
Credit card fraud is something that a normal person doesn’t really think about. You hear figures on the news of 700,000 instances of fraud last year costing businesses £420m and it means nothing to you. “My card hasn’t been stolen yet & even if it is the bank will reimburse me” – this was my attitude until E-resistible became a card merchant and we suddenly found out the rules of the game…
We initially started with a very well known payment processor that attaches itself to an equally well known auction site. This payment processor offered literally zero protection for merchants against fraud. As a merchant the way to protect yourself is to ensure the customer goes through 3d Secure Authentication, this is the password for Verified by Visa & Mastercard Secure Code that most people are familiar with on internet transactions. However our 1st payment processor didn’t have 3d secure available for anyone to use, this therefore left all their internet merchants at the mercy of fraudsters. When the inevitable charge backs arrived from the person who’s card was stolen our payment processor did no investigation at all, took the money from us to reimburse the card holder and charged us a £7 admin fee for the privilege of taking our money away!
On top of this they also retained 5% of our total turnover in a rolling reserve for 90 days. For a business working on a small 9% margin this was the absolute killer. The fact that they retained this rolling reserve tells me that they were expecting very high levels of fraud due to their weak system and the retainer covered their risk.
Needless to say we lost many thousands in a short period of time & our relationship with this payment processor was abruptly halted. We now use a reputable merchant bank and Sage Pay as our gateway. The gateway provides all the fraud checking procedures, 3d secure etc. Both provide an excellent service to us and I happily recommend them to other people setting up e-commerce websites.
Following on from our bad experience I think we’ve now become one of the most responsible and secure merchants on the web. We actually went to the trouble of writing our own fraud checking system. When we identify an attempted transaction as fraud we can also flag that persons, postcode, telephone number, IP address and account with us as fraudulent. Now every order that gets placed scans against our database of past attempted offenders and flags up any matches for further investigation.
With our experience we noticed some patterns to the fraudulent activity and can identify the risky transactions just by looking at data we already gather. Here are a few indicators:
1.) Fraudulent transactions will always arrive at e-resistible by searching something along the lines of “order takeaway pay by card” “Order takeaway online”, this doesn’t mean that all people searching this are fraudsters but its just another measure to look at. Someone searching “Chinese delivery Bristol” is most probably totally innocent.
2.) The person’s email address will bear no resemblance to their name. Most peoples emails have their name in it and those that don’t usually have a variation eg John Smith could have smithy1988@hotmail.com, again this doesn’t mean that crazy_chick83737@hotmail.com is guilty but the % of people placing orders searching for “Order Takeaway Online” and a random email is fairly low.
3.) The person will often make many attempts with many different cards. How many people do you know with 3 different visas? This combined with points 1 & 2 practically makes the person a definite fraudster. We also log the issuing countries and banks of the cards & you will see that the cards will all be registered to different addresses.
4.) The cards will be registered to a different country. Fraud is mostly committed with international cards so this is a particularly easy way to filter high risk fraudulent transactions.
The fraudsters never actually have the card they are using with them, they have most likely brought a list of details or stolen them online somehow. This means that they don’t know the issuing bank and sometimes even the country that the card is registered to. This makes it very easy when I call them up to “ask security questions”, most just hang up on me or guess wrongly. Due to the increased security we now have in place, most fraudsters aren’t able to actually place the order however we still call them anyway :-p this is to act as a deterrent, I always tell them we have called the police & reported their address, IP address & mobile number. I believe that fraudsters are in contact with each other so once they find a soft website loads of attempts will be made as word spreads amongst the criminals. By telling them we’ve called the police even for people who don’t manage to place the order I hope that word also spreads that attempting to use a stolen card on E-resistible isn’t worth the trouble as we always catch them & they risk getting the police involved.
That’s our experience and how we’ve had to learn very quickly to protect ourselves. No-one was there to give us this information when we set out & when I see some competitors of ours setting up with the same payment processor that we used initially I feel really sorry for them as I’m sure they will soon experience some real pain. My issue with the card industry as a whole is that there isn’t enough of an incentive to totally remove fraud from the system. The merchant is the one who pays the cost of any fraud and therefore why should the card companies invest large sums of money to guard against it. If they were footing the bill you could bet that fraud levels would be close to zero.