Forum Moderators: buckworks
Summary
I would like to know what the maximum amount of time that can go by before I bank contacts you to request a chargeback from the transaction date?
Details
A few weeks ago we had our first fraudulent transactions through our website, at first we didn't know and were generally excited about a large order. Basically what happened was that an order for several thousands pounds was put through and a dispatch address that was not valid was given (we only ship to uk), the phone number was also invalid, when our courier couldn't ship goods we had them returned. Next contact customer by email and we get the story that they are now back in Nigeria and could we ship there instead. So we have the money (from a stolen card obviously). We contact our bank and they suggested a refund which contradicted advice from our payment processor. As this is only one customer from thousands we have held onto the money and are currently waiting a chargeback letter which may or may not come. We reported this to the police here and have a crime number (not that they will do anything about it)
A few days later we had 2 new transactions go through (we even found the original fraudster had emailed another Nigerian at an IT firm and that he contacted us from a Yahoo mailbox). Again we have the money and didn't even bother to try and ship to bogus UK address.
Since this we have implemented several new strategies that will stop any further transactions from either going as we use our own bespoke shopping cart and can make the required mods, for example any transaction over a certain value will go in and be pending until we manually authorise whilst we check email address and possibly phone customer.
The mods will avoid chargebacks in the future and negate this whole process, however I presume there must be a time that after which a bank will not be able to reclaim the funds. Is this correct?
If a credit card customer queries a transaction, doesn't recognise the merchant on his statement and queries it. Cardnet do a chargeback until the item is verified ...and then take forever to re-credit.
Anyway, LloydsTSB Cardnet 12 weeks
The money in your account from these transactions doesn't belong to you.
But from your original statement:
> So we have the money (from a stolen card obviously)
That is fraud (the person using the card).
As is any order from a Nigerian using a Yahoo email address, false address and false telephone number.
You'll learn from experience!
Also if the card is stolen and yet to be reported then if we could refund the card they might be able to carry on using it somewhere else.
Also this has never happend before so would like to know what will happen during the chargeback process for future reference.
From an admin point of view we have set up a seperate account to put the whole amount into so that when the request comes through we are not bitten on the arse so to speak.
Should anything slip through our new updated cart as possible fraud in the future then I am sure we will automatically try and refund. However in this case I would like someone in authority to say, sorry this is not correct here is a chargeback - rather than for us to take educated guesses.
You have the card number. Call the credit card issuer and tell them you suspect someone is trying to purchase something from you using a stolen card. They will call the card holder and determine if it is in fact a valid purchase.
Why not do the right thing?
Freq---
Have called our merchant bank - tried to do a code 10 on the origianal transaction but instead they didn't understand that it was a website transaction and they kept saying we should keep the card
Have called our payment processor
Have called the police
Have called the fraud department based in london and left message and also emailed info through
We have not called the issuing bank, are we obliged to do so? I presume our payment processor will have info on the issuing bank which I beleive will be in another country/time zone.
I have to say that not once have we ever been called all current activities have been initiated by us.
Yes you've done a few things to show some due dilligence but you haven't done the one thing that will lay the matter to rest.
Freq---
So I need to call my payment processor, he will give me details of the issuing bank. I then find out they are in another country. I have to make an international call, try and get through to someone that speaks english, and ask them about the transaction. All of this is going to take time and hence more money from me to deal with. I have already spent a good number of hours dealing with this (as this is our first). For your information I beleive the cards are already stopped from my code 10 calls.
Or I could just sit back do nothing and wait for the automated processes to catch up and deal with it and get on with dealing with the 100's of legitimate transactions going through our system.
I don't believe I am doing anyting wrong. From my point of view nobody in authority i.e. bank as contacted me to tell me what to do and when I have contacted anyone they don't want to know.
As a side issue is there anywhere in the UK or the world for that matter actually doing any work to curb fraud from Nigeria and other known sources?
You are free to do as you wish of course. Having dealt with attempted fraudulent CC orders for years I have learned to smell them coming and deal with them in the most expedient manner. The most expedient manner I've found is to contact the card issuer and have them confirm with the card holder. Every issuer I've had to call has had an international toll-free number available when required.
With regards to dealing with orders from fraudulent countries, we have terms in place that specify prepayment by money-order is required and no shipment will be made until it has cleared the bank if your goods are being shipped to (insert troublemakers here). We also have terms in place requiring that orders can only be shipped to the actual CC billing address for the card holder (although we don't enforce it unless we smell a rat).
We may piss off and loose a few (very few) legitimate customers but in most cases they already know they are located in a fraud cesspool and are willing to jump through the hoops we have layed out for our own protection.
Freq---
Rann it for a few weeks and it seems to have scared of a few wouldbe fraudsters, but found a nice bug that reports some UK surfers orignating from Czhec Republic, so removed it...
But the basics are there...
Stick to UK, customer or cheques from international..
Several times, I have credited for fraudulent transactions, only to find the payment processor doing a chargeback anyways a few weeks latter.
A few faxes and weeks latter, I get my money back.
If a purchase is flagged for fraud, we don't ship and wait for positive confirmation of the fraud or valididation of sale. We then let the bank do the chargeback if it actually was fraud.
I believe you have no intention of keeping the money-obviously.
There is nothing more you can do unless you can obtain the actual cardholder's information and contact them yourself.
In my experience, the most efficient way to proceed is to wait for the chargeback, it will come.
If you're still holding it in ten years, give it to charity, plus interest.
Thats what I am going to do in this case.
It sounds to me that in the US it is a well established procedure for Merchants to contact card issuers to confirm transactions but here in the UK this process just doesn't (from my experience) seem to exist. Can anyone who is a UK merchant confirm that they are regularly able to contact UK card issuers and get help with confirming transactions? If so do they have a special number that you ring other than the general customers services number? Are we allowed to share these UK card issuers phone numbers here in the forums or is that against the TOS?
Simon.
barclays merchant services (a card processor) will confirm the address of a visa/mastercard holder for a fee ( fee varies depending on how many you want to confirm ) - you can also have permanent address verification set up with which there is also a fee.
i'm pretty sure that the card issuers will not deal with you directly for all kinds of reasons including privacy, so you have to go through your card processor.
From a technical point of view we do not know 100% if it is fraud. We have been advised by our payment processor not to do a refund because there could be problems through thier site.
We've processed tens of thousands of transactions, and I have yet to hear my payment processor say "please od not process a refund". Here's a clue - fals phone #, false address, AND wants to ship to Nigeria (the CC fraud capital of the world). It's bogus. Refund the money.
From an admin point of view we have set up a seperate account to put the whole amount into so that when the request comes through we are not bitten on the arse so to speak.
What justification do you possibly have to hold onto money for goods that have never shipped? Further, why would you want a CHARGEBACK (which carries a penalty) when you can simply reverse the charges?
Has anyone actually had a legit order going to Nigeria?
Simon.
