Preventing fraud without being too conservative

[dcox]

Hi everyone,

I submitted this as a ticket as well, but though you all may be interested and/or give some advise too.

I use Paypal website payments Pro as my CC processor. I received a large order last night and decided to verify it prior to shipping the products for my safety, as well as the CC owner's safety. Well, the phone number went to a fax, so I thought maybe a typo had occurred.

So, I checked my transaction details and it was NOT eligible for Paypal's seller protection policy, supposedly because the address could not be verified. HOWEVER, the AVS data field contained a "Y", indicating address had been verified (at least the numeric portions). Virtually all of my sales are this way: Not eligible for the seller protection policy, but the AVS is “Y”.

I called PayPal and there were no help, other than informing me that if I shipped the products, it was my full liability. So, I called AMEX and tried to verify the address, which they could not…

So, all of this so far does not have anything to do with 3dcart, but I would like to know a few things:
1. What is your opinion on AVS and is it a reasonably accurate means of judging an order’s legitimacy?
2. Should I set up my PayPal account such that 3dcart WILL NOT accept an order unless I am covered under their policy? (which would mean that about 90% of my orders would be lost)
3. Is this just a problem with PayPal that I should get away from by changing to a different gateway and merchant account?
4. What do you suggest to maximize orders, but still be safe? Is there anything within 3dcard settings that I can do to reduce my vulnerability to fraud?


Thank you,

DBC

[cekman]

1.) I don't pay a lot of attention to AVS at all. If the payment goes through I send the products (unless it's Nigeria or something like that)

2.) No - that would be silly :-) You would be limiting yourself to PAYPAL members who have chosen to verify their address. You would miss all credit card customers who aren't paypal members

3.) No - all merchant accounts would work the same. They can tell you what was or wasn't verified then it's your decision after that.

4.) I think what you did was right. You questioned the order and did some checking.

Did the customer give you a phone number? If so go to www.whitepages.com and click on the Reverse Lookup tab. Enter the phone number and see if it matches the Billing name/address.

Are the billing and shipping addresses the same? If not and your really suspect something, find out who lives at the billing address and call them to verify the charge.

I've been taking credit cards for at least 4-5 years and have not had a chargeback yet - but it's bound to happen sooner or later. I'm sure I'll be pretty upset when it does happen.

I'm interested to see what others say.

Good luck
Carla
Cobweb Corner

[dcox]

Carla,

Thank you for the suggestions. I generally do ship products without too much question because my site settings do not allow an order where the billing and shipping address do not match. In addition, orders outside of the lower 48 are not accepted.

What concerns me the most is not PayPal (I am sure they'll find any excuse possible to get out of liability), but the fact that AMEX could not verify the name to the address...

I ran the reverse look up and the phone number does not go to the address listed and it is supposedly a landline...

I have requested an updated address from the customer to verify it. If I do not hear back from them by Saturday, I'll cancel the order. It will be a $2,500 mistake if I do get a chargeback (~$1,400 chargeback and ~$1,100 worth of products). That is not something i can risk at this point.

Thanks!

[cekman]

For an order of that size then I think you're doing the right thing. I had someone order 50 badge holders last year and I thought it might be suspect. I called them and found out the address was for a hospital (they were for nurses). That one turned out fine - but I understand why you would question it. If the customer is legit they will answer your questions to your satisfaction. If not then you will be glad to avoid the sale. Good luck!

[dcox]

Well, for a quick followup, here is what's going today:

I recieved a chargeback request for an order two weeks ago that I did not dig into enough. Same kind of deal, order went through with no problems, AVS checked out OK, security code OK, billing and shipping address matched. I shipped the products and the package was re-routed at the time of delivery... This was an AMEX order too.

BE VERY CAUTIOUS OF AMEX ORDERS RIGHT NOW, THEY MUST HAVE HAD A SECURITY PROBLEM.

I provided them with all of the documentation showing the order, AVS results, billing and shipping address as well as the tracking number. We will see what happens

I have cancelled the order in question. If it was legit, I guess I lost a customer, but I cannot afford to loose double the order amount to try to get a customer.

[cekman]

Wow - what a bummer. What do you mean that the order was re-routed? Let us know how it turns out - if you have all of the documentation that you did everything correctly - then I hope that the chargeback is denied.

Good luck!
Carla Ekman
http://cobwebcorner.com

[dcox]

When the package arrived at the scheduled location, it was re-routed, apparently due to a change of address....

[thedancingdaisy]

I had a issue similiar to this a couple of weeks ago, and I also use Websites Payments Pro. I talked to someone at PayPal, and they told me that their customers (like you and I) who utilize Website Paymetns Pro are considered high risk. Thus no orders placed through our sites where the customer enters their credit card information are covered under their seller protection policy. The only way you would be convered under the policy would be if the customer actually pays through paypal (like through the their express checkout). She then told me that basically all I can do is use my best judgement, weight out the risk.

The thing I find interesting about that is that they kind of advertise that seller protection is a benefit of using Websites Payments Pro, but it really isn't if it only applys to customers who actually pay through paypal because the vast majority of my customers at least pay though my site not paypal.

[dcox]

Yes, I have noticed that only one of my sales have been covered under the policy and that is because they paid with Paypal.

I am curious to see how this chargeback turns out. I have a bad feeling I am going to have to eat it, which may be the end of the webiste.... I've been trying to decide to keep going with it or drop it (side business that isn't profitable yet). A $2500 hit will be a good reason to shut it down.

[dcox]

Hello everyone,

I wanted to give you an update.

The chargeback fight was dropped by PayPal saying "This chargeback type is not covered under PayPal's chargeback policies." I suppose no type of chargeback part of their policy. Luckily I did have a brainfart earlier and I realized it won't cost me $2500, just $1100 (cost of products shipped)... Still a bummer though.

At any rate, I am now officially looking for another processor. It turns out PayPal's AVS is pretty much worthless (most services may be, I am checking into it.) This is what PayPal checks for a transaction authorization based on the few dozen calls and emails I have been a part of over the past few weeks. To authorize the transaction, PayPal checks the following against the CC company files:

Number
Security Code
Expiration Date

They do NOT check the following:
NAME
ADDRESS
ZIP

Their AVS service checks the following against the CC company's files (AVS does not necessarily have to check out for the authorization depending on your settings):

First several (5 or 7 I think) digits of the numerical portion of the address
Zip Code


I learned all of this because I cancelled a suspected fraudulent order and the refund went to a person who did not place the order. When PayPal was questioned about this, they promised the refund went to the correct person. I then questioned why the transaction was authorized in the first place and I was informed the name was not something that was checked.

I want a processer who checks EVERYTHING. I ship ONLY to the billing address, so it shouldn't be a problem for these checks. Are any of you aware of anyone who provides this?

Thank you!