Online fraud catchers -- protecting you, but
maybe also getting your card turned down
By Holden Lewis • Bankrate.com

The biggest online retailers sniff you out when you try to buy -- and if they suspect fraud, they sometimes cancel the sale and don't tell you why.

In fact, a retailer might advise you to contact your credit card issuer, even though the fault lies not with the card, but with fraud-screening software that tags you as a potential cheat.

Sometimes you have to ask the retailer persistently to discover that you've been fingered as a possible crook, misrepresenting your identity.

To reduce the chance of rejection at the online checkout, it pays to use just a few credit cards online, make sure your name is spelled the same on all your cards, have items shipped to your billing address, and refrain from pranks such as registering your name on a retail Web site as "Mick E. Mouse."

It's also not a good idea to share your credit card for online purchases -- letting Junior buy CDs that are sent to him in his name but billed to you, for example.

Jon? John?
Jon Piot learned about fraud-screening programs the hard way. He tried to open a PayPal online-payment account in the summer of 2000. After entering his personal information, including a credit card number, he received an e-mail from PayPal telling him, "We were unable to verify this credit card." It suggested that he check with his credit card company.

The issuer of Piot's MasterCard said everything was fine. And Piot used the same card to sign up for an account with Billpoint, a PayPal competitor. Worked without a hitch.

Trying again to register with PayPal, Piot "pulled out any MasterCard, Visa or debit card I had," with no luck. He didn't know it, but he was in a hole and every time he tried to register with another card, he was digging himself deeper.

Finally, after posting to a message board devoted to PayPal, Piot discovered that a little-known company called CyberSource was probably behind his troubles. He got in touch with a PayPal customer-service rep and asked about CyberSource by name. He learned that, indeed, CyberSource had flagged his application as risky, possibly fraudulent.

What went wrong?
What caught CyberSource's attention? That Piot had "two or more name changes in the past six months" and that he had "used more than five credit cards in the past six months."

Piot thinks the bit about name changes might be a result of registering with different variations of his name on various sites: Jon Piot here, Jon C. Piot there, jpiot somewhere else. And maybe a database somewhere has his name misspelled as "John." Piot says he uses just a couple of credit cards online, and that he thinks he got tagged for multiple use of credit cards when he tried to register with PayPal using all those other cards.

CyberSource, based in Mountain View, Calif., counts some of the most prominent online retailers as clients. They include WalMart, Barnes and Noble, CompUSA, Nike, Saks and the Home Depot. Its main competitor is San Diego-based HNC, whose clients include Sears.com. PayPal developed their own antifraud service to handle their clients.

These antifraud services kick in when you click the "Buy" button on a Web site. Information such as your name and address, credit card number and what you're buying is transmitted to the antifraud service, which computes a fraud score in about one second and sends the score to the retailer. CyberSource's scores range from 0 to 99; the higher the score, the more likely that the buyer is misrepresenting himself.

Retailers set their own thresholds, so that a score of, say, 50 could mean a canceled sale, or a score between 40 and 60 would put the sale on hold until the buyer calls customer service to confirm his or her identity. The retailer sets these cutoff points and is free to change them -- during Christmas shopping season, for example, or when too many valid customers are being turned away.

What gets checked
CyberSource and HNC compare name, address and card number information to see if they match, and then combine that with knowledge of a customer's purchasing history and the alchemical computer wizardry of "neural networks" to arrive at the fraud score.

This isn't credit scoring, explains Jeff King, CyberSource's director of product management. Rather, it is a method of gauging whether you are who you claim to be.

"It doesn't look at what your past payment trends were, or the dollar amount of the transaction," King says. "What it's looking at is the Internet data from the browser, the environmental variables, the data the consumer has put in, the data that the retailer has put in."

Among the factors CyberSource looks at:

• Whether a card has been reported stolen.
• Whether it has been reported misused at another Web site.
• The number of transactions on the card in the last few minutes or hours.
• Where the buyer's computer is.

Someone using an American credit card on a computer logged onto a Russian Internet service provider would raise red flags.

The software also looks to see whether you have typed nonsensical information (such as an obviously made-up name) or obscenities in the online order form. And if the name on an order form (even if it's a family member) doesn't match the name on the credit card, that might add points to the fraud score.

Insult rate vs. fraud rate
It's important to weed out impostors and cheaters, but it's equally important to reduce the number of legitimate shoppers who are turned away unnecessarily.

"We call that the insult rate," King says. "The entire goal and mission is to keep the insult rate below 1 percent and the fraud rate below 1 percent. It is possible to do, but it takes careful control and monitoring of the system."

But it's difficult to maintain this balance.

Criminals find it easier to perpetrate identity theft and credit card fraud online than in person, so that's where they go. Some experts estimate that an online credit card transaction is 10 times more likely to be fraudulent than a transaction in a store. Online retailers -- and not credit card companies -- take the loss in a fraudulent transaction, so the stakes are stark: Reduce fraud or go out of business.

-- Updated: Dec. 2, 2002