Shipping Address - different to the Billing Address! Advise!

[juliewoo]

Dear UKBF!

As a business that deal with just as many higher priced items as the lower priced accessories - we face a common problem with checkout security.

We have had numerous attempts of fraud (shipping to an alternative address that does not match the billing address - each time using different cards). However, luckily we intervened these before the postman took away our products!!

Without discriminating against genuine customers who would like an alternative shipping address, I need to create some kind of procedure when we suspect an order may be fraudulent.
(other than just calling and questioning each customer)

Does anyone else have a procedure/standard email that they have put in place to try & weed out the fraud from the genuine buyers?
Many thanks for your help.

[davidjgoss87]

Hi

I have long pondered that question and have made my mind up.

I will outline our procedure for you that has so far had no failures and stopped 2 frauds:

If you don't have 3dsecure (verified by visa and mastercard securecode) enabled already, then get it now. There have been reliability and ease-of-use issues but things are getting better with it. If a transaction has been authenticated by 3dsecure then you are not liable for chargebacks (although I would double-check the small print with your card services provider).

When you have orders where 3dsecure has not been used and there is an alternate delivery address, you have to rely on judgement to a certain extent. Ask these questions:

Is there a home telephone number provided that matches the area code of the billing address?
Does the email address given contain the cardholder's name?
Is the delivery address within 90 miles of the billing address?
Is the order value in £ below what you would call a "high value"?
Is the delivery address a business?
If the delivery address is indeed a business, is the email address provided @ that business' domain name?
If you get more than 2 "no"s, or if you just have a suspicious feeling about the order, it is time for the next stage. What I do at this point is send a letter to the billing address asking the cardholder to call or email quoting a reference number and don't release the goods until they have contacted you.

This method is essentially bulletproof because no matter what, the letter goes to the genuine cardholder. A couple of people might grumble about the slightly longer wait but most people seem happy that we are actively trying to prevent fraud being committed against them.

I'll PM you my letter template.

[Page]

If you get a business address you can ring and check it out a bit.

Say you have a package to send are there any ways it needs to be marked or does the person work in a certain department.

Is it a real business? Google.

It all adds up.

[downsouth]

If you feel totally against sending to 'other' addresses then simply only ship to the 'billing address'. Genuine customers will understand and accept this.

OK you might lose 1 or 2 genuine customers but thats better than dealing with lots of fraudulent orders

Some good advice from David esp if the items are high value.

[gazza-666]

The problem lies with the non 3D secure cards. Especially at this time of year where the customers are buying items as gifts.

[boho]

The majority of people now tend to use a work address or alternative address for delivery - mostly because of the problems with having items redelivered from Royal Mail or couriers.

You need to try to just verify the customer and their addresses as much as possible. Definitely used 3D Secure I've found that 90% of my customers are now cardholder authenticated.

The remainder I google their name, google their postcode to check its a real address, I check phone numbers - shame the UK doesn't have a reverse look-up like the US as its always easy to checkout my US customers by their telephone number, I always do a whois on the IP address and just make sure that it is in the UK, that its with a provider that matches their email - where possible and that it looks about right for their given location - 9 times out of ten it comes up as an exchange that is local-ish to them, google work addresses and someone else mentioned if really concerned you could just doublecheck if the person works at the address given.

Fishy orders tend to look out of place, the customer types everything in lowercase, the address doesn't 100% match against the card info, they give a mobile number and a temporary mail address which is yahoo/hotmail/gmail or its foreign equivalents. Always try googling the email address as well, many scammers aren't bright enough not to use the same email address again and you can find them - or even something which points to a genuine customer.

[sysops]

If you feel totally against sending to 'other' addresses then simply only ship to the 'billing address'. Genuine customers will understand and accept this.

They really won't.


OK you might lose 1 or 2 genuine customers but thats better than dealing with lots of fraudulent orders

You'll lose a lot more genuine ones who know they won't be at home to receive the parcel than you'll save in fraudulent chargebacks.

[boho]

You really have to go with your gut instinct I think, send an investigative email to customers whose order you have a concern about querying something.

If the address doesn't match the cardholder details sent an email apologising but advising them that you have to carry out a further check as advised by your payment provider because the address match failed, ask them to confirm the exact address as per their cardholder statement - which may not be the same as the postal address they naturally use so that you can complete the check and send out their order, if you reassure them that this is in order to protect customers from any misuse of their card then genuine customers will in the main be fine with this.

Same as mobile numbers - email and ask for a landline number in case of any need to contact them during the order/delivery process.

If the email bounces back then you know you were right to be concerned and dont send the order - wait for them to contact you, if you get a genuine response then you know its ok, if you get a fraudster response trying to urge the order to be sent out and its still ringing alarm bells then dont send it.

All you can do is try your best to eliminate them wherever possible, as Sysops says to prevent customers from having items delivered to another address is likely to be a greater loss financially than the loss of the chargeback.

Do thoroughly investigate any order where it is being ordered and sent to differing countries - sometimes these are genuine gifts but quite often these are fraudulent.

[who_me]

They really won't.



You'll lose a lot more genuine ones who know they won't be at home to receive the parcel than you'll save in fraudulent charge backs.
I have to agree... we dispatch a high volume of goods (not websites i hasten to add) many of our customers have identified themselves as resellers (all goods are dispatched unbranded), so the addresses will almost always be different.

We wouldn't contact the end user, because firstly they wouldn't have clue who we were, but secondly because our clients trust that we wont.

We do use 3D secure but even before that, we accepted that much like being high street shop, you have to accept the possibility of getting shop lifters and if you want to stay in business you can't treat all your customers as guilty before proving otherwise.

loss/shrink call it what you like is a fact of life, but the cost of losing even one customer because of your 'vetting' can amount to a lot more than the odd lost stock.

This said, although we have never been complacent about payments there is a difference between actively hunting down suspects and just being vigilant.