With the recent state of the world’s economy, the industry is seeing an increase in fraud . Traditional fraud methods continue to be prevalent but there is also an increase in “friendly fraud”. With the Holiday Season in full bloom, fraudulent activity will be more apparent now than ever.

ACFE President James D. Ratley, CFE, said that the support of organizations around the world helps make Fraud Week an effective tool in raising anti-fraud awareness.

“Fraud continues to be a serious problem, and the state of our economy requires all organizations to be even more vigilant,” Ratley said. “Once again, we want to say ‘thank you’ to all of the Fraud Awareness Week supporters for helping to shine a spotlight on the urgent need for fraud prevention and detection.”

Not only is it important for businesses to be privy to internet fraud scams, but it is equally important for consumers to understand the risks and to learn what to look for when shopping. See this article, as I feel it provides a needed level of awareness for consumers.

According to the National Retail Federation, nearly half of consumers plan to use the Internet to purchase holiday gifts this year. But these shoppers need to be aware and prepared for a very real concern when surfing the Web — online fraud.

The internet provides a convenient outlet for additional shopping. The other side of that, of course, is that the internet also opens new opportunities for unlawful activity from all corners of the globe.

My hope is that this week of Fraud Awareness will turn into a daily awareness of the risks of, and opportunities for selling and buying on the internet. Be aware of some of the issues we discussed in this week’s articles in addition to our ongoing efforts of mitigating risk.

If you, the supplier, find an instance of fraud on your account that we missed, please cancel the transaction but also make us aware of the order. We analyze our data closely, and the more data we have, the more successful we will be at separating the good orders from the bad in the future.

On behalf of our Fraud & Disputes Department, I would like to wish you a happy and safe selling experience during this Holiday Season.

Sebbe

While it is important to mitigate fraud, you want to be sure that you are not inadvertently denying legitimate business. With the current credit card system in place, we are not as protected as a traditional retailer is. Because we are working in a “Card Not Present” environment, chargebacks will occur. We have found on average, 12% of your orders may appear to be suspicious, but only 1% will end up being fraudulent. It is very important that you don’t insult the 11% legitimate customers just to catch the 1% fraudulent customers. While working with digital products, losses are less formidable because there are no shipping fees and no items to be lost. The following information will help you to differentiate between legitimate customers and fraudsters.

Our vendor administration area has many pieces of information that should receive consideration when fulfilling an order. Among the information you should be taking note of is the amount of the purchase, the credit card used, the AVS and CVV responses, the language of the sales page, name, email, billing address, and IP address. When reviewing an order, be sure that the amount of the sale makes sense with what is being purchased. If a customer places multiple orders in a short period, pay attention to the card being used for each sale. If you notice many transactions being placed with multiple credit cards, this is a possible indication of fraud. American credit cards have built in security features such as AVS (address verification system) and CVV (security code on the card). Although our system captures this information, it is not always 100% accurate. You should not depend solely on these two pieces of information, as we can receive inaccurate responses. People move and the security code can be rubbed off the card. You should not base your decision on these two pieces of information alone. Use this information in conjunction with the other tools available to you to make your determination.

The information on the sales page can tell you a lot about the customer as well. The name, the email address, the language of the customer, the IP address, and the billing address should have some continuity. If you notice discrepancies between the IP and billing address, this can be an indication of fraud. Likewise, if you notice discrepancies between the name, email address, and language of the customer, this can be an indication of fraud. Keep in mind that in today’s world of business, it is common to see discrepancies between these pieces of information. Please consider all of this information when you receive our fraud review. We strongly advise that you do not fulfill services until receiving our review. Unfortunately, we cannot guarantee that our review is 100% accurate. You know your business and customers better than we do, so it is important that you review the orders as well. If at anytime, you feel that we have made the wrong decision, or you would like a second opinion, please contact us and we will be pleased to conduct a manual review.

2Checkout has matured with the evolution of fraud. We continue to compile various tools for you to use. Utilizing the tools available to you can help differentiate between fraudulent and legitimate orders. As long as you consider all the information when fulfilling services, you should be able to mitigate losses due to fraud. The importance of keeping your insult rate low cannot be overstated. Allowing legitimate business is far more important than catching every fraudster. You can contact us 24 hours a day 7 days a week. We are here for you.

By Jamal and Nathan

A vendor selling PC to Phone services was being targeted by a fraud ring. This type of fraud is very tricky to catch. The orders appeared to look legitimate. The card BIN, billing addresses and I.P. addresses all matched. What tipped off the fraud analyst to further investigate this, was the spelling of the customers’ names, name placement, and the frequency of the orders. Most orders had a French I.P. address, but there was one with the I.P. of Côte d’Ivoire. This one mistake led us to believe this was fraud coming out of Ghana. Using some deeper methods of fraud detection such as Device Identification, we were able to connect the orders to each other.

Intervention:

• We added the vendor account to our Fraud Monitoring program.
• The Fraud Monitoring Program is a program developed to provide a magnified look into the account. We monitor vendor accounts who receive fraudulent orders regularly missed by our internal-automated Fraud System. Accounts that we see fraud chargebacks come in where the system approved the order/s. Representatives within the Fraud Department are assigned a list of accounts where they check the account daily, review the last day’s worth of sales to ensure the Fraud System didn’t approve orders it shouldn’t have. In the cases where we do find a fraud order approved by the system, as long as we are monitoring daily, we will have caught it within 24 hours. We can notify the vendor, and take corrective action. This provides an additional level of protection for our suppliers.
• The orders that are determined fraudulent are canceled before the funds have a chance to deposit.
• Weekly reports are generated and shared between the account analysts and supervisor to determine the program’s success and what other steps should be taken.

Results:

• We caught fraudulent orders that were previously approved and canceled them. We added those orders to our negative database. Adding the information attached to the order allows us to manually review new orders with identified fraudulent information. This process makes it harder for the fraudster to make repeat purchases using the same information.
• Creates a barrier from the fraudsters targeting one vendor with multiple orders with different information.
• Lowers the Vendor’s fraud chargebacks
• Frustrates the fraudsters into moving on.

Nicole and LaShona 2Checkout Disputes Team

Types of customers and fraud:

With all new vendors, we must start from the ground up. From the moment our partnership begins, we attempt to assess what types of customers our vendors will be receiving. For the purpose of this study, we reviewed one of our new vendors and will now refer to them as “Supplier A“. In the case of Supplier A, several discrepancies were located in each order placed through their system. We noticed discrepancies between the billing information and the IP addresses, as well as discrepancies within our internal tools. While not unusual to find orders with these types of discrepancies, we did find that each new order placed had very similar discrepancies. This made it appear that the same person or group was attempting to circumvent the fraud review process and get by undetected. When we noticed such a large percent of Supplier A’s orders with these same discrepancies we then proceeded to take a higher level of caution with all new orders reviewed. It appeared that the trends changed slightly, receiving orders with matching billing addresses and IP addresses but suspicious email addresses as well as substantial and consistent discrepancies within our internal tools. This may have been the work of the same person or fraud ring placing the original orders, but it is also possible that the vendor was being hit by other fraudsters.

Fraud types and the likelihood of fraudulent activity:

Supplier A is providing a virtual private network or VPN service. A VPN service is both an intangible service and easily accessed long before the legitimate cardholder is likely to notice this fraudulent transaction, making this service a prime target for fraudsters. Knowing that this service is highly likely to attract fraudulent activity, we will be more prepared and inclined to contact the customers to provide a more in-depth review of the customer before reaching a conclusion.

Friendly fraud:

Unfortunately, everyone is at risk of friendly fraud. A VPN service, however, is less likely to receive this type of fraud than a vendor providing a product or service of a more personal nature such as dating or adult products. Friendly fraud is also the most difficult type of fraud to catch, as the correct information is generally listed on the order. The customer is more likely to report this as fraud if they do not recall the purchase or issuing a charge back instead of requesting a refund. Suppliers should keep records of the order, communicate with the customer, and save any other pertinent information to aid in disputing these charges when the time comes.

How can we minimize the risk to the vendor and the overall results?

The best advice that we can offer to any vendor is to be proactive with their own orders. Review any order, even briefly, to look for discrepancies listed on the vendor page or the information listed within their own system that we may not be able to access. If a vendor is suspicious of an order due to the discrepancies they find, or for any other reason, we encourage them to research it further. One of the most readily available tools around is the internet, and there are several helpful tools that are free for anyone to use. Google maps will help you know if the address listed is a home, business, or even an empty field thanks to the satellite images. The directions feature is also quite useful, letting you plot the distance between the billing address and the IP location. An IP location 500 miles away from the billing address tends to be a bit more suspicious than one within 50 miles. Another useful tool is whois domain tools this lets you check where an IP is coming from or search on an email domain to find out additional details. Is this an established business that has been around for years, or was the domain just created recently to appear legitimate? There are countless tools available to anyone if they wish to search for information about a customer. Our vendors are also more than welcome to contact us by emailing fraud@2co.com through our ticket system or by calling 877-294-0273 to express concern. We will take an additional look into the order with any new information provided. Once a vendor is aware of the types of fraud that they receive, they are more likely to understand and locate the types of fraud that they may be getting.

The world of fraud is ever changing and while we would like to say that we can prevent every instance of fraud, this is unfortunately not the case. Only by working together will we be able to provide the most effective protection.

Mike and JR – Fraud Department

All types of e-commerce companies have dealt with friendly fraud at one time or another. Within the past few years there has been an increase in deliberate friendly fraud. There are a few factors that have contributed to the rise in deliberate friendly fraud; such as the shape of the economy worldwide, individual financial situations, and consumer’s knowledge of how to take advantage of the banking system. Unfortunately, the economy can impact a person’s financial stability which can cause this type of deliberate fraud. What someone can afford today, they may not be able to afford tomorrow. This can lead them to drastic measures to hold on to any funds they have.

Another type of friendly fraud are fraudsters that regularly manipulate the system to get their products for free. Since these fraudsters are constantly finding new ways to use the system to their advantage, there is no real way to avoid this type of friendly fraud from happening. Basically the only thing that can be done is to try to protect your business as much as possible.

Accidental friendly fraud is when the consumer mistakenly disputes a charge and doesn’t take the incentive to rectify the situation. In many cases it can be helpful to contact the customer directly to give them additional information about the charge and the product or service that was purchased. Accidental friendly fraud can be easily fixed. Once the consumer realizes they made the mistake, they remedy the situation. The following suggestion may help to avoid this type of friendly fraud. If your business uses a reseller, a payment processor, or any type of third party billing service; such as 2Checkout.com, PayPal, Clickbank, WorldPay, or Google; it is very important that your customers are aware of this. Placing this company’s information on your website and on your receipts will help customers recognize the charge on their billing statement. An additional feature available to 2Checkout.com suppliers is the use of a “soft descriptor”. Each supplier can enter their own “soft descriptor” to be included within the description sent to the credit card companies when a credit card is billed.

With all of this in mind, before you send a product or provide a service to a customer, make sure you know the customer. If you don’t know them or are skeptical, use the tools on the internet or any other tools made available to you in order to screen the customer. You may request that the customer fax information to you such as their photo ID or a utility bill. Additionally, you may contact the Fraud Department to request that 2Checkout.com require additional documentation from the customer before providing the item(s) ordered.

These preventative methods may lower the chance of receiving a fraud related chargeback. However, even with doing all of this, there is really no way to predict cases of friendly fraud. It is a good idea to prepare your business for these special cases. The best way to prepare is to keep all documentation about the customer, the product/service that was provided, and any contact you have had with the customer; as these may be needed to challenge a chargeback. Some examples of documentation you should retain are:

• Proof of Successful Download
• Proof of Product Usage (Login, IP, etc.)
• Signed Terms Of Service/Contract
• Signed Proof of Delivery/Delivery Confirmation
• Tracking Pictures of Shipped Products
• Detailed Description of Product

Since there is no real way to stop this type of fraud from happening, a good business practice is allocating funds to offset any possible losses due to all types of friendly fraud. This can help ensure your business continues to grow while you are trying to recoup the loss of funds from the chargeback. All online companies spend time and money looking for fraud, but fewer companies spend enough time gathering the information required to fight friendly fraud. As this is “Fraud Awareness Week” we decided to take this opportunity to remind you that friendly fraud is out there and can negatively impact your business. With all of this information, you can be better prepared to fight friendly fraud.

Amanda and Leona – Disputes Department

“This weeklong campaign encourages business leaders and employees to proactively take steps to minimize the impact of fraud by promoting anti-fraud awareness and education.”

Share your ideas with us this week in a series of articles that will help define different types of fraud, highlight 2Checkout’s role in fighting fraud, and what we can all do to reduce the amount of fraud. By working together and communicating our ideas we can make online shopping safer for both customers and merchants.

One aspect of 2Checkout’s fraud prevention that we’ve mentioned – but not discussed in depth, is our ability to tailor our fraud protections to suit your individual needs. While our normal fraud procedures provide sufficient protection for the majority of our vendors, from time to time a more tailored approach is helpful. Do you ever feel that we are flagging too many valid orders as fraud? Do you ever feel that your product attracts more fraudulent consumers than you expected? We are happy to work with you and offer suggestions to help reduce fraud and allow good sales.

These strategies may be as simple as changing how we review orders for your product or service. It may also be suggesting simple wording changes in your product explanations on your website. We have been doing fraud prevention for nearly 10 years; let us work with you and show you how effective we are.

In yesterday’s blog Fighting Online Fraud with 2Checkout’s Sebbe Jones, Sebbe discussed how 2Checkout developed a sophisticated fraud scrubbing process, over a number of years, by intimately learning the mitigation process, through the manual examination of tens of thousands of orders the first few years of 2Checkout’s existence. Through hard work and innovative thought, 2CO developed a world-class fraud scrubbing process, but “the times were a changin’.” Each year, fraudsters were becoming more advanced and organized and 2Checkout’s volume of sales was increasing at an amazing rate. It was all his staff could do to keep up with the increased volume of sales and fraudsters.

Then dark times hit. When 2Checkout switched its system from Version 1 to Version 2, the sophisticated fraud queue was errantly left out of the upgrade. Years of work were wiped out in an instant. Sebbe and his staff endured a two-fold increase in manual order checks. The days were growing long, fraudulent transactions were on the rise and something had to give. — (Back to Sebbe’s story)

Taking Fraud Fighting to the Next Level

To say the least, vendors were not happy. 2Checkout was not happy. Customers who had their orders denied were not happy. 2Checkout had to do something to right the ship… so we did.

Following this misstep, we joined the MRC (Merchant Risk Council). We attended their annual conference, talked to the giants in the industry to learn best practices, and quickly discovered that if there was ever a company out there who could help us get our fraud prevention back to a manageable level it was 41st Parameter. Read the copy on their “About Us” link, as it sums up their services very well:

As leaders in fraud intervention, 41st Parameter’s innovative solutions help you protect your customers and your brand, reduce fraud losses and make the Internet a safer place to conduct business.

Through a combination of best practices, leading technology and human interaction, our innovative solutions provide an unprecedented level of Internet security, decrease the anonymity of the Internet and help you gain valuable insight into every online transaction and customer interaction.

We make the process of preventing and detecting Internet fraud easier and more effective, reducing both expenses and potential losses.

In August of 2005, 2Checkout integrated fraud mitigation services and software from 41st Parameter. The progress and improvements that have come from this integration are undeniable. Our review rates reduced from 45% to 15%. Our chargebacks-to-fraud ratio reduced from over 1% to less than 30 basis points. In addition, we gained access to additional investigator tools and a more knowledgeable staff due to a clearer picture of the elements that go into world-class fraud scrubbing.

41st Parameter provides 2Checkout with a full user interface of over 300 algorithms (or rules) that help us detect fraudulent activity. The ability to recognize fraud when it happens provides us the ability to recognize positive transactions as well. We have a robust negative list of which I referred to in Part One. The same goes for our positive list. There are velocity rules that tell us if multiple orders have been placed in a short period of time. There are so many tools and algorithms put in place in the 41st Parameter suite of software. In fact, I cannot discuss a majority of them.

Simply put, today, we use a state-of-the-art software package managed by a leader in the fraud mitigation industry to supplement our already robust system of checks and balances. In addition, we attend fraud conferences to ensure we are up-to-date on the “latest and greatest” in fraud mitigation and we network regularly with the world’s largest e-commerce companies to keep up on best practices and industry standards.

As you can see, throughout our history, 2Checkout has worked its way through multiple models of fraud detection and prevention. We won some and we lost some, but we continued to improve our service. We built a homegrown system, lost our homegrown system in what I like to refer to as “the dark days,” when we were left with nothing more than AVS, CVV, and IP tools to investigate questionable orders, then we rebuilt our system and joined forces with the world leader in fraud mitigation. Through the ups and downs, the long nights and the weekends of work, we learned an amazing amount about fraud protection which has strengthened our service every step of the way.

A CLOSING WORD TO THE WISE

Throughout the fraud monitoring process, we try to provide our 2Checkout vendors some valuable information on the transactions within their accounts. Regarding payments, we provide AVS and CVV responses, as well as an IP address identifying the order origination. This is excellent information for a company to have about its customers, but is not nearly detailed enough to decide whether or not the order is possibly fraudulent. As the provider of your product and/or service, there will definitely be times when you will know better than 2Checkout whether a potential customer is trying to rip you off, or not. However, this information would come from additional data you have collected outside of the information provided you in 2Checkout’s Admin Area. While I preach that there is no silver bullet when it comes to investigating orders for fraud, I can confidently say that AVS/CVV and IP data do not provide nearly enough information to detect and decide whether or not an order is fraudulent.

We recommend you leave the fraud decision-making process to the experts! We spend our entire day and over 10,000 man-hours annually catching bad guys. With that said however, I also recommend you utilize our fraud agents as partners to best mitigate losses by letting us know if you have additional information which can help us in our decision making. You can’t do it alone, and neither can we. It is imperative that we communicate regularly with one another and work together to stamp out Internet crime once and for all, one order at a time!

Allow me a moment to introduce myself and talk about my history at 2Checkout. My name is Sebbe Jones. I am the manager of Fraud Detection and Prevention at 2Checkout and manage a staff of analysts and investigators.

We are very good at what we do, but don’t take my word for it. Let our record and departmental process speak for itself.

Today and tomorrow, I will post a two-part blog describing 2Checkout’s daily fraud mitigation efforts – what goes into our daily work, a little history behind the development and rejuvenation of our department, and ultimately explain why you shouldn’t try tackling fraud on your own.

In the beginning, 2Checkout started with a practical understanding of fraud protection. I joined 2CO when there were six of us crammed into a small office. Those were the days – when the entire company was smaller than my current department! Each of us played our own role but we also multi-tasked and overlapped with one another. We used homegrown systems to grow the business. For example, we had a fraud queue built from the ground up which started with tools provided by the credit card companies including AVS (Address Verification System), CVV (Card Verification Value) and GEOIP… the basics!

Initially, this was the extent of our tools and fraud protection. However, we were smart, innovative folks at 2Checkout and continuously improved our fraud system by getting our hands dirty on the front lines. The few of us who were knee-deep in reviewing transactions on a daily basis for legitimacy or fraud constantly “talked shop” and worked hard to add new tools and ideas to develop a more efficient and robust review process.

One of the newest tools helped us better determine how many attempts it was taking each customer to process an order. Our thought process was this — if a customer changed their information on each attempt, we flagged the order to take a closer look and “make better sense of the story.”

This process led to the development of “negative lists.” While reviewing past orders, if we could link an email, billing address, or credit card to a fraud attempt, we would add that specific information to our negative list database. Every time a new order entered our system and included one or more of these data points, it was automatically flagged for manual review. Interestingly enough, to ensure we were not punishing good customers in the process, the presence of a negative list resulted in the development of a positive list, to ensure our honest repeat customers were passing through the system quickly.

You get the idea… these were a few of the features that initially built the foundation of our fraud fighting system. We constantly evolved. We got better, and even started making a name for ourselves. We had to… There was no choice. We knew that no matter how hard we worked or how innovative we were in the process, fraudsters were working even harder and coming up with new ways to beat the system. We followed this methodic process daily and continued to learn and evolve into the department we are today. It was our job to stay one-step ahead of the fraudsters, so we constantly adapted and always will.

Throughout the learning process we began to realize how equally important it was to approve good business, as it was to stop the bad. In fact, it was more important.

After a couple years of building our homegrown fraud queue into an awesome tool, the business was growing faster than anyone ever thought. It was a great feeling to see our company grow into what it is today, but we would be lying if we told you we weren’t overwhelmed. Because of the growth, 2Checkout had some business decisions to make. We needed to enhance our user interface, and for those of you who have been with us for years, you will remember our move from Version 1 to Version 2.

The move to V2 was necessary and inevitable, and it was mostly a success. However, there was one very important thing we failed to move — the Fraud Queue — which we spent so much time developing. Quicker than you can say “chargeback” our fraud department went from alert and savvy to working in complete darkness. The tools we spent so much time building and putting in place to better mitigate fraud losses were gone in a flash. All that was left were our original fraud fighting resources — AVS, CVV, and GEO IP. Sure, these three resources were excellent tools even by today’s standards, but we no longer had any rules set in place. Suddenly, our fraud representatives were forced to review hundreds of orders a day. As a company, we were at the point where on average, we were reviewing 45% of our transactions for fraud, while best practices suggest most companies review less than 20%!

Fraud was coming in, and because we were reviewing such a large number of orders, identifying legitimate fraud was like finding the proverbial needle in a haystack. Even worse, we were stopping good sales in the process! With little good data to compare each order against and fewer tools to help us validate our decisions, we could no longer “make sense of the story.”

Read Part Two of Fighting Online Fraud With 2Checkout’s Sebbe Jones tomorrow, to learn how 2Checkout turned a negative situation into a positive and strengthened its system into a world-class fraud net!

Click here to read Part Two.

According to an article published this week in The Paypers, the FBI’s Internet Crime Complaint Center (IC3) registered over 275,000 online fraud complaints in 2008…” That’s a 33 percent increase from 2007 and equal to approximately $265 million in annual losses.

World-class fraud protection is invaluable to an online business but not cheap. The labor and technical expenses associated with providing adequate protection require a significant resource commitment, especially for small businesses. However, for 2Checkout account holders, fraud protection is just one of a number of value-added features included in our turnkey e-commerce service. And sometimes it takes statistical reminders from the FBI to remind us how crucial these add-on services are to running a profitable online business.

Most veteran 2Checkout customers will agree that free, highly sophisticated fraud protection is by far the most valuable benefit 2CO offers its customers. As an integral part of our turnkey solution, 2Checkout manages fraud protection not only for the businesses utilizing our e-commerce solution, but also for the millions of anonymous and honest customers purchasing their products.

2Checkout attacks and manages online fraud issues with three separate, inter-related departments. Our Enterprise Services Group manages 2CO’s free, fully-hosted PCI-DSS Storage feature ensuring customer data is never breached. 2CO’s staff of Risk Specialists, serve as consumer advocates looking out for the interests of customers purchasing from 2Checkout vendors ensuring products are received. And, our Fraud Department works around the clock analyzing databases and networks and scrubbing data to continuously weave a stronger web and identify criminally minded customers before fraudulent transactions can even take place.

Whether you’re a 2Checkout vendor managing every dime that comes through your business or a consumer purchasing a product through 2CO, your protection from fraudulent behavior is a number one priority. Best of all… it’s free of charge!