WorldPay AVS Warning

Why does it allow payments to go through?

[TimmyMagic]

I was wondering why WorldPay allows transactions to go through when the person fails to enter the correct security code from their card.

I just had one such transaction and they also gave a false email address. I now doubt that they are genuine. If I give the refund then I lose the transaction fee (i assume) and also how do you try and find out if the customer just made a silly mistake by pushing the wrong key? If I ask the customer for the right number, I have no way of knowing whether it is correct. Does anyone have advice in this situation? Is there a way of verifying a correct security number or do I just have to give up and refund the customer?

Thanks,

Tim

[ukgimp]

Dont WP have an option for delayed processing to allow you to check the details rather than doing it upon form submittal. Costs slightly more per transaction but better than chargebacks etc.

[derekwong28]

The only details that worldpay, or other credit card processor require are the card no. and the expiry date. The customer's name does not even have to match.

We have had perfectly genuine orders with incorrect security code.

If AVS results are available and that it matches, then I think your order is safe.

If AVS results are not available, then I suggest that you request a code10 check. This is basically a manual AVS check. You should quote the the transaction no. and send the request to [e-mail]

It may take a few days, but if it matches, I think the order is quite safe.

[PCInk]

It also can be not matched if the customer decides not to enter the security code at all.

Pre-auth is deferred payment. Ask about this.

[TimmyMagic]

Thanks for the response. Could you explain a little more about the Code10 thing? How exactly does it work? Do you have a link where I could find out more. Sounds interesting.

I have only had 1 chargeback in the past year. Okay I don't have a high turnover but this is still pretty low. I don't really fancy doing the pre-auth if it means higher charges as there quite high anyway.

Thanks,

Tim

[PCInk]

Pre-auth is free, but involves more work: you have to log into your account and manually authorise the payments (a list can be done from one page).

It can save you a lot more money in the long run: you won't get charged the £10 admin charge if you don't complete the payment, nor will you pay a transaction fee.

If a fraudster uses several cards (as happened to us) overnight, you won't get charged a fortune. Four and a half percent mulitplied by £6000ish + £10 admin for the twenty (or thereabouts) orders placed. It's over £400 in one night, saved.

[derekwong28]

Code 10 is the manual equivalent of AVS. AVS is not normally available to credit cards issued by non-UK banks. What Worldpay will do is to contact the card issuer's bank to check the cardholder's name and address against those in the transaction. I don't know of a link but you can ask customer services about this.

If the code10 matches, then it is probably OK for you to ship the items provided that the shipping address is the same as the billing address. If it is not, then there is still a possibility that the order is fraudulent. Most of the fraud attempts on us involved the use of US credit cards for shipping to developing countries.

Pre-auth is worthwhile having. If your site is susceptible to a large volume of fraudulent activity, then you may consider getting the worldpay guarrantee scheme. Although our chargeback rate is now below 0.3%, the time saved and the reduction in anxiety have made it highly worthwhile for us.

Derek