Card Not Present Fraud Indicators

Card not present credit card fraud occurs when a product or service is ordered via an e-commerce website, over the phone, or via fax or mail using unauthorized credit card information and cardholder identity information. Typically, the credit card number and cardholder’s personal information (name, address, etc.) have been stolen or obtained illegally. When the cardholder sees the unauthorized sale in their billing statement, it usually results in a chargeback being issued by the cardholder’s issuing bank. The merchant is liable for having accepted the fraudulent sale and must refund the sale amount, pay a chargeback fee, takes a loss on the product shipped or service provided, and has to deal with the added expense of processing the chargeback dispute.

If a merchant sees any or a combination of the following elements in a card not present credit card sales order, it is cause to investigate further, and potentially avoid the sale due to the risk of fraud and or chargeback.

The Card and the Card Holder

New Customers. With a new customer there is always more potential for fraudulent activity using a stolen card, stolen card number, or a stolen identity.

Returning Customers with New Buying Patterns. Returning customers altering their buying habits, billing address, shipping address, or account number could indicate a stolen identity.

Transactions with Similar Account Numbers. Account numbers in series or following a geographic set indicate that they may have been generated fraudulently using software available on the internet.

Transactions from Multiple Cards Shipped to a Single Address. Multiple account numbers shipping to the same address could indicate account numbers fraudulently generated using software or a batch of stolen cards or stolen card numbers.

Multiple Transactions on One Card in a Short Period. Many quick charges on a single account number could indicate an attempt to run a card to its limit as quickly as possible.

Multiple Account Numbers from the Same IP Address. More than one or two cards or account numbers from the same Internet Protocol Address could indicate fraud.

The Order

Large Orders. Stolen cards and card numbers are only viable for a limited amount of time. Criminals try to make as many purchases as possible before the fraud is detected.

Multiple Orders. Multiple orders of the same item or type of item indicate that the order could be a fraudulent order intended for resale.

Big-Ticket Orders. Multiple big-ticket orders or orders made up of big ticket items have a high resale value and could be fraudulent orders intended for resale.

Rush Orders. Criminals want to speed the resale of stolen items. Orders that ignore extra delivery charges or need over night delivery may indicate a fraudulent order intended for resale.

The Shipping Address

International Shipping Address. Many fraudulent orders are shipped outside of the United States. Address Verification Systems are not as effective outside North America.

Multiple Shipping Addresses. One account number or similar account numbers with a single billing address a different or multiple shipping addresses could indicate organized criminal activity or a fraudulent order.

Free Email Addresses. Account numbers using free email addresses have no audit trail and could indicate the use of a stolen card or account number or a stolen identity.