Credit Card Fraud Detection: How to Protect Your Business

Credit card fraud is a problem most small businesses don’t think about — until it hits them. If you sell online or by mail, your business is particularly vulnerable to losing money due to fraudulent credit card orders. Here are tips for detecting fraudulent orders and minimizing your risk of losses.

The possibility of your business losing money due to fraudulent credit card sales is probably something that rarely, if ever, crosses your mind. But if you accept credit cards, it’s a threat you shouldn’t ignore. 

Credit card fraud occurs when someone uses a credit card or credit card details to obtain products or services without paying for them.

Unfortunately, it’s a growing problem, particularly for businesses that sell online. According to the Nilson Report, credit card global losses rose to $27.85 billion worldwide in 2018, up from $23.97 billion the previous year. One-third of those losses in 2018 ($9.47 billion) occurred in the U.S.

Although some fraudulent transactions happen at brick-and-mortar businesses, fraud was 81% more likely in online card-not-present sales.

No matter where it takes place, though, credit card fraud can quickly turn an otherwise prosperous year into a nightmare for a small business. When a credit card holder spots a transaction they don’t recognize on their credit card bill, if they didn’t receive an order, or there was a problem with the goods or services they ordered, they can dispute the charge with the credit card company. That dispute turns into a chargeback to the merchant.

What’s a chargeback?

A chargeback is a transaction reversal. The credit card processor withdraws the disputed transaction amount from the merchant’s bank account. The merchant may be given a chance to dispute the chargeback and may win. But if they lose, and they’ve already shipped or delivered what was purchased, they lose not only the sale but also their cost of goods for the item they shipped, their shipping costs, and any other costs associated with the transaction.

To top it all off, merchant account providers also charge merchants a chargeback fee for each disputed transaction.

Those chargebacks can add up to substantial sums in some instances. A California business owner had to borrow from friends and family to make good on $14,000 worth of fraudulent charges made on stolen cards one year. The following year, the owner implemented procedures to screen out possible fraudulent orders and refused to ship $25,000 in orders that seemed suspicious.

‘Friendly’ Fraud vs. Stolen and Fake Cards

Stolen and fake credit cards aren’t the only cause of chargebacks. Sometimes the cardholder who purchased the item is the perpetrator of the fraud. Monica Eaton-Cardone, co-founder and COO of Chargebacks 911, says that often, “customers to request a chargeback out of buyer’s remorse, a practice which is called friendly fraud.” She adds that “another common trigger is family fraud, which occurs when a friend or relative of the cardholder authorizes a purchase without the cardholder’s knowledge.” Merchant errors can also be the cause of chargebacks.

How to Handle Chargebacks

Handling chargebacks can be quite time-consuming. Eaton-Cardone says the first thing the merchant needs to do is to “determine the true source of the chargeback.” Is it fraud? Did the item get lost in shipping or delivered to the wrong address? Did the merchandise arrive damaged? 

“The merchant needs to get all the information available about the transaction from the bank, then assemble a compelling case for representment [submitting evidence to the bank proving that a transaction was valid]. That will include evidence demonstrating the transaction was legitimate, plus supporting documentation to give it context.”

Those supporting details might include shipping company records and signature confirmations. All the documentation needs to be sent back to the processor, who will decide the outcome.

If your sales volume is sufficient, an alternative to handling your own chargebacks is to use a service to handle disputes for you.

How to Spot Fraudulent Orders and Avoid Chargebacks

There’s no surefire way to prevent chargebacks. But there are things you can do to minimize them. If you’re dealing with customers in person, you may be able to spot fake credit cards by looking over the card carefully.

Check the appearance of the card, the numbers on the card, the magnetic strip, and the hologram. A customer that seems evasive or fidgety could be a reason for concern, as well.

For online sales, you don’t have those visual clues, but there are still steps you can take to reduce the occurrence of fraud.

• Use address verification (AVS) and card code verification (CCV) for all card-not-present sales (that is, online and mail order sales).
• Make sure the business name that shows on the purchaser’s credit card is recognizable to the purchaser. If the official company name of your company is Smith & Company, but you run an online store called PrettyJewelry.com, be sure your credit card processor shows the name PrettyJewelry on the customer’s statement, not Smith & Company. The customer probably won’t recognize Smith & Company and may chargeback a legitimate purchase.
• Include a reminder on your Thank You page telling the purchaser to save their receipt and use it to reconcile their credit card statement. 
• Email the customer a copy of the receipt that includes what was purchased, the expected shipping time, and the name of your company.
• Notify the customer if there’s going to be a shipping delay. If the order will take longer than usual to ship, give the customer the option of waiting or canceling their order and refunding their money.
• Be on the lookout for suspicious sales. These include:
  • Unusually large orders placed through the Internet without any contact from the customer.
  • Rush orders for large quantities or high-priced goods. Crooks may ask to have an order shipped overnight so they know exactly what day the order will arrive and can be waiting to pick it up.
  • Inquiries from buyers promising to place a large order, but who want you to send them a list of what you sell.
  • Missing information or information the customer refuses to give, such as a day-time phone number or the CCV verification number.
  • Orders that are shipped to a different address than the billing address.
  • Orders from foreign countries.
  • Orders on U.S. cards shipped to foreign countries.
  • Billing addresses that don’t match the information on file with the credit card company.

By themselves, no one of these things is a sure sign that a credit card is stolen. But when several factors are present (say, your average ticket amount is $75, and you see a rush order for $5,000 being shipped to a different address than the address of the credit card holder), it’s prudent to be suspicious and investigate the sale before you ship the merchandise.

RELATED: Counterfeit Money: How to Spot Fake Bills

Even if there’s only one factor that doesn’t pass your “sniff” test, it’s useful to err on the cautious side. As an example, not long ago, someone using a credit card with U.S. address purchased a product from us and wanted it shipped to someone by a different name in another country. The particular product was one that wouldn’t be of much use to anyone in the country it was being shipped to, so we called the credit card holder to verify the shipping address. The credit card holder hadn’t made the purchase. Neither had anyone else authorized to use the card. The card and the cardholder’s contact information had been stolen.

What should I do if an order does sound suspicious?

Under any of the above circumstances, be particularly cautious and do everything possible to ascertain that the person ordering the merchandise is actually the cardholder or an authorized representative of the cardholder.

These tips, though not infallible, may help you decide if an order is legitimate:

• Get the complete name, address, ZIP code, and phone number for the cardholder.  
• Require customers to enter the 3-digit card code number from the back of their credit card.
• Verify that the billing address of the cardholder is correct. Then, verify the information you are given by calling the merchant bank or using whatever other address verification system is in place through the ISO that processes your charges. If the address you were given doesn’t match the address of the cardholder, don’t ship.
• Implement a fraud detection service that blocks suspicious transactions based on where they originate, or other factors. (Online credit card processing gateways such as Authorizenet have these available for a fee.)
• Use an address verification service (AVS) to block sales when the billing address entered online doesn’t exactly match the billing information on record for the cardholder. 
• If a sale looks suspicious, find an excuse to call the customer back, using the phone number they gave you, and ask to speak to the cardholder. If you can’t reach the cardholder, don’t ship the merchandise. People who use stolen credit cards don’t give out their real phone numbers.  
• Look up the address and phone number of any local orders in the phone book. 
• Send a reminder letter to people when you ship an item telling them the item has been shipped and when they can expect it to appear on their bill. This type of letter can reduce complaints and chargebacks from people who simply forget what they ordered or from whom.

NOTE: Don’t automatically discredit an order that looks suspicious. I once had someone place an order and ask that it be shipped to Mickey Mouse. The address verification feature on Authorize.net didn’t find any problems with the address. My order form includes a place for an e-mail address, and the person had included their e-mail address, so I sent them a note to ask about the order. The individual, who had used his real credit card data and real address for shipping had used the name Mickey Mouse because he was afraid to use his real name on the Internet.

Using the right software can also help protect you from fraud. When you use the ZenBusiness Money app to accept credit card and bank transfer payments, all payments are fully secured with end-to-end encryption.

Disclaimer: The content on this page is for informational purposes only, and does not constitute legal, tax, or accounting advice. If you have specific questions about any of these topics, seek the counsel of a licensed professional.