On-line security, payment services aid e-tailers stung by fraud

Discount Store News, April 19, 1999 by Cecile B. Corral

In many tales of fraudulent e-commerce, the consumer is most often portrayed as the victim. But less is said about the thousands of on-line retailers that unknowingly conduct transactions with illegitimate consumer--the kind who drain profits through extensive use of stolen credit cards.

In truth, consumer cyber fraud runs rampant. As much as 5% to 6% of the average Internet retailer's transactions involve consumer fraud, according to figures recorded by CyberSource, a developer of software systems that detect online fraud. What's more, its assessments for Web businesses selling software and other digital goods are much worse; they show that 30% of total Internet sales result in attempted credit card fraud.

What's a retailer to do? Tracking the identity of Net consumers can be virtually impossible. Malls and stores have a big advantage over e-commerce retailers in that their shoppers must be physically present to make purchases and often must provide a signature and valid identification. Even when buying from phone catalogs, store operators can query a shopper's profile to check for discrepancies in their personal information.

Web-based retailers don't have the same advantages. An e-mail address will not reveal a customer's identity or location, let alone whether the credit card they're using is their own.

"Any service or product delivered digitally on the Web is where you find a very high incident rate of credit card fraud," said Tom Arnold, cto and vp of engineering at San Jose, Calif.-based CyberSource. "These figures can change over time--and change rapidly. They can swing up when there's a sudden interest in certain types of sites in the hacker community."

Janet Langenderfer, president of Vision Partners Inc., a management consulting firm outside Chicago, experiences the realities of Cybersource's findings almost daily as she listens to the many horror stories from her clients who operate Internet-based businesses.

Even so, Langenderfer said she gets five to 10 calls per week from Web retailers pursuing guidance in setting up credit card services for their sites.

"They usually have no idea about the added risks and expenses involved," she said. "Everyone selling something on the Web--whether it's a multimillion-dollar company or a mom-and-pop operation--is in danger of losing large sums of money because of credit card fraud. The only difference is how hard it hits their wallets or if they can afford to protect themselves."

Web purchases range from $5 items, such as books, to $4,000 items, such as computers. Regardless of the value of the purchases, though, Langenderfer said e-commerce merchants face two potential problems when they accept any on-line credit card transaction:

* A higher processing rate than bricks-and-mortar retailers. Credit card companies consider the fraud rate higher among e-commerce businesses.

* A high-risk transaction. Web retailers are entirely responsible for making sure that each credit card user matches the actual credit card owner and not an unauthorized user.

Visa's policy, for example, is that the defrauded customer has zero liability, according to a Visa USA spokeswoman. Web merchants, however, can seek protection only from their acquiring banks. Otherwise, the merchant is liable for any fraudulent transactions.

This results in banks creating higher "chargeback" fees for merchants to cover the expenses for the thefts of products and services bought by customers using stolen credit cards. Unlike the situation with major retail stores, banks usually will not cover fraudulent expenses charged to e-commerce vendors.

"Most banks are shy or hesitant to protect an Internet business from such fraudulent transactions because the risks are too high," said John Shirey of the electronic commerce division at Paymentech, a Dallas-based company that provides credit card processing for retailers. Some of Paymentech's bigger e-commerce customers include Amazon. com and America Online.

"It's almost like a Catch-22," said Jim Lanford, who cofounded Scambusters.com with his wife Audri. "It's virtually impossible to operate a business on line without accepting customers' credit cards. But at the same time, by [accepting them] you run some major risks."

The Lanfords, also the founders of the on-line marketing service Netrageous.com, set up Scambusters.com after they got stung by a Web shopper who charged $500 in services and goods from their site using a stolen credit card.

Scambusters.com is now one of the more visited sites among e-commerce merchants looking for advice and a place to vent about credit card fraud and scams on the Internet.

Swamped with e-mail from people sharing personal experiences and offering advice, the Lanfords compiled a list of eight scam-prevention tips for Web retailers. Among the pointers:

* Be wary of orders with different "bill to" and "ship to" addresses;

* Require customers to send a fax with their signature and credit card number authorizing the transaction;