Forum Moderators: buckworks

Message Too Old, No Replies

Persistent Fraudsters

Need a workable solution

         

volatilegx

2:42 am on Jan 2, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I have an ecommerce website with an affiliate program. Occasionally, it is a target of fraudsters who sign up for the affiliate program and try posting fraudulent transactions. I've already lost one merchant account due to excessive chargebacks.

I once thought banning all non-U.S. IP addresses from checkout would help, but some fraudsters use proxies, and many of my legitimate customers are from overseas.

I also thought about implementing a form of ip address/geo-location cross checks with the information provided during checkout to make sure the country of the IP address matches the country input on the form. This may be the most effective solution.

Any other ideas?

Key_Master

3:26 am on Jan 2, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Do your legitimate customers use proxies?

The reason why I ask is the vast majority of proxy IPs have rather unique HTTP_ACCEPT headers. Also, a lot of proxies can be detected by comparing the document url with the browsers address bar using JavaScript.

topsites

3:57 am on Jan 2, 2006 (gmt 0)



I might recommend finding a credit-card processing agency that will give you no hassle over this. IF someone enters fake credit card info, this is as much their problem as it is yours.
no
As far as I'm concerned, if they can not live with the reality that scams will come their way, then they are not ready to do business.

As for me, I never hear from the cc guys, my only problem is when a customer goes and fills in some information, then proceeds to make a payment.

Well, wouldn't you know it, IF a customer fills out the information, clicks Proceed and THEN backs out without paying, I still get the email for the listing - Of course, without the next email confirming payment, there will be no listing but over the years this particular issue frustrated me considerably.

One might think this is just someone who at the last minute got cold feet, and although I do not doubt this to be the case at times, I find more often than not it's the work of one particular (and always persistent) person.

But, much like what I said about if the credit-card people are not willing to tolerate this and business on the Web is connected, I am learning slowly to tolerate this nuisance.

Corey Bryant

5:37 pm on Jan 2, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Take a look at your TOS for the affiliates. How often do you pay out? When do you pay out? How do you pay out?

Do you screen your affiliates at all? You have to screen them just about as much as your orders.

Does the program you have work for you? Is it bringing you business?

-Corey

volatilegx

2:12 pm on Jan 3, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



> vast majority of proxy IPs have rather unique HTTP_ACCEPT headers.

Any examples of this?

The JavaScript idea is pretty good. I recently did implement something like that, but for a different reason. However, not all proxies are web proxies.

The affiliate program does make a fair bit of money for me, and I'm not willing to discontinue it. I screen affiliates, but probably not as well as I'd like to be able to. It would be nice if I could do a background check on all of them, but I don't have the time or resources. Mostly, I just eliminate ones from suspect countries. As far as the payouts, they are delayed by 30 days to help eliminate fraud. It has worked for me in the past... I've never paid a commission on a sale that turned out later to be fraudulent. The problem I'm having stems from fraudulent charges that I've caught before paying commissions. It would be nice if there was some automated way to catch them.

andye

3:08 pm on Jan 3, 2006 (gmt 0)

10+ Year Member



Maybe you do this already, but my suggestions would be:
- only accept affiliates from countries where you have a decent chance of legal recourse.
- only make affiliate payments in trackable ways, i.e. to named bank account, not untracable payments like e-gold.
- if you have doubts about a new affiliate and the purchases associated with them, ask them to send you a copy of some ID (e.g. their passport) which matches the bank account.

This doesn't prevent the initial fraudulent transaction of course, but it should stop you getting a run of them from the same person (because they'll realise they won't get the money, or if they do then you'll be sending the police round). You might sometimes be able to refund the dodgy transaction before getting hit by a chargeback too (and hopefully before despatching the goods / performing the service).

hth,
a.

update: I just read your later posting properly

I've never paid a commission on a sale that turned out later to be fraudulent

and I guess you're doing most of this already - barring affiliates from the more 'lawless' countries can help though.