You receive an email notifying you that an order has been placed on your site.
Should you start jumping up and down in glee? You’d better hold that bottle of
champagne -- until you have confirmed the veracity of the order.
(article continued below ...)
With about 93 percent of all consumer Internet purchases made with credit
cards, credit card frauds are on the rise. In fact, a Gartner survey of 100 Web
retailers found Internet credit-card fraud to be much more common than offline
fraud, making it the "No. 1 problem" in e-commerce.
Think you won’t be victimized? Well, think again. CNN recently reported
that the big travel site Expedia.com suffered losses of $4.1 million in credit
card fraud. If big sites with their sophisticated credit card fraud detection
systems in place can be victimized, how much more the smaller sites?
Internet frauds that victimize the merchants are becoming shrewder, wiser and
more sophisticated. In fact, gone are the days when credit-card thieves have to
break into Web servers to steal card numbers (although many still do). All they
have to do is to download a software on the Internet and a free one at that
-- to generate a supply of credit card numbers associated with a particular
bank.
Thieves are also becoming brazen. Some phone aggressively to get the order
approved. Rick Beneteau wrote in his article “The Latest, Not-so-Greatest
dot-Con Game” that a cheating affiliate member who submitted orders using
stolen credit card numbers even sent an email begging for his commissions!
Particularly if you are selling big ticket and high-value items, some credit
card gangs may be after you (yes, it is scary!).
When you are accepting online orders, you must make sure that you implement
protective measures. While you may not be able to diligently screen out all
fraudulent orders, you can greatly reduce online fraud.
Here are ten signs that an order may be fraudulent:
Larger than normal orders.
The customer may be using stolen credit cards or
phony account numbers that have limited life span. If the customer is looking to
conduct fraudulent transactions, he needs to maximize the size of his purchase.
Orders for multiples of the same
item. If your products have high resale
value like watches or jewelry, be wary of those ordering five items all at once.
If a crook intends to resell them, having more will increase profits.
Orders made up of expensive
items. While you may be happy that your big
ticket items are moving, check and double check before you ship out those items.
Expensive items, especially brand name items, have maximum resale value and
maximum profit potential. They are especially attractive to thieves.
Shipping address differs from billing
address. It is always good policy to
only ship to the billing address of the card. If the item is being shipped
elsewhere, especially for gifts, you need to take extra steps to confirm the
veracity of the order like calling the person who placed the order.
Suspicious billing
address. If the order is within the United States, you can
use the mapping software in some of the major portals to confirm whether the
address exists. If the address cannot be verified, contact the person to make
sure that the address was simply not mistyped. However, if the email address or
the phone number is still erroneous, then simply forget about the order.
Leave at
door. As a rule, never allow your products to be left at the
doorstep, particularly if you are selling valuable items. The crook may be using
an innocent person’s house as a drop-off point. If you are using the postal
system, UPS, or FEDEX, the delivery man will simply leave a notice that a
package has arrived and it needs to be picked-up.
Orders shipped “rush” or
overnight. Most fraudulent orders specify
overnight or 1-day shipping. A thief using someone else’s credit card is not
concerned about the shipping expense: the faster he or she gets the goods, the
better. Never mind if the shipping costs twice or more than the product. As one
netpreneur relates, “Let's say a customer from Buffalo is buying
a video game for a relative in Miami. If it's P.O. boxes, or it's FedEx
overnight, then you start to ask, "Why are you sending this $6 item
overnight? Why are you paying for shipping that's 3x the price of your
item?"
Untraceable email
address. Many fraudulent orders originate from a free,
web-based, or e-mail forwarding address. Anyone can simply open a Hotmail
account, without giving his or her personal info. Free email addresses allow
thieves to quickly make their escape, and makes it hard for the victim or even
authorities to trace them back. It is safer to require the customer to provide
an ISP or domain based address, which makes it easier to trace back to a
"real" person.
Orders that cannot be
confirmed. No order is accepted unless the complete
information is provided and can be confirmed, including full address and phone
numbers. As the Sneetch.com guys warn, “You call the number and it doesn't
ring. Every time we have a funny feeling about an order, we call. If they don't
answer the phone or if the phone is disconnected, they get an email saying that
the order is cancelled.”
Suspect ship
address. According to Yahoo, orders from Romania, Macedonia,
Belarus, Pakistan, Russia, Lithuania, Egypt, Nigeria, Colombia, Malaysia, and
Indonesia have a very high incidence of fraud, and often have unverifiable
addresses. You are taking a higher risk if you are shipping outside of your
country.
The cardinal rule should always be to ship only when the order checks out.
Particularly if an order exhibits multiple warning signs, you are better off
keeping the item on your shelf than sending it to a crook. You will not only
lose the item, but the valid credit card owner will not pay for the item they
never authorized or received. Worse, you will be slapped with a chargeback fee
by your bank, and even lose your capability to accept credit card orders.
Now that you know the signs, here are some ways to measures you can implement
to make sure that the orders you process are the real deals.
- Use common sense. Don’t immediately ring up orders received. Sean Lungren
and Todd Lidvahl, founders of Sneetch.com selling DVDs and videos on the Web,
uses a system they call “manual. It is called "two eyes" and we both
have two eyes. Well, you just basically look at it and see if it look kinda
phoney. Just take it with your gut instinct.”
-
Call to
confirm. Calling your customers to confirm their order is not only a
way to detect fraud, but part of good customer service. It will give your
customers a sense that you are taking steps to protect their identity. If the
card was stolen, your call can alert the customer that their cards are being
misused. Even if the credit card number and address check out, the person who
owns the card may have not even heard of your “customer.”
-
Use tracking codes in your order
forms. In your form, add a hidden field
called the Environment Report field. While it may vary among various form
handlers (FormMail, cgimail, etc,), the syntax is most often:<input
type=hidden name="env_report" value="REMOTE_HOST,REMOTE_ADDR,HTTP_USER_AGENT">.
This will allow you to know about the computer used to send the order, including
the domain name and the IP address. If you suspect that an order is fraudulent,
you can contact the ISP of the “customer” and alert them of the fraud.
- Ship only within your country. You may say that you are on the Internet to
reach the global market. But then again, the risks are oftentimes too great when
you ship to other countries. If you are a US-based merchants, Address
Verification Systems do not work outside of the US so you have no way to check
out the validity of the address. If you call to confirm the order, think if the
international long distance costs are worth it.
- Accept orders only from ISP or domain name email addresses. EVERY fraudulent
order has come through the free, web-based, or e-mail forwarding services. If
you establish a policy that you only accept orders from ISP (e.g. @aol.com) or
domain name emails (e.g. @powerhomebiz.com), you will be weeding out a lot of
fraud. Be careful, though: be sure to type in the domain name in your browser to
verify if indeed the web site exists or not. One of the leading free email
providers, Mail.com, allows users to have email addresses using the domains @accountant.com,
@techie.com, and others. If the customer does not have ISP or domain name email
addresses, ask him or her to call your business (be sure to have caller ID) or
fax the order, along with a photocopy of the credit card.
=======
|
