By Paul Lang, Editor, Sell It!
March 20th, 1999

See Also   How to Build a Web Store for FREE   How to choose mailing list management software   How to Grow Your Web Business   How to Accept Credit Cards without a Merchant Account   How To Develop Online Products That Sell   How to Change Your Web Hosting Service (ISP)   How to Deal with Disgruntled Customers   How to Get Top Search Engine Positioning   How to Beat Credit Card Fraud   How to Design an Affiliate Program   How to Accept Credit Card Payments   How to Choose a Shopping Cart

[This is the second part of a three part article. The first part can be read here].

AVS was developed to help MOTO merchants avoid fraud. It works by comparing a portion of the billing address with the records held by the card issuer. However, AVS has some serious limitations when it comes to Internet transactions:

• One of the major opportunities that the Internet brings is the ability to accept orders from all around the world, but AVS only works for addresses in the USA.

• Another major advantage of the Internet is that it allows "soft" goods such as software to be purchased and downloaded instantly. AVS provides no protection here as all a thief has to do is to obtain a valid address that corresponds to a stolen credit card number.

• And even with "hard" goods there is still a problem as thieves can supply a valid address for a stolen credit card as the "bill to" but then request a different "ship to" address.

I mentioned above that the banks and card issuing authorities were doing very little to combat online fraud. This is not strictly true as they are investing large sums of money in to a new system known as SET. SET is the Secure Electronic Transaction protocol developed by Visa and MasterCard specifically for enabling secure credit card transactions on the Internet. It uses digital certificates to validate the identities of all parties involved in a purchase and encrypts credit card information before sending it across the Internet. However it is likely to be several years (if ever) before the use of SET becomes widespread.

Not surprisingly then, merchants have been quick to develop and introduce a number of ways to limit their exposure to fraud. Here's a list of some of them:

• Using AVS whenever possible: OK so it only works in the US and the system can be beaten, but it's still a useful way of weeding out the less sophisticated fraudster.

• Being particularly wary of orders from free e-mail addresses: Once a thief has a stolen credit card number and a stolen address they need one more thing to complete their fraud portfolio - an untraceable e-mail address to hide behind. That's why a high proportion of fraudulent orders come from free e-mail addresses and as a result many merchants refuse to accept orders from them or at least perform additional checks. You can find a list of free e-mail domains on the AntiFraud Web site.

• Checking out the customer's Web site: it is often possible to determine the URL of a customer's Web site by simply putting "www" in front of the second part of their e-mail address. For example, if a customer provides an e-mail address of "john.doe@somedomain.com" then typing www.somedomain.com in to a Web browser usually leads to their Web site.

  Things to look out for include empty or "under construction" Web sites or sites where the contact information differs significantly from the order information. For example, the Web site might display a US business address whilst the order requests delivery to be made to Eastern Europe.

  Some merchants go even further and check out who owns the domain name. Information on the ownership of US domains is available on the Network Solutions Web site or alternatively Unix wizards can use the "whois" command.

• Taking special care where the "ship to" address differs from the "bill to" address: Some merchants don't accept these types of orders from international customers and some carry out additional checks even for domestic orders.

• Watching out for unusual orders: Thieves usually have the "might as well be hung for a sheep as a lamb" mentality and therefore tend to place orders that differ significantly from what legitimate customers typically order. Things to look out for include orders for "big ticket" items, orders for unusually high quantities and orders where the customer is prepared to pay a lot for expedited delivery.

• Phoning the customer if in any doubt: A quick telephone call can often be enough to establish whether an order is legitimate or not.

• Collecting all possible order data: When trying to detect fraudulent orders or trying to recover money lost through fraud, the more data you have available the better. This includes the customer's address and telephone number, the name of bank that issued the credit card, and the IP address of the computer from which the order was placed.

• Firing a warning shot: Stating clearly on a Web site that the merchant has anti fraud safeguards in place and will pursue prosecution for all fraudulent orders can be enough to scare of some would-be thieves.

So which of these checks should a merchant employ? How can they be automated? Read on and find out more....

More: Which checks to use and how to automate them