Watch out for this AVS flaw

Article on increasing fraud orders that match AVS

[RedWolf]

I saw this today and thought some of you might need to watch out for it.

[msnbc.msn.com...]

I do all my processing manually so I would catch it luckily.

[antirack]

"Merchants don't manually review very many orders. Most merchants manually review about 10 percent," she said.

Somehow I would like to comment, but I am not really sure what to say. Does this sound realistic?

I know that for most privately owned companies this is true. Might be not true when they are newly opened, but after the first bad experience that behavior should change drastically. Which companies could afford to only check 10% of their orders? Public listed companies? I am not sure if that can be taken serious, but I might be completely wrong.

[netguy]

>>only check 10% of their orders?

I agree antirack. Depending on the industry, checking only 10% of the orders could put a company (of any size) out of business in a hurry, particularly in light of this latest 'hack.'

While we check virtually ALL our online orders, there are also big differences (in fraud) by the types of items sold. Our sales of reference and literature items, for example, has virtually no fraud, while more precious items that can be easily sold on a street corner can run 40% or more fraudulent.

Fortunately, most fraudsters are greedy. We can spot them a mile away when they order 10 of something - and always want it shipped overnight.

Steve

[diamondgrl]

I agree antirack. Depending on the industry, checking only 10% of the orders could put a company (of any size) out of business in a hurry, particularly in light of this latest 'hack.'

We do manual review of 100% of orders but if we went down to 10%, it wouldn't much change the situation. We have a fraud rate of less than .1%. But we mostly have professional customers so I can easily see how other companies have much larger problems.

[Raymond]

I am one of those lazy merchants who only checks about 10 to 20% of all my orders. There is no particular reason why I don't check them, probably because our fraud rate is quite low. I also wrote a script to block off most of the IP from nigeria, I guess that helps a little.
When I do check the orders, I usually check the IP to see which country it belongs and then match the billing and shipping address with it.
What do you usually check to verify an order?

[RedWolf]

Probably the more orders a company recieves the fewer they manually check. I would be surprised if the biggies even check 10% of them. If are recieving 1000's of orders a day, it would be very labor intensive to do it.

[antirack]

If are recieving 1000's of orders a day, it would be very labor intensive to do it.

But if you have 1000 orders a day, you should be able to hire a nice person who keeps an eye on the orders. The more orders you have, the more money you can loose.

When we signed up for our merchant account, we have been warned that a high chargeback rate would mean that they cancel the contract.