Forum Moderators: buckworks
Any thoughts on this issue would be appreciated. Is it going to make the store a fraud magnet? What kind of manual check would provide the best insurance against fraud?
Best bet is to stick to ship to bill to unless you can prove positively the person making the order is entitled to make the order (no easy thing to do, granted).
All I can say to the person who does it all the time for $80 goods is you've either been lucky or your products have no resale value to fraudsters.
An alternative is to write to the validated billing address with a contact telephone number for the cardholder to call if they have concerns. Chances are though they won't respond (especially if they are travelling - a key reason for alt ship to for some issuers).
Ultimately AVS and CV2 only prove conclusively that the anonymous person on the end of the IP address making the order knows the cardholder billing address and CV2 value. Unless you deliver to the validated billing address you place yourself at risk. Even then, with account takeover as detailed above, you could still be banged back.
One option is a bureau style check. e-identity provides that so at least you would get corroboration that the person making the order has a link to the address they claim - gets around the ID theft problem.
In the UK no chex offer 100% chargeback proofing - although there appears to be a get out clause of "reasonable efforts" on your behalf. Similiar to PayPal they offer cart integration.
Hope this helps :)
Gift orders are probably going to be coming in now so there is always exceptions to make.
-Corey
See if you loosen the policy and see how's the sales going? If the sales is increased and the number of fraud doesn't change much, then you should loosen the policy.
Every time you ship item to customer, check the cost of the order, if it's above $250 or something. Give them a phone call to approve the order.
Dell selling a Computer which cost above $1000, but they didn't need shipping and billing address match in order to process the order. The process is smooth and easy.
Usually people stole someone's card they don't know the billing address. The rate of the scammer pick a gift store is pretty low.
I think you act like a cop investiage all your customer as theift. You should make the order process easy and without hassle.
You should Lower Shopping Cart Abandonment Rates on your store for Better Conversion
As the transaction is at your risk you owe it to yourself to independently validate the data you've been given if you are uncomfortable with the transaction. If it's worth it is business terms always use a tracked delivery option - helps prove the goods were delivered to a validated address and avoids not received chargebacks.
There are stacks of resources out on the web - and third party solutions to deploy to automate most, if not all, of the above checks.
Merchants who view the net as a quick and cheap channel miss the point. Depending on your product and visibility it can be the quickest way to loose your entire business - for the sake of not setting up meaningful checks and balances.
Strike the right balance between risk and reward and your business will fly - cut corners and it will most likely die.
Not many merchants understand the card payment process in enough depth to be able to make those calls alone. It stands to reason then that external help is needed and should be sought.
That said - if you're selling spanner sets or lumber the resale opportunities are so limited as not to be worth the hassle for frauds.
Selling gadgets, PC's, AV equipment, car parts, jewellery - you're a magnet....
-Corey
Web hosting was not treated as even a moderate risk by my team in my "other" life as we figured that, like utilities (gas, electricity etc, hosting had no resale value and the fraud would lose everything in the blink of an eye when the hosts got a chargeback.
Interestingly we were getting more and more cases towards the end of my time involving just that. Can't for the life of me figure out what they hoped to gain other than possibly the ability to set off another scam with the space (phishing for example) and wanting to remain as anonymous as possible.
One very interesting development I was involved with was "planting" files on a users PC (much like a cookie - but not ;) ) that could be used to track use and multiple attempts (primarily for finance applications) from a single machine. Legally this was skating on thin ice to say the least but throws up some useful ideas for high traffic sites that are prone to near sequential and "testing" attacks.
Main stumbling block was the UK DPA requirement to tell everyone you intended to store a piece of unique code on their PC that would ID there machine - kind of defeats the object as bogus people would simply search for and destroy the file.....
Be interested to have your thoughts on why hosting would be a target....
And since smaller hosting companies are targeted, that money can really eat away all the profits.
And there are ways to verify your IP address. Look at the hosting company, etc.
-Corey
I wonder how much legitimate business you lose by not allowing this?
There is a lot of fraud and you have to use common sense. If you see transactions from a card in Maryland looking to ship to Arizona, I'd be a little cautious.
I think different industries need to apply different policies when it comes to shipping & billing addresses being different.
We get such orders from college students and small businesses where card is paid from owners business but he wants stuff sent home. Maybe 5% of our orders have diff ship and bill.
Different ship/bill probably doubles risk. But our loss rate is about .1% to start with.
As an aside, I turn about $10k in gifts to physical addys OTHER THAN my billing addy on a yearly basis - not a lot by some standards, but not peanuts either....
When things look fishy, ie next day air shipping on a high dollar item, we call the customer to verify.
Bottomline, no AVS match on the billing address, we don't ship.
Andrea
