web site fraud - tips to spot it

[LyndaSandick]

We have been caught so hope this helps someone.

If you receive an order with the following then be careful, it could be credit card fraud.

Billing address and delivery address different, however same name and telephone number on each address.
Email address is usually gmail
Multiple items bought - in our case, mainly electrical or expensive items.
Same customer placing multiple orders over a short period of time.

Our credit card payments are taken through PayPal and we have had chargebacks for a number of fraudulent purchases. We can't do anything about it. The fraudsters end up with the goods and the money back from the credit card company. We reported this to the police but have heard nothing

Even though we spotted this fraud on the 12th January. We are still being hit although we are intercepting the orders now. My staff are now fully fledged detectives

 

[GreenLaser]

I am normally overzealous in watching , checking and rarely get hit ! However i was recently hit by an address in BELFAST ..keep you eye out for orders from BELFAST.

As it turned out , the goods were never signed for and came back Phew ...so all i lost was the postage !

The last two years when i spot anything suspicious i phone worldpay who are cautious in what they say but can give an indication.

If its all adding up to looking like defo fraud i do a postcode search and find local police station and call them and explain i beleive their is a potential fraud going on at a particular address , i suggest its "possible" and they may like to put the address on their intelligence system or send an officer by and they seem content to take the details , explain also that if they are using dodgy cards likely more important than this fruad is WHERE they are getting the card details from ..... tell em while its HOT ! ... help your fellow traders !

I beleive this action helped to stop some fraud taking place in london last year ...it was obvious they tried 6 diffeertn cards from different countries address names etc , but all to same delivery address until they got one that passed. i ended up giving a statement by fax and was told by CID that it was a major fraud and they had THOUSANDS of peopels credit card details

PAUL

 

[LyndaSandick]

Ther delivery addresses we found were in Leeds Bradford Wakefield Grangemouth Liverpool London and Germany

 

[smellyskelly]

Lynda

I Have been in the Fraud industry (Retail) for nearly 20 years, prior to starting our Business. I too keep an eye out for tell tale signs !

Depending on your personal situation and value of goods it is a fine balance between taking a risk or good service and being vigilant.

As you point out, generally @hotmail or @Gmail emails addresses.

For those that may want to investigate further - A few pointers that may help people make a decision to dispatch or not, do not rely on these though - if unsure or suspicious or cannot afford to lose the item - do not despatch.

• Check the name in the email address - is it the same/similar to the card?
• Try a Voters/electoral roll check (yell.Com)
• Try and ring the telephone number provided -does it work / talk to them if they answer - and expalin you wish to confirm something?!?!?! most fraudsters are reluctant to discuss there actions with anyone?
• Ring your Merchant Bank provider and ask for an address verfiication or code 10 if you are suspicious - you may be charged £3 or so.
• Asking for quick delivery???!!!??

Lots of online resource available to help you

cardwatch.org
APACS.co.uk
Your bank will have online advice
VISA/Mastercard etc
A particularly good one is - retailersandcards.org

I recently was suspicious about a high value order - the invoice address was a business adress - so i found the numberr and called the name on invoice - she knew nothing of the order!!

If you do end up losing to a fraud - try and learn from it - they are always changing their methods.

Hope this helps

Scott

 

[CaterTrade]

Just to add, if it's a company buying the goods, don't just look to see if the company has a website as fraudsters know about that and often set up a site to look genuine.

We were nearly caught once as the goods were being sent abroad at the last minute we were asked to redirect the goods to Nigeria and the freight company warned us about such goings on.

 

[LyndaSandick]

Thanks for all your help guys. On the advice of GreenLaser I telephoned the local police station which happened to be in London for the orders we caught last week. The orders totalled £1,600 for 3 orders. The police woman I spoke to was very helpful although the information she gave me was alarming. She confirmed it is a real problem in London. The suite shown on my address was a mail box. As the orders were next day delivery she said the fraudsters hang about outside the building to sign for the goods when the carrier shows up or sometimes the carrioer drivers are in on it. She knows many London companies that will not send out goods without checking names and addresses on the electoral roll. What is happening to this Country.............

 

[benjamin_c]

are there any kind of insurances companies can get to guard against this kind of fraud?

 

[Mystro]

I think a good deterrant would be to not only have a signature for the signed goods but a photo too of the person signing for this ..

Not much different to walking into a shop and the CCTV getting a picture of you so should not be many complaints

 

[JElder]

She knows many London companies that will not send out goods without checking names and addresses on the electoral roll.

Unfortunately there are plans afoot to prevent this kind of commercial access to the electoral roll, making this check impossible....

 

[SillyJokes]

are there any kind of insurances companies can get to guard against this kind of fraud?

You can insure against it a bit with your payment service provider, at least with World Pay you can.

Paypal....... well I won't take a big order via paypal.

 

[seiretto]

PayPal/WorldPay or any other online processor are all much the same, they will make a chargeback if its fraud, its up to YOU the seller to check the buyer is kosher (it will certainly NOT be the banks that will feel the pain, unfortunately).

We were hit about 10 years ago, and since have been so vigilant it has only been repeated once (we get attempts EVERY DAY from wasters all over the World: UK, Russia, America...). On some occasions genuine orders can get delayed, but that is how it is: we as real customers are inconvienced by fraud everyday.

To confirm an order you should always check:

• the users ip address, you can do this here:
  ip2location.com/free.asp
  and/or
  visualroute.visualware.co.uk
• the telephone number - ensure your order form requests their REAL TELEPHONE number at the delivery address (no mobile numbers), if they can not provide this then cancel or at least delay that order.

Hope that helps others a little

 

[seiretto]

You can insure against it a bit with your payment service provider, at least with World Pay you can.

Paypal....... well I won't take a big order via paypal.

Your comfort with WorldPay over-and-above any other online processor is misplaced.

 

[busynessman]

We had a fair few at the end of last year, we lost around 1k.

We use paypal for all our payements and the advices they gave was it is down to the seller.

BUT one thing weve found that is very handy is the AVS match and weve spotted a few with these where the card detaisl dont match the address exactly and havent had 1 charge back sine.

The police are very aware of this crime and try to help the best they can but at the end of the day most chargebacks like this end up unsolved hence why they just keep on doing it.

The new 3d secure should help eradicate a lot of them which maestro have now brought in as mandatory.

Most of us do learn the hard way but once youve learnt you are on your guard a lot more, it would be good if payement providers gave information out when you sign up with them etc so you can be more on your guard.

 

[GreenLaser]

If the the shopper passes the 3D secure checks , you as a retailer are not responsible and wont be charged back - at least that how i understand it .

Just watch your not being over vigilant and losing buisness , I find a lot more people are having deliveries to work addresses due to not being in to accept and sign etc , o quite often you can get address mismatch alert but it quite innocent

Also as explained before I contact local police station as soon as im 90% it looks like fraud ... you will get better reaction from police if you indicate and hint about how it maybe a BIG scam , after all WHERE are they getting thse numbers , rather than hey ive just been ripped off for £70 type request ...and its true , these fraudsters normally have lots of card numbers and you are at the shrp end of it .... report , report , report

 

[seiretto]

If the the shopper passes the 3D secure checks , you as a retailer are not responsible and wont be charged back - at least that how i understand it .

I am not so sure about that!!! We have had countless attempts where ALL details are correct and complete.


Too vigilant - well I dont think there is anything wrong with telephoning the new client, quite often they are impressed the seller is taking the time to call them. Of course if its a fraudster then they are very cagey as they fear their cover is blown.

 

[KateCB]

Wecall telephone number to speak witht he purchase if we are suspicious about an order; the 3D thig is meant to be an insuranc ethat if you have it available and it is used by the customer, then the liability shifts from YOU the supplier to the Card Issuer - thank fully have no had to pu it to the test.

On the subjec to email addresses, I have a gmail account for my private account, and again with telephone numbers - we have many customers who do not have a landline, just a mobile - my own brother is the same; he doesn't need/want/have use for a landline, so it can be a minefield trying to sort out who is genuine or not - we only had once case that got by us over 9 years ago, and we are very vigiliant now and customers have thanked us for checking, so it is worth doing. Customera that are unwilling to talk about their purchase/order become more suspicious in my eyes!

 

[4little1s]

Great thread. We have been caught out but are extra paranoid these days. Out of interest, what is to stop you from putting the details of the postal address out onto the Internet as a suspected credit card fraud address and the date? We have the details of an address etc that the Police are 'looking into' but if the address is out there on the Internet wouldn't that at least alert other online retailers to be extra careful if they get an order to that address as well ? Are you 'allowed' to do this ?

 

[LyndaSandick]

I probably have about 20 addresses received on fraudulent internet orders. If anyone is suspicious of an internet order, I am happy for them to pm me the address for me to check against the addresses we hold. I am all for us all helping each other. I wouldn't be happy however in printing the addresses anywhere due to possible repercussions. One of my previous posts shows the areas I hold addresses for.

 

[smellyskelly]

Sharing information relating to Fraud is currentlly a hot potato!

There is potential, if controlled, for this to benefit retailers and make Fraud very difficult indeed.

However, because of the Data Protection Act - Most companies are reluctant to become involved in this type of practice - they are too worried that if the information is not controlled correctly they could have serious financial penalties.

It is no longer legal to store data against an address, too many innocent people had poor credit score as a result of living in a house that was "blacklisted" through previous tenants. This is also true if you have any suspicions about an address.

Having said that - CIFAS fraud prevention ( http://www.cifas.org.uk )is a registered Organisation within the UK, it took off slowly in the late 90's but seems to be gathering pace. It is mainly dominated by companies offering credit, loans or leases, however, there is a small mail order section. Retailers such as Littlewoods, Grattons and Next are members.

The consumer can register there details in such a fashion that no credit can be authorised without speaking to them 1st and various Security Questions being answered correctly - it is a proactive system. There is an element of data sharing that happens between companies.

CIFAS works very closley with the National Fraud Office, the Data Protection Registrar and various other related Bodies.

Apart from that - self defence is the best!!!!!

 

[LyndaSandick]

What is frustrating is that we have received fraudulent internet orders requesting next day delivery. Fantastic...... ring the police........give them the address......catch the fraudsters red handed... easy. WRONG.... the police are not interested!!!!! The police have admitted to us that they are doing nothing with the information we are reporting. Frustrating, very frustrating.

 

[Jonpolygon]

Many payment providers are including the Verified by Visa and MasterCard Secure Code services. If the card is registered and the purchaser authorizes the payment with their card password then in most cases the seller is not liable for chargebacks.

We use PayPal for many purchases and have had chargebacks even though the purchaser has authorized the card using the password they have setup with Verified by Visa or MasterCard secure code. Thankfully PayPal were able to win these cases on our behalf based on the information we provided them and the unique authorisation code.

In some cases, especially where the card is not registered under one of these services, the odd fraudulent transaction can break through. For this I would recommend screening the purchases and looking for any tell tale signs, many are included above (IP address, Card Billing Address, Delivery Address, E-mail etc).

PayPal is geared towards helping those who send items via post and you can claim the items are sent and provide the proof of postage, however there are not many systems that work to protect digital purchases. Standard PayPal fraud checks are terrible if you ask me. We tried all the fraud filters but ultimately we were losing out on valid transactions. AVS checks were no good for us as we deal internationally and many countries do not support address verification, we simply use this fraud filter to flag up potential frauds.

In my opinion it shouldn't always be down to the seller, this is why I like the Verified by Visa and MasterCard Secure Code services.

One other service that comes to mind is IP address to card holder location checks. This basically works out where the purchaser IP address originates and then works out the card holders address and calculates the distance between the two. The further away they are the higher the fraud score. If the user is operating under an IP proxy then you will know about it and can decide to reject that particular transaction.

 

[gemd89]

• the telephone number - ensure your order form requests their REAL TELEPHONE number at the delivery address (no mobile numbers), if they can not provide this then cancel or at least delay that order.

Hope that helps others a little

How would i, a genuine buyer' get on then as i only have a mobile number, no landline number? I dont think that would be a definate spam, maybe you could have said ring the mobile number and confirm?

Gemma