Preventing fraud without being too conservative

[rrw]

In the eight years that we have had an online business we've gone through the mill with regard to credit card processors. We initially used Cybercash, which was bought by Verisign, which was bought by PayPal. When PayPal took over, some of the services that we used to get for free became a paid service. We didn't realize that at first, and after a couple of fraudulent transactions (not NEARLY as bad as you've experienced) we had to do the upgrade. As you state, they only checked the basics--when you upgrade to their next level, however, you can determine which items you want them to check. We have it set to reject any card that doesn't have an address, zip code, and CVS code match. I don't know any that match name.

In the past, we've been told by both Verisign and our merchant bank that even if you have a fully cleared card, delivered to the billing address and signed for by the customer, it still doesn't matter. All the customer has to do is state that they didn't place the order, and they didn't sign for it--actually had that happen. All we could do was to wish the bride all the worst and let karma do it's thing.

[thedancingdaisy]

Seems like there is more safety coverage for the customer, but nothing for the business. I realize that in a lot of cases customers get screwed by companies. I have had this happen to me on several occasions. And yet at the same time, since being in business it seems that I have had customers who go out of there way to try to screw me too.

[dcox]

Thanks for the information.

I am looking at my payment statistics because I am so frustrated with PayPal (not only about the chargeback, but with their customer service as well) that I want to switch processors. However, I have analyzed the statistics and while I do not have a huge population, hopefully I have enough to make a reasonable decision.

Here are my payment method statistics based on revenue of completed (not fraudulent) orders:

VISA/Mastercard: 62%
AMEX/Disc: 10%
PayPal: 28%

These numbers are based on dollar amounts, not the number of uses for each payment method. I did not realize until now that PayPal payments account for 28% of my business. This is slightly skewed because one of my largest sales has been paid for with PayPal. Payment method statistics based on number of uses is as follows:

VISA/Mastercard: 79%
AMEX/Disc: 8%
PayPal: 13%


Of the 3 fraudulent (or suspected fraudulent) orders I have had, I have cancelled two and eaten 1. Two of the three were placed with AMEX...

Based on this, I am willing to drop AMEX and Discover if needed. I hate to lose 10% of my business, but many of the merchant accounts do to work with AMEX or Discover.

I am looking at a few options:

1. Stay with PayPal, but use their advanced risk controls (looking into effectiveness and cost)
2. Emerchantsgroup, which has the lowest fees, but cannot accept AMEX or Discover (unless they consider my PayPal account an existing AMEX and Discover account)
3. Bankcard Services (3d Carts recommendation). Fees here are a little lower than PayPal, but not as cheap as emerchantsgroup. Also, I’ll have to find a gateway, which will probably offset the lower fees. There is also a 3 year contract that seems a little long.

I still have to research option 2 and 3 for risk controls. Whatever I do, I need to have the option of setting STRICT risk controls. I cannot afford these huge chargebacks.

Anyone out there use emerchantsgroup or Bankcard Services? If so:

• Are you pleased with the service in general?
• What risk controls are offered?
• What are the main advantages you find in the service?
• What are the main disadvantages you find in the service?


Thanks!

[bristweb]

try google checkout. here is their page about fraud

https://checkout.google.com/seller/fraud.html

second, get on authorize.net / cybersource and use their avs tools. bank of america set us up with 1.88% rate for online transactions which i think is very competitive.

[thedancingdaisy]

What's kind of funny about that is I've been in business for almost a year and a half now, and I have had 2 fraudulent issues, but within the last couple of months. At anyrate, they were both with AMEX too.

I also use paypal btw.

[ScribeTime]

1. We use Bankcard Services Worldwide for both of our stores and have been very happy with them. They use USAEpay for their gateway, which we've also been happy with. I'm not sure how they compare with other companies since they're the only ones we've used. But as far as I'm concerned the USAEpay online system is very easy to use.

2. Regarding fraud controls - you can get more information from this link:
http://usaepay.com/content/fraudstop.htm

3. Main advantages - reasonable rates, easy to work with, and good customer service.

4. Main disadvantages - don't really have any - except that the online rate of 2.19% is slightly higher than the 1.88% quoted by bristweb.

We also use Paypal and Google Checkout (most recently).

[cekman]

I just had my first wierd credit card order. Luckily very small - only $18. Anyway - a customer order with credit card, billing and shipping address matched. All credit card information was correct and phone number matched address it was sent to (did reverse lookup).

Anyway - sent to customer and yesterday he emailed to say he never ordered anything from me. He called his credit card company and they cancelled his card and are issuing him a new one.

The only thing that was odd was he said he never saw the email address that was used to place the order. I tried to do a reverse lookup by email - but couldn't find anything free.

I told him to return the merchandise and I would refund the whole amount. Since I'm getting the items back I'll only be out a small amount of shipping.

Why would someone order something and send it to the owner of the card? Everything matched, name, address, phone number, Exp. date and CVC number.

The customer could be just trying to get their money back - but I doubt it.

[thedancingdaisy]

cekman -

I actually had an order just like that a couple of months ago. It was for $11. Everything checked out just like it did for you. The email address even belonged to the customer. I though the whole thing was super weird.

I think one of two things happened...either someone in the household (say a kid) made the purchase and then didn't fess up to it or some random fraud used it and was hoping to pick the package up from the customer's house before they actually got it. I mean the second one would be the only reason I could think of that some who is using stolen credit card info, would actually have it shipped to the same address.

[www.frik-n-frak.com]

I think sometimes these identity thieving, credit card scammin' scum bags will do a little "test transaction" at some random site to see if the charge will go through.

The only reason I can think to buy a $20 widget and have it sent to someone else is that I'm just trying to see if funds are available on that card. I don't think I'd hide in the bushes at your house waitin' on a $20 widget to show up so I can hope you're not home when it arrives and maybe get to the front door first without someone seeing me and...

I want to know if the transaction on the card will work based on the card and customer information I've obtained. If the transactions doesn't fail - voila! Now I've got a card and customer information that I can use or sell to my other scumbag friends... or, whatever these jerks do.

Gotta love it, eh?

-fr_k