Sagepay - High Risk

[Allan123]

What's you procedure for High Risk orders?

I've received a large order over £1000 with a High Risk score of 141. Address, Sec, Name on Card etc passed, but no Electral Role registered, lots of cards declined at address etc etc.

Obviously Sagepay and the acquiring bank offer no help at all.

What do you guys do?

 

[sysops]

I've received a large order over £1000 with a High Risk score of 141. Address, Sec, Name on Card etc passed, but no Electral Role registered, lots of cards declined at address etc etc.

3D Secure?

Obviously Sagepay and the acquiring bank offer no help at all.

What do you expect them to do? Say "it's ok, you go ahead and ship, if there's a problem, we'll cover it"?

 

[Allan123]

What do you expect them to do? Say "it's ok, you go ahead and ship, if there's a problem, we'll cover it"?

What's with the attitude on this forum?

My point was there a phone number and a quote ID but they offer no other information than is available through the 3rd Man. Natwest the acquiring bank where also not interested that a card may have been used fraudulently and didn't even want to take the details.

 

[sysops]

What's with the attitude on this forum?

Don't blame the forum, I'm responsible for my own attitude.

My point was there a phone number and a quote ID but they offer no other information than is available through the 3rd Man. Natwest the acquiring bank where also not interested that a card may have been used fraudulently and didn't even want to take the details.

Hah - you're new to this, right?

Get this - when you have a real fraudulent transaction, and you know where the goods were delivered, they're still not interested.

Or when you catch a fraudulent order before shipping, because the user has tried 14 different cards with different names on them, they're still not interested.

You're on your own. Money is just numbers on a screen to these people (and they're right in many ways).

Now, for this order, did it pass 3DS? Is the delivery address the same as the card address? Did it match on address numerics?

 

[Brasso]

What's you procedure for High Risk orders?

I've received a large order over £1000 with a High Risk score of 141. Address, Sec, Name on Card etc passed, but no Electral Role registered, lots of cards declined at address etc etc.

Obviously Sagepay and the acquiring bank offer no help at all.

What do you guys do?

Firstly, depending on your bank (we use natwest streamline) you might be covered IF They passed 3D secure AND you have a validated postal address AND you ship the goods to that address AND you have a PROOF OF DELIVERY (not just proof of posting). I would guess that you don't have 3D secure verification in this case.

Outside of those very strict conditions if the order is fraudulent then you get the charge back, end of. You carry the can, that's why they don't put any resources into card holder not present transactions (which internet sales are). You can get a charge back for up to 6 months after the sale has gone through, so just waiting a bit won't help.

So, 141 is a very high score, my advice, DO NOT SEND THE GOODS!!!!
If you call the number on the third man form SagePay should be able to tell you why it has this high score IF the card has been used through SagePay before. The fact that you have a high score indicated that this address and this card is known to them.

Current scam is,
1. Get card details from elderly person
2. order online or over the phone
3. arrange to pick the goods up
Variation on 3. is Arrnage for their own courrier to get the goods and then the courrier is told to switch addresses en route.

If you have a number for the customer then you can call then and see if you think they are genuine. If you think you are being done then you probably are. Let me know if you have any other specifics.

I find SagePay to be really helpful and if you think they are bad, move to world pay...

 

[Allan123]

3D Secure wasn't obtained as it was a Telephone Mail Order, but the Address Numerics & Postcode matched.

Things that are highlighted in red where;

Multiple cards declined at del address
Phone no has not been supplied
ER Fail Billing
ElecRoll fail and >£x
Multiple purchases at delivery address
Moderate spend at delivery address
High recent spend at delivery address
Very High spend at delivery address
Value Depending on Sub-Client Type.
Multiple cards at delivery address
Multiple people at delivery address
High ATV at delivery address

 

[Allan123]

Don't blame the forum, I'm responsible for my own attitude.



Hah - you're new to this, right?

Get this - when you have a real fraudulent transaction, and you know where the goods were delivered, they're still not interested.

Or when you catch a fraudulent order before shipping, because the user has tried 14 different cards with different names on them, they're still not interested.

You're on your own. Money is just numbers on a screen to these people (and they're right in many ways).

Now, for this order, did it pass 3DS? Is the delivery address the same as the card address? Did it match on address numerics?

Every topic is filled with somebody getting grief of some sort. I could accept it if I came on and said oh.. i took and order which failed everything on SP and I shipped it.

Come on, not everybody is a full blown idiot.

The reason I asked on here was because SP & Natwest didn't offer any information. I'm not new to trading online no, we have been trading from our website for 5 years, but have only ever had 1 fraudulent transaction back in 2005 to Italy when our site first went live and our Rules hadn't been setup properly.

I don't take orders for anywhere other than the billing address, and usually reject any orders that are not in Low Risk.

 

[sysops]

Address numerics are useful, but are not foolproof. For instance:

If the card address is 3 Acacia Avenue, W3 2XZ
the numerics will match to 3 Bronson Close, L3 2UI

I think you need to use common sense here. The only situation where a genuine order will throw up such a high fraud score is if it's a business address, and there are lots of people at that address placing lots of orders.

Is it a business address? Is it a real company? Does it look right on streetview?

 

[Allan123]

No it's a row of terraced houses in London. Common sense says do not send which I haven't but it would have been nice to know if there is anything anywhere you can get extra information to validate an order, or what do other people when they receive an order with a similar profile.

 

[sysops]

No it's a row of terraced houses in London. Common sense says do not send which I haven't but it would have been nice to know if there is anything anywhere you can get extra information to validate an order, or what do other people when they receive an order with a similar profile.

I guarantee it's fraudulent

There isn't really anywhere where you can get further information, what you have is pretty much it. If it smells that fishy, it will always be fish.

 

[dingbat]

Call up the customer, tell them you're recording the call and just want some extra information as there are issues with the delivery address. IME, fraudsters start collapsing once you smell something.

 

[Brasso]

No it's a row of terraced houses in London. Common sense says do not send which I haven't but it would have been nice to know if there is anything anywhere you can get extra information to validate an order, or what do other people when they receive an order with a similar profile.

Hi Allan

Given that this isn't a business address it is almost certainly fraudulent. In many ways, your lucky you use SagePay. If you had a terminal you would have gotten your auth code and sent it out none the wiser. I know that a grands worth of business is a nice big order and you really want it to be genuine, but...

Unfortunately, there isn't anything more you can find out, the actual card is almost certainly still in its owners wallet, not lost, not stolen. Without actually speaking to the genuine cardholder (and knowing 100% that you are) there is nothing else to find out.

If you become 100% certain then it is best to refund the order through sage pay rather than wait for the chargeback due to reputation.

I wish I had better news

 

[sysops]

If you become 100% certain then it is best to refund the order through sage pay rather than wait for the chargeback due to reputation.

Don't refund it, void it. Refunding it costs you a lot more than voiding it.

 

[Esk247]

can i just ask, just because it's a row of terrace houses doesn't mean its not a business address...or did i miss the point? it's just, we run our businesses from a terrace house, ground floor offices and gallery with residential above it..but its still on a normal street.

 

[sysops]

can i just ask, just because it's a row of terrace houses doesn't mean its not a business address...or did i miss the point? it's just, we run our businesses from a terrace house, ground floor offices and gallery with residential above it..but its still on a normal street.

Yebbut - come on, this one is definitely dodgy.

 

[Esk247]

Yebbut - come on, this one is definitely dodgy.

oh aye << yorkshire for yes

it's more dodgy than Hagues private life but i just wanted to stick an oar in that not all businesses (especially internet only) are run from trading estates or flashy headquarters so don't be too put off if you find yourself dealing with a terrace house in future.

 

[Brasso]

Don't refund it, void it. Refunding it costs you a lot more than voiding it.

Yup, he's right, my appologies

 

[Allan123]

Yes i voided the order yesterday. Today the customer called and was concerned where his order was. I explained it returned a High Risk score and that we could not dispatch unless he could pay via a different card that returned a Low Risk score and he seemed genuinely concerned wether the money had been returned to his card.

He was either a very convincing Fraudster saying the right things or I may have actually rejected a genuine order!

Not worth taking the risk though. He didn't produce another card so no way of finding out!

 

[InternetPaymentProvider]

What's you procedure for High Risk orders?

I've received a large order over £1000 with a High Risk score of 141. Address, Sec, Name on Card etc passed, but no Electral Role registered, lots of cards declined at address etc etc.

Obviously Sagepay and the acquiring bank offer no help at all.

What do you guys do?

You could request further information about the cardholder? A proof of address and ID.....

 

[Experienced IT guy]

you seem to have their address, write to them, explain nicely that their card was not passed and if they send you some other guaranteed form of payment you will will be happy to process their order....