Forum Moderators: buckworks
If you receive an order and it makes you feel funny, do more testing. A lot of them want the product now, now, now! They order a lot in hopes that people will get greedy.
Email the customer. Did it come back with somewhat the same IP address? For example, we had a hosting client sign up. The IP address was issued to an ISP in the UK. When he replied back, that IP address was issued to a company in Canada (within about 10 minutes). Now I am the world's worst on geography, but I do know that you cannot make it from the UK to Canada in 10 minutes.
Maybe ask them to fax the credit card number to you along with an ID? Also, does the biling address match? Are you shipping the products to the same address? Does the IP address match the address? Does the phone number match the address?
-Corey
If I still feel suspicious, I ask them for the bank phone number off the back of the card. If they give it to me, I usually process the order. Sometimes I actually call the bank or I will go online and look to see if the phone number matches that of the bank. Depends on how big the order is. I have one for $300 right now that I will be calling on, although I am pretty sure it is okay.
For US cards, I use authorizenet's fraud suite, which is overpriced but cuts out those idiots who sit there and input random numbers. I have my settings so that much goes through that others might reject, like no match on Avs. If no match, I look at the order. Certain items attract thieves. I have gradually been getting rid of those items. If a no-match is for a thief-attractant or comes from an email address that uses so-called haxor lettering or reads like something made up by a teenaged boy who considers himself a badass, I usually send them a boilerplate email about how the billing address they have given does not match the billing address the bank has on file for this card and they should contract their bank, sorry for the inconvenience but I must void this transaction, etc., etc. I get a lot from a person's screen-name.
If the avs is no match, it looks like a real person and is not for suspicious items but I still feel suspicious, I will check the info they have given in the White Pages. Bad thing about that is it takes a lot of time and they don't have cell numbers plus half the time it just doesn't work right. If I get no matches there or contradictory information, I have to decide if I want to put the charge through anyhow, just void it with a boilerplate email, or ask them for the 800-number off the back of the card. I do that sometimes, but actually I put most no-matches through and have had no chargebacks (no evil eye) for two years now. People often get suspicious when I ask for the 800-number, and so I will explain to them exactly why I need to do it. I don't feel there is any alternative.
I have gotten to the point where I don't mention overnighting anywhere on my site and I discourage it if people ask for it. I usually only do it if it is a business.
Lately I have been getting more and more emails that are more sophisticated than the usual "I want your products do you overnite to Lagos?" I have mentioned some of them here.
The most recent was a fellow wanting to know if I could send him a large order to the Bahamas if he wired me the money through Western Union. I told him I had to call Western Union and check because I did not have a business account with them and that I would call him back. I didn't call him back and have not heard from him again. So from now on, all people who want to use Western Union will set off an alarm for me. In fact, I have had only two people use it in four years, both in Italy.
Also of course I do not accept foreign money orders or foreign check even if they are in US dollars. This is actually because my bank charges me a $12 fee to cash them, which I have on the site, but it also cuts down substantially on fraud. For foreign orders that want to use a money order, I take only Western Union money orders. I have not heard about any fraud with their mos.
I don't accept any wire transfers to my bank.
I do have foreign customers who send cash in US dollars (I even used to take any kind of cash before my bank got all cranky about it). If someone is from another country so I can't use AVS and they sound iffy, I tell them that they can pay in cash by registered mail.
However I think by adding a message on your site that “We screen diligently for credit card fraud" may be enough to cut fraud attempts atleast fifty percent.
I usually send them a boilerplate email about how the billing address they have given does not match the billing address the bank has on file for this card and they should contract their bank, sorry for the inconvenience but I must void this transaction, etc., etc.
If I decide something is fraud, I will just ignore it. (providing that an actual card isn't charged.)
This way, it eats up more of the thief's time and brain power - checking on the order, waiting on the order, wondering about the order, writing about the order. If someone writes, I respond to it. Fraudsters typically don't write to find out why their fraud order didn't go through.
We set up a bank account only to receive wire transfers. There's no checks, overdraft, or any of that on there. We immediately transfer out any money we receive into the account leaving no more than $25 to keep it active.
This is a good idea but few chances is there probably you miss few “genuine orders” if particular customer is really an ignorant one.
Agreed.
It's a better idea if you're selling cheap widgets and can only spend a little time on each one. A fraud order and an ignorant customer can both be costly timewise. (especially if you're selling something like hosting, or other digital service.)
I don't accept any wire transfers to my bank.
Regarding Nigeria, Indonesia, Singapore, et al:
One step we took was to simply eliminate these from the country scroll-list for creating a new account. Nigeria's just not an available option. I have zero regrets for any honest Nigerian or Ghanaian business I might be leaving behind on the table by doing so...
We also advise during checkout, when credit card info is entered, that addresses are verified and that a mismatch of credit card billing address vs. ship-to address may cause rejection. So far so good. Only one chargeback in 2 years, despite high $ volume. And that chargeback was a domestic USA fraud involving members of the same family, using auntie's card without authorization.
However we should work together and share information to combat online fraud.
If I were dealing with large amounts generally and with established companies, then it would be a different matter. Even then, though, I would have to ensure to my own satisfaction that the account the money was being sent from and/or the company itself had been in existence for some time. Too many ripoffs have found wire transfers to be an easy way to scam people.
Originally I asked my bank about wire transfers because I was concerned about my recourse if I paid for something by wire and they didn't give it to me. The bank said they could ask the receiving bank for the money back, but the receiving bank was not obliged to repay it. So far this fits with what the thread mentioned above says.
BUT, according to my bank, if someone paid me with a fraudulent instrument, it was a different story (because of what I think of as "the devil take the hindmost" principle). The recipient bank would have to refund the money to the sending bank, because banks always take care of each first and their customers second. How else could they do business? They are in a network, and they can't do anything that would mean they were shunned by that network, unless they are planning to go out of business (or they are crooked offshore banks that are on the fringes of the network anyhow). The recipient bank would want to get their money back, and the only way that would happen is to get it from the person who had received actual cash - you (the hindmost in this case). Even if you took the money out of your account and spent it immediately, you would still have to give it back to your own bank. Why should you get the benefit of a fraud, even if you sent merchandise out on account of it? Do you get the money back if you accept counterfeit money for a transaction? Do you get the money back if you accept a bad check? Do you get the money back if you accept a phoney money order? The bank is never going to be out the money, period. Their words to me were: "The bank always pays itself first." Second it pays other banks. We customers are dead last.
I am in the US. My bank is a national bank. This is what they told me. It could be that other US banks have a different practice, but I doubt it. Anyway, I hope some people who have had the misfortune to receive a fraudulent wire will post about it here. I would like to get some verification either way.
