanent address verification set up with which there is also a fee.

i'm pretty sure that the card issuers will not deal with you directly for all kinds of reasons including privacy, so you have to go through your card processor.


 11:45 am on Mar 17, 2005 (gmt 0)

For info I have had a telephone call with someone and the credit card fraud department in London who actually understand the technical stuff. They have also read my email that I sent through and are considering taking me up on my offer to allow them to use our systems to talk directly to the fraudsters by email - so we might actually get some progress on this one or at least allow them to extract more meaninful info.


 3:49 pm on Mar 17, 2005 (gmt 0)

From a technical point of view we do not know 100% if it is fraud. We have been advised by our payment processor not to do a refund because there could be problems through thier site.

We've processed tens of thousands of transactions, and I have yet to hear my payment processor say "please od not process a refund". Here's a clue - fals phone #, false address, AND wants to ship to Nigeria (the CC fraud capital of the world). It's bogus. Refund the money.

From an admin point of view we have set up a seperate account to put the whole amount into so that when the request comes through we are not bitten on the arse so to speak.

What justification do you possibly have to hold onto money for goods that have never shipped? Further, why would you want a CHARGEBACK (which carries a penalty) when you can simply reverse the charges?

Has anyone actually had a legit order going to Nigeria?


 4:04 pm on Mar 17, 2005 (gmt 0)

I'm going to start a new thread on the point I raised earlier so as not to hijack this equally important thread.


This 35 message thread spans 2 pages: 35 ( [1] 2 > >
Global Options:
 top home search open messages active posts  

Home / Forums Index / WebmasterWorld / Ecommerce
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved