Ecommerce: how to avoid credit card fraud

Practical eCommerce, a magazine dedicated to ecommerce issues, conducted a field study on fraud prevention. A group of experienced merchants were asked a number of questions. As a result of the field test it was discovered that all of the merchants were targets of hundreds of online credit card fraud attempts. The following ways of attempted fraud were highlighted:

1. The merchant receives a number of orders from the same customer. All of the orders get rejected by the credit card processor and then the last one gets approved. This method is used to test the credit card information necessary for processing (billing address and CVS codes) until the right combination is found by an identity thief.
2. Fraudulent orders come from IP phones claimed to be located in one area but when the IP addresses are checked - they do not match.
3. But the most common scenario is when the billing address and the shipping address do not match.

PCI compliance helps to prevent further identity theft from the merchant's website and databases but it does not prevent people from using stolen credit cards in an on-line store. It was noted that the best way to prevent fraud is to review every purchase request by hand. Staff who does order processing needs to be trained to detect suspicious-looking transactions. Appropriate security settings need to be utilized to make credit card usage safe and to filter unauthorized attempts.

Some recommendations from the test group to help other ecommerce merchants to avoid credit card fraud included the following:

"Pay attention to the details of each order. Red flags warrant further inspection and validation", said field tester 1. "Have checks and balances in place. Trust your instincts. Do not sway from your policies to accommodate an odd request - you came up with those policies for a reason", was suggested by the field tester 2. "Credit card fraud is inevitable. The key is finding the perfect balance of security settings without inconveniencing the customer or yourself with standards that virtually do not approve any transactions", was concluded by the filed tester 3.