In payment systems, fraud means using someone else's credit or debit card to carry out a transaction at a merchant or ATM, gaining unfair profit and causing loss to the real cardholder, the merchant, or the bank.
Transactions carried out by fraudsters can take place in a physical or virtual environment. Fraudsters develop new methods every day and cause losses to individuals or institutions. For this reason, it is almost impossible for merchants to eliminate fraud and chargeback risk entirely. However, it is possible to reduce the risk by taking certain precautions.
In e-commerce transactions carried out through merchants that are not protected by 3D Secure, if the cardholder disputes the transaction by claiming it does not belong to them, the financial liability falls on the merchant. Under chargeback rules, this means that the transaction amount is not paid to the merchant by the bank, or that amounts already paid are reclaimed and refunded to the cardholder.
Merchants that sell products and services with a particularly high risk level need to take precautions against fraud and perform fraud checks to protect themselves against the chargeback risk that may result from fraud. These checks are transactions performed to prevent fraud by evaluating an online order using various defined methods.
What should merchants pay attention to in order to reduce fraud risk?
Customers Shopping for the First Time:
Fraudsters will try the cards whose information they have stolen on many websites until they get approval. For this reason, transactions belonging to customers who register as new members on a website and make their first purchase should be examined in detail. In suspicious cases, confirmation should be obtained from the merchant's bank before the order is delivered, and if confirmation cannot be obtained, the delivery should not be made.
Orders Placed Under Different Memberships Using the Same Card:
It should be checked whether the card used in the order has previously been used under another membership. If the same card has been used in an order under another membership, the cardholder information and delivery address given in the previous order should be checked. Transaction confirmation should be obtained by phone, and it should be verified that the person to whom the product is delivered is the real cardholder.
Orders Placed to the Same Delivery Address Under Different Memberships:
Delivery addresses should be checked independently of the customer at regular periods (for example, daily); situations where orders from different customers are concentrated on a single delivery address should be tracked. If a previous fraud case is detected related to the delivery address entered in the order, it should be reported to the Cybercrime Combat Team.
High-Value Orders:
Fraudsters tend to use the entire limit of the cards they have obtained. To detect this type of fraud, the order amount should be compared, at the time of the transaction, with previous order amounts made at the merchant; orders placed well above the average should be examined more carefully.
Orders Placed After Multiple Failed Attempts:
Fraudsters may not fully know the details of the card they have obtained and may be acting by trial and error, or they may want to use the card's entire limit. In this case, transactions may encounter errors such as Limit Exceeded or Incorrect CVV. To detect this type of fraud attempt, it is important to examine the number of declined transaction attempts that can occur during payment, the reasons for the declines, and the related transactions that are subsequently approved.
Multiple Orders for the Same Product:
When multiple orders are placed for the same product, it should be checked whether the product is expensive and easy to convert into cash; if it is a product that is easy to convert into cash, the order should be examined in detail. Past orders should be checked at the time of the transaction, and if there are orders made with different cards for high amounts of the same product within a short period, these orders should be examined in detail.
Orders Requesting Fast Delivery:
For fraudsters, it is important that the product reaches them and is converted into cash as quickly as possible after the purchase. For this reason, since they will not be the ones bearing the cost of fast delivery, they will request fast delivery. In this case, the order owner should be contacted before the product is shipped, and the necessary checks should be made. If the order owner cannot be reached, or if there is a suspicious situation during the conversation, the order should be canceled.
Orders Made with Different Cards from the Same IP Address:
Whether an order is fraudulent should be checked by cross-referencing a lot of information. The most important piece of information that can be considered critical is the customer's IP information. The IP address (number) is data that is widely used in many different areas, such as tracking a transaction, tracking criminals, online sales, and marketing. It is important to capture the customer's IP in all transactions and perform fraud checks using these IPs. Orders placed at short intervals using different cards from the same IP address create a high level of fraud risk. Checking that orders are made over a valid IP, identifying the domain address, and requesting detailed information from the bank when necessary are all very important for fraud control.
Orders with Different Billing and Delivery Addresses:
Due to typical user behavior, the billing address and delivery address information selected during a purchase are usually the same. Orders where the Billing Address and Delivery Address are different should be treated with more caution, and if the order consists of high-value products that are easy to convert into cash, it must be examined in detail. The order's shipping information, membership information, and past orders should be examined in detail.
Orders to Be Picked Up from Courier Branches:
Orders requested to be delivered to courier company branch addresses, as well as orders from customers who insist on delivery to the courier company and call on the delivery day to get information about the delivery process, should be examined in detail. If the order information cannot be confirmed, the order should be canceled if necessary, and the merchant's bank should be informed.
Preventing fraud requires serious effort. However, the effort spent should not exceed the potential cost of fraud losses avoided; a balance must be maintained.
No matter what merchants do to prevent fraud, fraudsters keep coming up with new methods every day. We must learn to live with fraud and do everything we can to reduce it.
