Protecting Your Business from Fraud

With many consumers preferring credit to cash and online shopping to in-person, the merchant's risk of credit card fraud has steadily increased. When you add up the cost of stolen merchandise, unrecouped shipping and transactions fees, and chargeback costs for disputed purchases (typically between $10 and $25 per chargeback, depending on your merchant bank), you'll soon realize it pays to be vigilant about fraud protection. Although merchants are often innocent bystanders to most fraud activities, they are more likely to have to pay the price since the law tends to side with consumers over merchants. Even if you think your business is safe, it's important to consider the other end of the fraud cycle: Are you exposing your customers’ credit card information to would-be-thieves?

  • Different Types of Fraud

    Each year, merchants lose billions of dollars to credit card fraud and identity theft. Advances in technology and the Internet have provided even more avenues for criminals to commit these crimes, often without the merchant realizing anything is amiss.

    The following list details the more common types of fraud:

    • Trusted Employee, the most common and costly type of fraud in brick-and-mortar businesses, involves employees who collect your customers' credit card information to make fraudulent purchases, sell to other criminals, or issue credits to their own cards through your merchant account. This also applies to employees of banks and merchant service providers.

    • Skimming devices allow a thief to swipe and maintain thousands of card numbers to be used later to create new cards or make fraudulent purchases.

    • Spoofing/Phishing exists only in the online realm and involves setting up a fake website to fraudulently obtain card information or process illegal transactions. Card numbers are sometimes shared between fraudsters to maximize illegal activities before the cardholder notices anything is wrong.

    • Cardholder Fraud, one of the most difficult fraud types to identify and prevent, occurs when a legitimate cardholder purchases goods or a service but then either disputes the charge claiming the goods/services were never received or immediately reports the card as stolen.

    • Number Generators provide thieves with thousands of random card numbers. Simple software is then used to charge a small amount to each number, helping to identify which ones are active.

    • Stolen, Altered, and Fake Cards are a common form of fraud. Technology has facilitated card duplication and altering, resulting in legitimate-looking cards that are harder to identify than counterfeit currency.

    • Identity Theft occurs when an individual's identifying information has been compromised. This information can often be easily obtained by going through a merchant's garbage or even looking over a person's shoulder during a transaction.

    • Hackers have become more prevalent with the increase in online shopping and individual merchant web stores. Once thieves have found a way into your site, they begin searching for sensitive information that they can steal for their own personal gain.

  • Credit Card Security Features

    The card associations take great care in incorporating security features into their credit cards to stymie fraudulent activity. Be sure to leverage these features during every transaction.

  • Address Verification and Voice Authorization

    The Address Verification Service (AVS) is a fraud-deterrent tool used to verify the identity of the person claiming to own the credit card. Especially important for card-absent sales, AVS verifies the numeric portions of the cardholder's billing address, the identification number located on the signature panel (the CVV2 number), and the expiration date.

    If your AVS code indicates a problem and/or you suspect fraud, report it to the issuing credit card company by obtaining a "Code 10" voice authorization. The card company will walk you through a series of "yes" or "no" questions to help determine how to proceed without alerting the customer.

  • PCI Data Security Standard

    The Payment Card Industry Data Security Standard (PCI DSS) outlines six categories of requirements with which all cardaccepting merchants must comply. These requirements serve to protect you and your customers from theft and fraud, and safeguard the cardholder's information from attackers and other online hazards.

    PCI's compliance categories include:

    • Building and maintaining a secure network

    • Protecting cardholder data

    • Maintaining a vulnerability management program

    • Implementing strong access control measures

    • Regularly monitoring and testing networks

    • Maintaining an information security policy

  • Help Stop the Cycle of Fraud

    Preventing fraud takes foresight, education, and planning. Use the following checklist help deter would-be thieves and lower your company's fraud-related costs.

    • Swipe or imprint the card and get a signature, whenever possible

    • Keep records of customer interactions to help prove that the customer authorized the charge

    • Key-enter the last four card-number digits into your terminal to verify that they match the last four digits of the number on the magnetic strip

    • Compare the signature with a government-issued ID

    • Ask for extra information for online, phone, fax, and mail orders

    • Always enter an address and heed AVS warnings

    • Always obtain authorization for each transaction

    • Be aware of suspicious customer behaviors:

      • Is in a big rush to process the transaction

      • Asks about authorization limits or refund policy

      • Makes large purchases but doesn't care about item details

      • Makes several repeat purchases

      • Hasn't signed the back of the card or doesn't have identification

      • Attempts to use a card before or after its valid dates

      • Gives you information that does not match the card issuer's records

      • Has a suspicious email address that doesn't match the cardholder's name

      • Makes large purchases first thing in the morning or last thing in the evening when staff have other things on their minds

      • Turns down free delivery or gives an address that doesn't match the card issuer's records