Forum Moderators: buckworks
I recently added the option to pay through my own merchant gateway (in addition to Google Checkout).
My question is:
Google Checkout would usually take an hour or two to run security checks on every order that I received, but with my new merchant gateway, it checks the AVS and CVV2 in about 10 seconds and then charges the order.
What security checks does Google do that takes an hour? I'm asking because I didn't have one fraudulent transaction with Google, and I don't want any with my new processor.
Now nothing is 100% but ya better check those merchant charges with a call to verify the address or phone number or you're gonna be eating some of the orders.
Google doen't give you access to the card number so all the pressure is on them to be correct all you can go by is Google and any charge back falls back on Google.
it checks the AVS
Use this with caution, or better yet, use it only as a silent warning to you, the company, about the order. About 20-30% of our orders fail the AVS - people move and don't update the change on their CC, causing an address or zip failure. We get a lot of Canadian orders, they always fail. My own daughter orders from us and hers fails. :-)
First thing we look at on an AVS failure is the billing and shipping address, if they're the same it's a no-brainer. Different raises a flag, but seldom a fatal one, our site is used frequently to send gifts.
Zero fraud in three years, 6 bona fide attempts, we're just lucky I think.
So this is what I'm gonna do I think:
Customer enters all their info, clicks submit. It posts authorization request to the CC gateway, I get the response code and put it in a database.
I make a back-end page that reads all the orders out of the database. I'll call the people after their purchase, and use my judgment. If it seems legit I click the charge button :o
Think that seems good enough?
Just looks like double the work and upkeep of information, and if this is the case are you going to put this stored personal information on your privacy policy?
I'll call the people after their purchase, and use my judgment.
IMO this is a bad idea. When we first started one of our first orders had a "discrepancy" - not in the CC info, but in the order - and we called to verify. Identified the company in the first sentence "This is company, calling about the order you placed yesterday - "
BANG. They hung up. We left a message explaining our question, they never returned the call. Our guess was they suspected it was an upsell sales call.
People often order from the Internet because they don't want to be bothered by talking to you (You'd think they would, it's their money on the line.)
Since then we are very cautious when calling customers, and almost every time they reflect their suspicion and dread until we can manage to convince them it's for their benefit and NOT an upsell.
@rocknbil: Maybe I'll only call if it looks overly suspicious. I'm selling widgets with a pretty high value and not an overly high profit margin, so I'm really trying not to get any bad transactions.
Did the order with the "discrepancy" end up being good? Maybe it was really someone who was trying to scam you.
Maybe I'll only call if it looks overly suspicious. I'm selling widgets with a pretty high value and not an overly high profit margin, so I'm really trying not to get any bad transactions.I say this is a really good plan of attack but rob7591 what makes an order "suspicious". just wondering what you will be looking for to as to what trips your filter so to speak.
Also people usually call before making large orders, so if they don't call and they order a large number of products of high value it is suspicious.
The reason why it takes google so long is because they are in a large volume environment. Obviously the larger the volume the higher the count of orders outsorted by a fraud screening solution. Your gateway and AVS checks are a lot less effective and very archaeic compared to what google is doing during the fraud screening process.
There have been a lot of threads regarding fraud review and best practices so I am not going to write a diary here but use your gut feeling. Fraud review is all about making sense of the order. Putting the pieces together. Diff bill to ship to, maybe it's a gift? Does whitepages reverse lookup show the actual names on the order? Is it shipping to a business? Did the customer use a paid email? If yes does the email domain correlate with the ip host? All about balancing the red flags with the green flags, weigh them out and whichever weighs the most than react to it. Call and verify the purchase. Explain you are doing it for their protection, they like to hear that.
Call and verify the purchase. Explain you are doing it for their protection, they like to hear that.
Thanks for all the info guys. I've called people before even with Google just to make sure, and all of them seemed happier to hear from me than not. I think I'll call most of the new customers and let returning customers do their thing depending on the size of the order.
Did the order with the "discrepancy" end up being good?
It might have been, but we couldn't resolve the issue we had with the order (can't recall specifics) so we just refunded since we couldn't get ahold of them. It had nothing to do with the CC, billing address, or shipping address - it was something with what they ordered. Seems like that was "forever" ago!
