2

I run a website which accepts credit card payments.

I recently noticed that one user who used many different names and/or email addresses attempted to make almost a hundred credit card transactions for varying amounts (from $1.50 to > $500) over the course of a few hours.

What is the correct way to report this sort of activity to the authorities?

5
  • 4
    Contact your payment processing company immediately!! Talk to them about this problem. If you can, look in your log files and determine what domain names or IP addresses these are coming from. If there are not too many, paste them into your question as well as your web server (Apache, IIS, Nginx, etc.) and perhaps I/we can post some access block code for you. It may not stop the fraud, but it could slow it down. These are likely coming from open anonymous proxies so it is possible that they would just change proxies- but they could also get the hint too and just plain stop and go away. – closetnoc May 27 '15 at 0:44
  • Thank you. I've contacted my payment processing company and have temporarily blocked this user from the payment-accepting areas of my application, in a way that isn't immediately obvious that they're blocked, until I can get this sorted out. The number of IPs being used seems to be small (i.e. about 5) and they're all proxies, VPNs, VPS providers, and the like. – antifraud May 27 '15 at 0:55
  • I guess the cops will be paying this kid a visit soon!! If this persists and you want blocking code, just let me know and we will do what we can here. I create blocking code automatically using a tool I created and often paste it here so it is not a big deal. -- How frustrating is this?? It has to be maddening. A bit scary too. – closetnoc May 27 '15 at 0:59
  • 3
    @closetnoc - you should make your comment an answer... :-) – Greenonline May 27 '15 at 3:27
  • What payment processing company are you using – AaTish Jun 6 '15 at 8:21
1

I found this article which might help:

Obviously, this is a sensitive situation. No merchant wants to offend honest customers by turning the shopping experience into what feels like a prosecution. At the same time, you can't afford to turn a blind eye to fraud.

The major card issuers have published recommendations on what to do if you or a cashier on your team suspects fraud and I recommend that you follow them closely to avoid dangerous situations. As you probably suspected, no card issuer expects you to get into a dramatic verbal confrontation with a customer you think is misusing a card or to become a vigilante and wrestle a card from a fraudster's grasp.

American Express's guidelines say you should never put yourself or your employees at risk when you suspect credit card fraud. "Do not, under any circumstances, confront or attempt to apprehend the customer," the company's website says. I suggest you take that warning very seriously.

AmEx, MasterCard and Visa all say that if you or an employee suspects credit-card fraud, you should call your authorization center and, in a normal voice, say you have a Code 10 authorization request. Follow instructions from the operator after that, answering questions in yes or no answers. MasterCard says that the operator will notify the police for you if it is necessary.

Visa suggests on its site that an employee who notices suspicious signs should also "hold onto the customer's card if you think you can do so safely." I would venture that, given how violent society has become, there aren't any situations where you have 100 percent assurance you can do so safely, and I would err on the side of caution.

To prevent fraud, follow the card issuers' guidelines for fraud prevention to the letter with each and every customer -- and train your cashiers to do that, too. In Visa's list of card acceptance procedures, for instance, cashiers should make sure customers sign the receipt and compare it to the card. Many cashiers don't do this, even though they should.

Know the circumstances when you should decline a card and train your team in them, too. Politely explaining that someone's card has been declined because it has expired, for instance, should not offend honest customers. Many will appreciate it that you take fraud-prevention seriously.

Visa has published a helpful list of warning signs of potential fraud that I'd suggest you read and share with your employees, if you haven't done so already. For instance you'll want to be especially observant if a customer tries to purchase a lot of merchandise without regard to size, style, color or price. Someone who tries to distract you or rush you on a sale -- or doesn't have a single question about a major purchase -- may also be up to something, according to the guidelines.

At the same time, you have to use your judgment. For instance, parents who are shopping with young children might try to rush you on a sale because they are worn out from shopping with their kids. Your common sense and instincts are your best weapon in the war on fraud, so use them as your guide.

This information is for "Brick and Mortar" stores but should apply to e-commerce as well. (as applicable)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.