AVS and CVV Checkout But IP is from Ukarine

Is this a possible Fraud?

[karim0028]

Hey Guys,

I got a customer order today that has a US address in Arkansas and the AVS matches, the CVV2 matches but the IP is from the Ukraine... Would this be a possible fraud?

I cant think of any reason why the IP would be from the ukraine other than that it is fraud.... Can someone shed some light on this for me or at least give me your valued opinions... Should i process the order?

Thanks!

[akmac]

Customer could be using a proxy server. Does the shipping address match the billing address? Did they request express shipment? Did they leave a phone number? If so, where does it trace to?

[dartman]

Ship to the AVS verified address (if Y or X, not Z). AVS Z is not a verified address and you will lose in a chargeback.

Customer may have placed the order from the Ukraine (possible). If an Arkansas phone# was provided you could simply call to confirm.

[Bjorn Iceland]

Good advice there from dartman.

A common scam also is if you give them the tracking number for FedEx, etc. before delivery, a scammer will sometimes find a way to change the delivery address before it gets to the original delivery address - thus intercepting the goods.

Sadly for the legitimate people of Ukraine, the majority of orders placed from IPs there are fraudulent, i.e. far more than 50%.

[edited by: Bjorn_Iceland at 5:14 am (utc) on Oct. 4, 2007]

[jecasc]

There may be a legitimate reason for the Ukrainian IP. Perhaps the buyer is there on business or on holidays.

I once was on a buinsess trip to China and then checked my Paypal account - next thing I knew it was restricted...

Is the shipping address the same as the billing address? Perhaps you can use a shipping option with confirmation of identity if available with your courier?

[justgowithit]

As well as calling the customer you can also call the card issuer to voice your concerns. In a case like this the issuer may inform you of similar activity on the account - I.E. there are other charges from the same region... they're traveling.

[karim0028]

Thanks for the input guys!

So, i did a little more research, i called the phone number in the order and it was a South Carolina number (nothing major, since you can now move your number to any location in state or out. I asked for the person who put in the order and was told by his girlfriend that he was deployed in Iraq... I called the bank and the card wasn't stolen, i figure that the boyfriend ordered something for his girlfriend while he was in Iraq and the military must use some sort of proxy.....

Sound reasonable?

[akmac]

Sounds reasonable to me.

I've gotten orders from US troops all over the world.

[Bjorn Iceland]

karim0028 wrote:

I asked for the person who put in the order and was told by his girlfriend that he was deployed in Iraq... I called the bank and the card wasn't stolen, i figure that the boyfriend ordered something for his girlfriend while he was in Iraq and the military must use some sort of proxy.....

Sound reasonable?

No. It sounds very likely that his card has been stolen.

US troops' cards are a good target for identity theft.

Our merchants take orders from US troops also, and their foreign IPs always indicate that it is a military network (.mil), related ISP, or Satellite Internet in that region.

For example:
UNITED STATES, VIRGINIA, MANASSAS, DOD NETWORK INFORMATION CENTER

OR

TALIA BEFORD COLO, APO, ARMED FORCES EUROPE, MIDDLE EAST, & CANADA, UNITED STATES

etc.

[Bjorn Iceland]

P.S. Another thread on this subject: [webmasterworld.com...]

[jsinger]

I asked for the person who put in the order and was told by his girlfriend that he was deployed in Iraq.

Possible the "girlfriend" never even met her "boyfriend."

Lots of lonely women being suckered by men they met online. He writes that he's a U.S. officer in Iraq; he's really a kid in Lagos.

[karim0028]

Actually Bjorn Iceland, i have taken orders from Iraq before and the weird thing is that the IP seems to be from different places, is there a better way to check the IP? Ive taken one order before where the individual was in Iraq but the IP said texas and another one said Lebanon.... I just use ip location lookup is there something better?

Also, one thing i forgot to mention is that i just mentioned the Boyfriends first name and she sounded pretty familiar with him, so i dont know, i already shipped it, but i guess we will see if it gets charged back... Hope not! If it does, i guess you just learn, adapt and move on.....

[Tsuren]

karim0028, Ukraine, Nigeria, Laos etc = fraud. Military guys use their VPN so their IPs are not from Ukraine or from Iraq even if the army guy is there.

[edited by: Tsuren at 6:36 am (utc) on Oct. 12, 2007]

[jsinger]

On Chris Hansen's Dateline TV show (the Sex Predator guy) on Nigerian Scams, he tracked merchandise to a woman's home in the U.S. She told Hansen said was ordering the stuff (tons of it) for her fiancee who had a store in Nigeria.

Poor woman had never met the Nigerian in person. They planned on marriage after meeting online.

[Volusion]

Just because an order has a cvv2 code, it doesn't mean it is legitimate. This data can and has been stolen online and in stores. If the IP is in Ukraine, call the customer to confirm the order. If they were indeed in the world hotbed of activity that is the Ukraine, they will have no issues confirming the order.

[Bjorn Iceland]

karim0028,

Would you care to update us with what happened with the order in the end?

Did you have to refund it because of fraud or did it become a chargeback?

[Rugles]

Ya, fraud order from the Ukraine, ship to address in Arkansas to either an unsuspecting or complicit person, consolidate all fraud orders, forward the shipment overseas. This kind of thing happens everyday.

The "deployed in Iraq" might be a ploy to gain your sympathy by the way.

I would delay the order a few days. See if they get panicky and ask for air shipping.

[karim0028]

I went ahead and processed the order; and havent seen a charge back yet... But, that doesn't mean that it might not happen... Im still waiting to see; its more of a live and learn experience for me till i see what happens.

Karim

[trinorthlighting]

You might not see a chargeback for up to 30-60 days later.... People do not always monitor credit card charges daily. They might not notice the charge until their statement arrives in the mail, then they call their cc company, get a form to fill out and mail back. That typically takes 14 additional days. Then by the time it makes it all the way back, it is typically at the 60 day mark.

[karim0028]

Would i still get a chargeback from October 07?

[Bjorn Iceland]

karim0028 wrote:

Would i still get a chargeback from October 07?

Yes, the period of risk for Visa and MasterCard is 180 days.

For AMEX it is longer - up to 18 months.

In general, most chargebacks come in during the first 80 days. But the above is the period of risk.

If someone were to be posted abroad and return from their tour of duty, for example, you may well see a chargeback coming in at the end of the time.

So, if a Visa or MasterCard charge you have until April for that order (depending on the specific date).

[trinorthlighting]

Yep, those are the dates for chargebacks.