Block Individual from Ordering, block IP, something

[jonsweaver]

Hello
Second time that a crook in Africa has ordered with a fraudulent credit card. Talking tot he credit card company, they said our store software should have a way to block an individual from ordering. I checked documentation & searched the forum.
Is there a way to block an individual from ordering?

Basically we now have procedures for crosschecking the order, but still are charged the credit card processing fee for a large fraudulent order.
Any ideas? Thank you SC!

[Jamie]

You shouldn't be charged processing fees for voided orders. I would always recommend you set your gateway to authorize only, and check every order manually before capturing the funds. If you see a fraudulent order you can void it before it goes to settlement.

We don't have features to block customers from ordering. That is not possible. There is no way to uniquely identify a person on the internet. You could try blocking their IP address in your web hosting control panel, but IP addresses will often change.

Most payment gateways offer fraud filters to help reduce fraudulent orders, with the option to set thresholds for when you will and will not approve a transaction.

[jonsweaver]

Thanks Jamie!

I will check this set-up. This is possible with their volume.
"I would always recommend you set your gateway to authorize only, and check every order manually before capturing the funds. If you see a fraudulent order you can void it before it goes to settlement."

I don't understand why the processor doesn't mention this and instead claims that it is the software's job. Maybe my client talked to his creduit card and not the processor - hmmm? "Most payment gateways offer fraud filters to help reduce fraudulent orders, with the option to set thresholds for when you will and will not approve a transaction. "

Question - Isn't a credit card supposed to be denied when the number and the billing address doesn't match? And it is the processor that should be verifying that?

Thanks JON

[jonsweaver]

Changed the gateway setting to AUTH_ONLY.
I think that is an excellent recommendation.

Are there resources that compare the various gateways, fees & percentages, quality of customer service?

Thank you JON

[Jamie]

Isn't a credit card supposed to be denied when the number and the billing address doesn't match? And it is the processor that should be verifying that?

Not necessarily. The card issuing bank can decline a transaction if the address info doesn't match, but that doesn't happen very often (the decline part). Usually, AVS (addres verification system) will return information about whether or not the address info matched. Cards from some countries won't return any AVS information so it is not 100% reliable.

When AVS info doesn't match, we can't do anything about it. Usually the gateway will have settings you can control to tell it what to do when the AVS info doesn't match. I would never recommend not accepting all transactions that have wrong AVS info. It is very common for that info not to match. People move all the time, or may enter a personal address when they should enter a business one.

I would recommend looking at a combination of things, including AVS info. If AVS matches, you should also make sure they are in a location close to that address. You can do that by copying the IP address in your order notification email and pasting it into GeoBytes:
http://www.geobytes.com/IpLocator.htm

That info is not always 100% reliable, but it is pretty good. If they say they are in Virginia and their IP is in another country, its fraudulent.

If you find an order questionable but can't quite deem it fraud, do some further checking. Google the info they gave you, name, company name, street address, email address, etc...

When all else fails, take a look at their phone number and call them to get a verbal confirmation. I've gotten orders with perfect AVS matches, and an IP address not close to the card holder's address.

Are there resources that compare the various gateways, fees & percentages, quality of customer service?

I don't have any, but I'm sure there are some out there.

[jonsweaver]

Thank you for this helpful info & perspective. JON

[Beery_Asst]

Just about every store is going to get hit with fraudulent orders. I see them all the time. When anything out of the country hits my store, I am very dilligent about it as your recourse for legal action is very slim. Even then, I have them use PayPal for payment and demand it be with a PayPal account that has been verified through their banking institution.

Since you did set Authorize Only, then the only fee you should get hit with is the approximate $0.30 cent fee to run the card, not the 2 to 4% fee for depositing the funds, and another 2 to 4% fee for returning the funds later if you are forced too.

I used to shop at one website until I discovered they had a security flaw. Somehow, someone was accessing their customer database and they had stored credit card numbers.

They had then taken those names/numbers, and processed them on a second website that was taking contributions through a very simple setup. They were trying to determine what credit cards were still good with a small $2 charge. The non profit ended up having to return each of the thousands of $2 charges, they were assessed with the $0.30 transaction fee per contribution for each transaction, plus the extra ~3% fee on the total, twice. Once for depositing, once for returning. They lost quite a bit of money.

Beery

[jonsweaver]

Thanks Beery.
Ouch for that unfortunate nonprofit.
This client is kind of taken by surprise & creating better policies for checking orders.
Has been on SC for several years & not had fraud.
All good things to learn. JON

[Beery_Asst]

I haven't been bit yet with a bad order because I am pretty dilligent. I've also lost some sales being conservative. I carry products that can run upwards of $7K, and lose one of them on a bad transaction is not good on the pocketbook.

Every month, I get someone writing to me asking if I accept Visa, Mastercard, or American Express credit cards despite it being very clearly displayed on my website. That's another good sign someone is fishing for gullible people.

I knew it was a fraudulent customer, but I still kept him going as if he was working with me, he wasn't spending the time to trick someone else. He ended up placing a $16K order and wanted me to send him the total weight, so he could have his guy pick the order up. That's when I finally ended the communication with him as I am sure the next step would have been him sending/processing more money than the total cost, giving cash to his pickup guy, and losing both the order and extra cash.

Beery