Foiling credit card fraud
How happy your company's holidays are may depend on
your vigilance when it comes to credit card transactions.
Consumers who fall prey to credit card fraud generally
are responsible only for the first $50 illegally charged. Merchants
who accept the false charges, however, are on the hook to the credit
card company for the remainder of the bill -- and it's a big one.
Estimates of how much companies lose each year to credit card fraud
run as high as $2 billion.
And the cost to companies doesn't end with the price
of the products. There's also the chargeback fee, usually around
$15 to $25 per incident. If your company ends up with a lot of chargebacks,
don't be surprised if your card fees go up.
So how do you keep from being left holding the bag,
and we're not talking Santa's gift sack here, when it comes to credit
card charges? Here are some ways a business can foil fraudsters.
First, familiarize yourself -- and your employees -- with situations
that might indicate a credit card is being used fraudulently. Some
sales that might set off alarm bells instead of cash register cha-chings
- A first-time shopper. Criminals usually
hit a merchant once and then disappear.
- Larger-than-normal orders. If someone's
going on a shopping spree, it may be because the buying binge
is on a stolen card or card number.
- Orders consisting of several of the same item.
Maybe Aunt Mary really did decide to get everybody DVD players
for Christmas or maybe it's a thief trying to buy as much consumer
electronic equipment as possible so he can sell it quickly for
a tidy profit.
- Orders shipped to a single address but made
on multiple cards. These could be legitimate orders, or they
could be purchases made from a batch of stolen cards.
When you encounter any suspicious credit card purchases,
then it's time to check them out. For most businesses, a good starting
point is a fraud triage system.
Since it costs money to investigate orders, you need
to establish a cost-effective way to examine orders. Your company
won't want to scrutinize an order for an $8 book as closely as it
would the purchase of a $500 pair of skis. Plus, crooks are more
likely to order high-ticket, easy-to-sell items.
When the purchase is made in person, you generally
can depend upon the verification process recommended by the card
companies. Compare card and charge slip signatures, get electronic
authorization from the credit card company, check the card's expiration
In the case of expensive sports equipment or costly
consumer electronics gear, your company order takers may do well
to verify the transaction by calling the home phone number of the
person placing the order.
"If you follow the rules to the letter the chances
of a chargeback are low," Ken Ragan, executive vice president
of Missouri-based Commerce Bank N.A.
Get your MOTO working
Policing against fraud, however, gets harder with off-site purchases.
Most businesses routinely accept mail order-telephone
order, or MOTO, transactions. A growing number also encourage Internet,
or card-not-present, orders. In these cases, a company can't examine
the card or run it through a card reader to get an authorization
code. However, there are ways to minimize its risk.
With large or expensive MOTO and online orders, your
verification process is critical. "If somebody orders something
for $10, you won't want to do an in-depth investigation, but if
they order a fur coat or a diamond ring over the phone or the Internet
you will want to verify that order," Ragan says.
Start by only processing complete orders. That means
that all blanks are filled in: the person's name, billing and shipping
addresses, e-mail address, phone number, credit card number, expiration
date. Collection of all this information gives you ways to verify
and authenticate the order. For example, a missing expiration date
may indicate a counterfeit card or unauthorized use.
Make sure that everything adds up. For example, if
the phone number listed is for a different state than the credit
card holder's billing address that should be a red flag. Also be
wary of customers who buy multiples of expensive items and don't
seem to care what color or size they come in. Normally, consumers
care about the size, shape or color of an expensive item; somebody
who plans to simply resell what are in essence stolen goods won't
care. And rush orders, while often legitimate, could be a sign that
a con artist is at work.
If your company has a Web site, consider not accepting
orders from free e-mail addresses, says Neal Rawls, a Florida-based
security consultant and co-author of Be
Alert, Have a Plan: The Complete Guide to Protecting Yourself, Your
Home and Your Family. It can be next to impossible to trace
an order placed by someone using a free e-mail address. In addition,
it's easy to set one up in any name.
"I actually use a free e-mail service, but if
someone questioned me, I'd gladly use another e-mail address to
place an order," Rawls says.
Don't accept international orders. They can be hard
to verify. For example in Eastern Europe, there's a brisk traffic
in credit card numbers illegally obtained on pornography sites based
there, according to Rawls. These stolen credit card numbers then
get used to buy goods.
Utilizing outside help
Sign up for the Address Verification Service that most major credit
card companies offer. Merchants who use the AVS get billing addresses
verified at the same time they get authorization to process and
approve a charge.
Verify shipping and billing addresses. Do they match
the credit card holder's address? This can be tricky because during
the holidays people buy presents, which get shipped to an address
other than the cardholder's. Still, if you have any doubts, verify
addresses by using the AVS service provided by the credit card companies.
The credit card issuers also offer ways to double-check
charges. For example, if you have doubts about a Visa purchase,
perform a CW2 validation, which simply means getting the three-digit
security number that's printed on the back of Visa credit cards.
According to Visa's Web site, "Merchants that perform CW2 validation
for card-not-present transactions as part of their authorization
procedures can expect to reduce their chargebacks by as much as
26 percent." Retailers accepting Visa cards also can ask for
a Code 10 Authorization, a service that the card company provides
so that your authorization center realizes you have concerns about
an order. Other major credit cards offer similar added-verification
But don't depend just on the card company. If an order
sets off alarm bells, ask the customer for additional information,
such as day and evening phone numbers or the bank name on the front
of the card. You also can separately confirm the order with the
customer by sending a note to his or her billing address, rather
than the ship-to destination.
Another way to check on a purchaser is to call directory
assistance and see if the number you get there matches the one on
the order, says Commerce Bank's Ragan. If it doesn't or you still
have doubts, dial the number and check with the person to make sure
they ordered from your company. That's what Ralph Wilson, a Rocklin,
Calif.-based e-business consultant, does: "Whenever I'm in
doubt, I e-mail or telephone to verify the identity of the purchaser."
And you can always sign up with an anti-fraud group.
There are several associations you can join, some free, others for
a fee. They offer tips and advice. Some even provide databases of
stolen card numbers or other more in-depth services. Popular sites
include: AntiFraud.com, Internet
Fraud Watch, Merchant
Fraud Squad and Merchant
These steps can help your company have a merrier and
more profitable holiday. They'll also help increase your revenue
and decrease your losses no matter what the season.
But remember that it is impossible to completely reduce
fraudulent credit card transactions. "All you can do is decrease
the odds you'll be taken," Rawls says. "You can't eliminate
Jenny C. McCune is a contributing
editor based in Montana.
-- Posted: Dec. 4, 2002