Ecommerce Fraud Prevention
All ecommerce merchants deal with fraud eventually.
Over the past few years fraud has accounted for between 1-2% of all online revenue. In 2012 that cost e-retailers $3.5 billion according to CyberSource Corp. That's a lot of dollars.
Including major security breaches like the one Target experienced recently, fraud from identity theft alone accounted for 17% of all fraud in 2013, up from just 11% in 2010, according to LexisNexis.
But there's good news.
With basic diligence and an eye for the warning signs, fraud can often be stopped before it affects the bottom line. There are two basic approaches to combating fraud:
Don't allow fraudulent orders to be placed (preemptive)
Don't ship (or allow downloads) for orders placed fraudulently (reactive)
The first is difficult to do well, and there is always a risk that you will keep valid orders from being placed in the process. Because retailers do not want to risk alienating honest customers by unnecessarily blocking transactions, more emphasis is generally put on the second method.
A quick look at the preemptive approach: the most common way to keep fraudulent orders from being placed is to require that billing information matches bank account information on the payment processing level, and to decline the transaction if it does not. We'll focus more however on how to perform fraud checks on orders that have already been placed.
Here are some good steps to take to avoid shipping fraudulent orders or allowing downloads when there may be fraud in play:
1) Verify that the order was placed from the same location as the customer's billing and/or shipping address. Anytime the customer's IP resolves to an address that does not match the address they enter during checkout a red flag should go off and the order should be subjected to more intense scrutiny.
This is because a person using a stolen credit card will generally enter the card holder's billing address during checkout so that the order is accepted by the merchant's system, while using a computer in a different physical location, often times in another country.
To help PrestaShop users easily compare the billing address of an order with the location from which the order was actually placed, we recently released Order IP Address Verification v1.0. This free module, compatible with PrestaShop 1.3, 1.4 and 1.5.x displays a block in every back-office Order page containing all available address information associated with the customer's IP address including Country, Region, City, Zip/Postal Code, Time Zone and Coordinates.
2) Determine whether the billing address entered matches the one on file with the cardholder's bank. Depending on which payment processing service you use and what your account settings are, you should be able to determine if there is a match. Authorize.net even offers a Fraud Detection Suite that alerts you to discrepancies in order information.
There is another service, Reprisal.co, that aims to create a crowdsourced collection of data related to fraudulent orders so that businesses can take advantage of other ecommerce retailer's experience with fraud, in effect creating a 'massive, evolving blacklist of the people you never want to ship your products to' according to their website.
3) Matching Billing & Shipping information; although sometimes customers need an order shipping to a different address, like a gift for example, it's a good idea to take a closer look at an order where the addresses do not match.
4) Verify that the email address used to place an order is a valid address. A quick Google search of the email often provides info on whether it belongs to someone authentic or if it was created purely to place fraudulent orders with (ie. there's no record of the address anywhere on the internet).
If you think the order may be fraud and you can't find a record of the email address online, email the customer to verify that they are who they say they are.
Many times you'll notice that an email address is related to the customer's name in some way (ie. Bob Spade, [email protected]). This is a good sign, but not a guarantee, that the order is legitimate.
5) Always require a phone number during checkout. This way if there are any questions about the legitimacy of an order, you can call the customer to verify the transaction. If they answer your call and have never heard of your company, the order is likely fraudulent (unless they have children who like to shop online with mom's credit card!). And by calling you may find that you are alerting the card holder to that fact that their information has been stolen and used fraudulently, which helps them avoid further use of the card and gives you an opportunity to assure them that you will void the transaction before they or their bank can issue you a chargeback.
6) Consider time of day: for example, if an order has a billing address in New York but was received at 4:30am EST, you probably want to do some extra investigation.
7) Does address data look copy/pasted? A legitimate customers generally enters their own personal information accurately and consistently. If the format of an address looks copied from another source, entered incorrectly or does not match the format you would expect for that region, take a closer look.
8) Failed transaction attempts: one reason that our PrestaShop Payment Modules alert our customers to failed transaction attempts is that they are often a precursor to a fraudulent order. They are an indication that the thief has tried multiple stolen credit cards before finding one that works.
Above are some of the more technical and subtle items to check. Additionally, keep an eye open for the following which often times go hand-in-hand with ecommerce fraud:
Overnight Shipping is selected: the faster a bogus order is shipped and received, the less time there is to catch and cancel the transaction, and the thieves know this.
Multiple quantities of the same item: perhaps your business regularly gets orders for multiple items, but if not, take a closer look.
One or multiple high-value items, or uncommonly purchased items, are being ordered: obviously you want to sell the expensive and unique stuff, but the thieves also want the most bang for their (or someone else's) buck. Keep an eye for this one.
And that, friends, is ecommerce fraud prevention in a nutshell.