No announcement yet.

Preventing fraud without being too conservative

  • Filter
  • Time
  • Show
Clear All
new posts

  • Preventing fraud without being too conservative

    Hi everyone,

    I submitted this as a ticket as well, but though you all may be interested and/or give some advise too.

    I use Paypal website payments Pro as my CC processor. I received a large order last night and decided to verify it prior to shipping the products for my safety, as well as the CC owner's safety. Well, the phone number went to a fax, so I thought maybe a typo had occurred.

    So, I checked my transaction details and it was NOT eligible for Paypal's seller protection policy, supposedly because the address could not be verified. HOWEVER, the AVS data field contained a "Y", indicating address had been verified (at least the numeric portions). Virtually all of my sales are this way: Not eligible for the seller protection policy, but the AVS is “Y”.

    I called PayPal and there were no help, other than informing me that if I shipped the products, it was my full liability. So, I called AMEX and tried to verify the address, which they could not…

    So, all of this so far does not have anything to do with 3dcart, but I would like to know a few things:
    1. What is your opinion on AVS and is it a reasonably accurate means of judging an order’s legitimacy?
    2. Should I set up my PayPal account such that 3dcart WILL NOT accept an order unless I am covered under their policy? (which would mean that about 90% of my orders would be lost)
    3. Is this just a problem with PayPal that I should get away from by changing to a different gateway and merchant account?
    4. What do you suggest to maximize orders, but still be safe? Is there anything within 3dcard settings that I can do to reduce my vulnerability to fraud?

    Thank you,

    DBC - Your Total Choice for the Outdoors

  • #2
    1.) I don't pay a lot of attention to AVS at all. If the payment goes through I send the products (unless it's Nigeria or something like that)

    2.) No - that would be silly :-) You would be limiting yourself to PAYPAL members who have chosen to verify their address. You would miss all credit card customers who aren't paypal members

    3.) No - all merchant accounts would work the same. They can tell you what was or wasn't verified then it's your decision after that.

    4.) I think what you did was right. You questioned the order and did some checking.

    Did the customer give you a phone number? If so go to and click on the Reverse Lookup tab. Enter the phone number and see if it matches the Billing name/address.

    Are the billing and shipping addresses the same? If not and your really suspect something, find out who lives at the billing address and call them to verify the charge.

    I've been taking credit cards for at least 4-5 years and have not had a chargeback yet - but it's bound to happen sooner or later. I'm sure I'll be pretty upset when it does happen.

    I'm interested to see what others say.

    Good luck
    Cobweb Corner
    C Ekman
    Owner/Designer: Cobweb Corner


    • #3

      Thank you for the suggestions. I generally do ship products without too much question because my site settings do not allow an order where the billing and shipping address do not match. In addition, orders outside of the lower 48 are not accepted.

      What concerns me the most is not PayPal (I am sure they'll find any excuse possible to get out of liability), but the fact that AMEX could not verify the name to the address...

      I ran the reverse look up and the phone number does not go to the address listed and it is supposedly a landline...

      I have requested an updated address from the customer to verify it. If I do not hear back from them by Saturday, I'll cancel the order. It will be a $2,500 mistake if I do get a chargeback (~$1,400 chargeback and ~$1,100 worth of products). That is not something i can risk at this point.

      Thanks! - Your Total Choice for the Outdoors


      • #4
        For an order of that size then I think you're doing the right thing. I had someone order 50 badge holders last year and I thought it might be suspect. I called them and found out the address was for a hospital (they were for nurses). That one turned out fine - but I understand why you would question it. If the customer is legit they will answer your questions to your satisfaction. If not then you will be glad to avoid the sale. Good luck!
        C Ekman
        Owner/Designer: Cobweb Corner


        • #5
          Well, for a quick followup, here is what's going today:

          I recieved a chargeback request for an order two weeks ago that I did not dig into enough. Same kind of deal, order went through with no problems, AVS checked out OK, security code OK, billing and shipping address matched. I shipped the products and the package was re-routed at the time of delivery... This was an AMEX order too.


          I provided them with all of the documentation showing the order, AVS results, billing and shipping address as well as the tracking number. We will see what happens

          I have cancelled the order in question. If it was legit, I guess I lost a customer, but I cannot afford to loose double the order amount to try to get a customer.
 - Your Total Choice for the Outdoors


          • #6
            Wow - what a bummer. What do you mean that the order was re-routed? Let us know how it turns out - if you have all of the documentation that you did everything correctly - then I hope that the chargeback is denied.

            Good luck!
            Carla Ekman
            C Ekman
            Owner/Designer: Cobweb Corner


            • #7
              When the package arrived at the scheduled location, it was re-routed, apparently due to a change of address....
     - Your Total Choice for the Outdoors


              • #8
                I had a issue similiar to this a couple of weeks ago, and I also use Websites Payments Pro. I talked to someone at PayPal, and they told me that their customers (like you and I) who utilize Website Paymetns Pro are considered high risk. Thus no orders placed through our sites where the customer enters their credit card information are covered under their seller protection policy. The only way you would be convered under the policy would be if the customer actually pays through paypal (like through the their express checkout). She then told me that basically all I can do is use my best judgement, weight out the risk.

                The thing I find interesting about that is that they kind of advertise that seller protection is a benefit of using Websites Payments Pro, but it really isn't if it only applys to customers who actually pay through paypal because the vast majority of my customers at least pay though my site not paypal.


                • #9
                  Yes, I have noticed that only one of my sales have been covered under the policy and that is because they paid with Paypal.

                  I am curious to see how this chargeback turns out. I have a bad feeling I am going to have to eat it, which may be the end of the webiste.... I've been trying to decide to keep going with it or drop it (side business that isn't profitable yet). A $2500 hit will be a good reason to shut it down.
         - Your Total Choice for the Outdoors


                  • #10

                    Hello everyone,

                    I wanted to give you an update.

                    The chargeback fight was dropped by PayPal saying "This chargeback type is not covered under PayPal's chargeback policies." I suppose no type of chargeback part of their policy. Luckily I did have a brainfart earlier and I realized it won't cost me $2500, just $1100 (cost of products shipped)... Still a bummer though.

                    At any rate, I am now officially looking for another processor. It turns out PayPal's AVS is pretty much worthless (most services may be, I am checking into it.) This is what PayPal checks for a transaction authorization based on the few dozen calls and emails I have been a part of over the past few weeks. To authorize the transaction, PayPal checks the following against the CC company files:

                    Security Code
                    Expiration Date

                    They do NOT check the following:

                    Their AVS service checks the following against the CC company's files (AVS does not necessarily have to check out for the authorization depending on your settings):

                    First several (5 or 7 I think) digits of the numerical portion of the address
                    Zip Code

                    I learned all of this because I cancelled a suspected fraudulent order and the refund went to a person who did not place the order. When PayPal was questioned about this, they promised the refund went to the correct person. I then questioned why the transaction was authorized in the first place and I was informed the name was not something that was checked.

                    I want a processer who checks EVERYTHING. I ship ONLY to the billing address, so it shouldn't be a problem for these checks. Are any of you aware of anyone who provides this?

                    Thank you!
           - Your Total Choice for the Outdoors


                    • #11
                      In the eight years that we have had an online business we've gone through the mill with regard to credit card processors. We initially used Cybercash, which was bought by Verisign, which was bought by PayPal. When PayPal took over, some of the services that we used to get for free became a paid service. We didn't realize that at first, and after a couple of fraudulent transactions (not NEARLY as bad as you've experienced) we had to do the upgrade. As you state, they only checked the basics--when you upgrade to their next level, however, you can determine which items you want them to check. We have it set to reject any card that doesn't have an address, zip code, and CVS code match. I don't know any that match name.

                      In the past, we've been told by both Verisign and our merchant bank that even if you have a fully cleared card, delivered to the billing address and signed for by the customer, it still doesn't matter. All the customer has to do is state that they didn't place the order, and they didn't sign for it--actually had that happen. All we could do was to wish the bride all the worst and let karma do it's thing. :(


                      • #12
                        Seems like there is more safety coverage for the customer, but nothing for the business. I realize that in a lot of cases customers get screwed by companies. I have had this happen to me on several occasions. And yet at the same time, since being in business it seems that I have had customers who go out of there way to try to screw me too.


                        • #13
                          Thanks for the information.

                          I am looking at my payment statistics because I am so frustrated with PayPal (not only about the chargeback, but with their customer service as well) that I want to switch processors. However, I have analyzed the statistics and while I do not have a huge population, hopefully I have enough to make a reasonable decision.

                          Here are my payment method statistics based on revenue of completed (not fraudulent) orders:

                          VISA/Mastercard: 62%
                          AMEX/Disc: 10%
                          PayPal: 28%

                          These numbers are based on dollar amounts, not the number of uses for each payment method. I did not realize until now that PayPal payments account for 28% of my business. This is slightly skewed because one of my largest sales has been paid for with PayPal. Payment method statistics based on number of uses is as follows:

                          VISA/Mastercard: 79%
                          AMEX/Disc: 8%
                          PayPal: 13%

                          Of the 3 fraudulent (or suspected fraudulent) orders I have had, I have cancelled two and eaten 1. Two of the three were placed with AMEX...

                          Based on this, I am willing to drop AMEX and Discover if needed. I hate to lose 10% of my business, but many of the merchant accounts do to work with AMEX or Discover.

                          I am looking at a few options:

                          1. Stay with PayPal, but use their advanced risk controls (looking into effectiveness and cost)
                          2. Emerchantsgroup, which has the lowest fees, but cannot accept AMEX or Discover (unless they consider my PayPal account an existing AMEX and Discover account)
                          3. Bankcard Services (3d Carts recommendation). Fees here are a little lower than PayPal, but not as cheap as emerchantsgroup. Also, I’ll have to find a gateway, which will probably offset the lower fees. There is also a 3 year contract that seems a little long.

                          I still have to research option 2 and 3 for risk controls. Whatever I do, I need to have the option of setting STRICT risk controls. I cannot afford these huge chargebacks.

                          Anyone out there use emerchantsgroup or Bankcard Services? If so:

                          • Are you pleased with the service in general?
                          • What risk controls are offered?
                          • What are the main advantages you find in the service?
                          • What are the main disadvantages you find in the service?

                 - Your Total Choice for the Outdoors


                          • #14
                            try google checkout. here is their page about fraud


                            second, get on / cybersource and use their avs tools. bank of america set us up with 1.88% rate for online transactions which i think is very competitive.


                            • #15
                              What's kind of funny about that is I've been in business for almost a year and a half now, and I have had 2 fraudulent issues, but within the last couple of months. At anyrate, they were both with AMEX too.

                              I also use paypal btw.