If you own a commerce site and you're serious about your Internet business, you probably already accept credit cards. And as we all know, there is a myriad of positive benefits associated with accepting credit cards including customer convenience, increased sales, professional image...and the list goes on.
But it's also important to know that credit card fraud runs rampant on the Internet. And unfortunately as merchants we bear the primary responsibility for ensuring a transaction is legitimate before filling the order. In other words, if a transaction is fraudulent, and you failed to take the all important steps to verify the legitimacy of the order, you will be left holding the bill when the cardholder challenges the purchase.
In this article you will learn:
AVS stands for Address Verification Service. This code will tell you whether or not the address given in the order actually matches that of the cardholder. On my real-time processing system, the AVS code is comprised of three numbers. The first corresponds to the numbers in the street address. The second corresponds to the zip code. And the third is an overall verification of both. For example, an AVS code of YYY means: "yes" the address matches, "yes" the zip code matches and "yes," both the address and zip code match the cardholder's. But an AVS response code of NYZ means "no" the address does not match, "yes" the zip code matches and only the "zip" code matches.
There are about ten different letters used for AVS response codes, and it's important for you to know all of them and what each means. For a list of the most common AVS response code letters and their meanings, click here.
If a transaction is approved with an AVS response code of YYY, AND if the order is to be shipped to that same address, then you have nothing to worry about. You can feel confident you have a legitimate order. But if the AVS code does not match, you need to decide whether to ship the product, or whether to do further checking before shipping the product. Be aware, however, that if you ship the product without further verification and the purchase is fraudulent, your account will be debited for the full purchase amount as a result of a chargeback by the cardholder.
If you receive an AVS code that is unacceptable to you and you'd like to do further checking, the first thing you should do is call your merchant provider. (You can also call Visa/MasterCard, Discover & American Express directly. Click here for a listing of their numbers.) Mention that you are calling for a cardholder's issuing bank phone number. You will need to give your merchant number and the first six digits of the credit card in question. They will then give you the number of the issuing bank for the credit card in question. Call that number and tell the person helping you that you would like a cardholder verification.
Calling the issuing bank of a cardholder has many advantages over simply calling the credit card company for an address verification. First of all, the credit card company will only tell you the same information your AVS code did, and sometimes a mismatch is simply due to outdated information. Calling the issuing bank enables you to verify not only the address and zip code of a cardholder, but also the cardholder's name and phone number (something the credit card company cannot do). You can even inquire if an address mismatch is due to a P.O. Box listing rather than a physical street address.
With all this information, you can make an informed decision about fulfilling the order. Be sure to take notes when you call the issuing bank for verification. Write down with whom you spoke, the date and time you called, and include notes concerning the outcome of the phone call. That way you'll have the information if you need to defend yourself against a chargeback later.
Be Observant! YYY can still mean "No, No, No!"
Follow your gut instinct. Let me give you an example. I sell jewelry and watches of all types (dead ringer for credit card fraud). Many of my costume jewelry customers are high school aged boys buying large figaro chains (it's the "in" thing). Most of these guys are harmless and I enjoy their business. But last weekend, I received a $200 chain order on my costume jewelry site. The order was much larger than a standard order from that particular site and the quantity for each item was suspicious. The AVS code for the purchase came back as YYY, but the person's name on the e-mail address was different from the cardholder's name. The order was also being shipped to someone other than the cardholder and the person requested overnight shipping (a huge red flag as thieves want to receive their products before getting caught).
My gut instinct was that something was not right with this order. I called the phone number provided on the order and it was disconnected. First thing Monday morning I called Discover Card directly. Not only was the phone number on the order a mismatch, but the cardholder had called sometime after I received the order to report his card was stolen. In this particular instance, had I not been so diligent in verifying everything possible, I would be out the cost of those goods. Luckily, my instinct was correct and the perpetrator was an 11-year old boy who will be spending some time in juvenile court.
Obviously, you will need to adopt your own policy outlining how far you will go to verify information for each order. You may not want to worry about verifying small purchases of $20 or less. The fraudulent orders I receive are typically much larger than average. Look for things that are suspicious such as those I mentioned earlier, and make your guidelines accordingly.
What If I Become A Victim?
If you have the misfortune of sending merchandise to a crook, there are a few options available to you to try and recover your merchandise or to see justice done. This is a rather complicated issue for merchants though and you may hit several stumbling blocks along the way.
Be persistent! Try all your options.
Call the cardholder's issuing bank and ask them to do a courtesy call to the cardholder. Mention that you have the address where the product charged to the cardholder's credit card is being shipped. That information will usually entice the cardholder to return your call. Convince the cardholder to report the crime to the police in the town where the crime was committed (where the product was shipped). If that police department has a detective that works on credit card fraud cases, you can at least get the ball rolling to possibly recover the merchandise and/or see justice for the actual crime.
Some police departments will be more helpful than others. Find out the parameters of your state law concerning issues of credit card fraud. In some states, all credit card fraud is considered a felony and the crime is taken more seriously. You may be lucky to find a police department that has a detective dedicated to crimes involving credit card fraud. Such was the case in the incident involving the 11 year-old. Although I never sent the product, we were still able to get some justice for the crime. And hopefully, he will be one credit card crook who learned his lesson early and won't do it again. In a case like this, you may or may not recover your lost merchandise, but at least you've done your part to help put an end to the crime.
Here in Colorado, as in many states, credit card fraud is considered a misdemeanor unless the actual dollar value of the loss (cost of goods in the merchant's case) reaches $400. From $400 - $15,000 the crime is considered a Class 4 Felony. Above $15,000 the crime is a Class 3 Felony. Admittedly, many police departments simply do not have the manpower to dedicate a detective to misdemeanor crimes and the cases are closed leaving the merchant holding the bill.
If this is the case in your situation, and if you truly feel you did everything you could to verify the cardholder information before shipping the product, then you need to take the issue up with the credit card company when you receive your chargeback notice. Take some time to write out a strong defense for yourself. Include the notes from your conversation with the cardholder's issuing bank. Hopefully, the credit card company will reverse the chargeback and you won't be responsible for the lost dollars in the crime. In this case, you may not see justice for the crime, but at least you've recovered your losses.
Be proactive! Put yourself in the cardholder's shoes.
Pay attention to failed credit card transactions that are suspicious. Again, look for the red flags that I pointed out earlier and check the AVS response code. If you suspect a purchase attempt was fraudulent, you owe it to yourself and to the cardholder to do your part in stopping the crook before he succeeds.
Again, call the cardholder's issuing bank and ask them to do a courtesy call to the customer. Be sure to give your phone number so the cardholder can call you back. Mention that you had someone attempt a purchase on your website with his/her credit card and you suspect it may be a fraudulent transaction. If you're right, hopefully the cycle will start all over again with the cardholder calling the police to report the crime just as if a purchase was actually made.
This happened just recently on my site and I did just as I stated above. When the cardholder returned my call, she was so grateful I had taken the measures I did. She didn't even know her purse had been stolen until she got the call from American Express. Because I was proactive, we were able to stop the crook right away, and criminal charges are now pending against him.
Don't be passive about potential credit card fraud just because you may not be out anything...YET. As a community of Internet entrepreneurs we must stand strong and stand united against credit card criminals. If you are a netrepreneur, trust me, it's only a matter of time before this crime affects you in some way. Be proactive against the crime, regardless of what your loss may or may not be.
PO Box 22157 Knoxville, Tennessee 37933-0157
Telephone: 865-692-9253 FAX: 865-692-9247
© 1998, 1999, 2000 PLANETWEBDESIGN
TECHNOLOGIES, Inc. All rights reserved