What is a fraudulent (or bogus) order?
Simply, a fraudulent (or bogus) order is any order that is made with a stolen credit card. Whether the name on the card is correct or the shipping address is the same as the billing address, it doesn’t matter. It’s bogus, and should be dealt with right away!
What causes a bogus order to come through your shopping cart?
That depends on a number of independent factors, but in this day and age (of ID theft and global commerce), no online merchant is exempt from fraudulent (or bogus) orders. Typically though, these bogus orders occur because:
Your Site IS Highly Visible — If your site gets a lot of traffic, chances are a tiny % of people coming to your site may have the intention of testing your shopping cart with a stolen credit card (or two or three) to see if those cards are valid, working credit cards. In comparison, the more people walking into an (offline) store, increases the likeliness of at least one person wanting to shoplift in your store and steal from you. It’s just reality. On the web, it works just the same. So, keep in mind, the more traffic you get, the more susceptible you might be to receiving the occasional shoplifter in the form of a fraudulent (or bogus) order.
Your Sales Are High (or) Low — Whether you have a lot of sales or few sales or no sales at your web site, the occasional thief might come along with a stolen credit card and attempt to place an order through your site. The higher (number) of sales you receive, the greater the chance one of those orders might be a bogus one.
Your Site Presence Is Obscure & NOT Highly Visible — Don’t you worry, thieves will steal from anyone! You don’t have to have a lot of traffic to your site to be a victim of a bogus order. If someone (with the intent to use a stolen credit card to place an order through your site) finds your site, chances are they’ll go for it and try testing a stolen card through your site.
Why do bogus orders take place in the first place?
Typically, bogus orders take place because criminals, losers, thieves and other self-interested individuals (around the globe) want to use your shopping cart to test (yes, TEST) one or more credit cards to see if they are valid and working.
If these criminals are successful in TESTING a valid, stolen credit card through your shopping cart, by purchasing any low or high-priced item, they know they can turn around and sell that valid, stolen credit card on the black market for real money. Never are these people ever interested in receiving your new book, fabulous audio program or attending your next workshop, for that matter.
For the most part, all they want to do is test a credit card, which they somehow acquired illegally, for its validity and sell it to someone who will give them real cash for it. That’s what these criminals do. Period.
For example, a client of mine once received an order for his recently published book. Quantity? Ten copies! Total order amount? $250 + shipping and handling. He was so excited. I immediately suspected something was up and asked him where the order came from and where it was to be shipped to. He replied, “It came from someone in Nigeria.” I told my client to eMail the customer and ask them one simple question, “We have a question about the shipping. Can you contact us either by eMail or telephone? Are number is …”
I then told my client, “If you don’t receive a response within 12 hours of the order, you should void the entire transaction immediately.” The next morning, my client checked his eMail. No response. He then called the number listed with the order. No response. Why don’t you think the customer never responded to my client’s request to verify the order? Do you think the bank robber wants to talk to the bank manager after robbing the bank? “Uh, yeah can you call me a cab? I need a ride outta here!”
How can you spot a bogus order when looking through your orders?
There are several ways to spot a bogus order when it comes in. For starters, you should check your orders daily and verify them closely that same day. Here are some ways to do just that:
IP Address Is Different From Billing/Shipping Address — This is my first choice! While bogus orders are hard to spot, the easiest way to spot them is to randomly compare the IP Address (location) with the shipping or billing address of the credit card holder. Looking at the screen shot below (in this example order), you can see the (bogus) customer placed this order in CHINA.
If you track the IP Address (18.104.22.168) you can verify that, like I have below. Notice that it doesn’t really match the billing or shipping address of the card holder? (i.e., New York) Should you be suspicious of an order like this? Absolutely! Is it correct to assume someone in a foreign country is trying to test a stolen credit card belonging to someone who lives in New York? You bet. Should you terminate and VOID an order like this one? Yes!
If you ever want to to look up the location of a specific IP Address, just visit WhatIsMyIPAddress.com/ip-lookup. Then, copy and paste the customer’s IP Address (you see on the Order Details page within the shopping cart; as seen above) into the box you see on the IP lookup page, click the LOOK IT UP button and viola! You’ll see where that particular order was placed.
Then, you be the judge! If the geographical location of where the order was placed is vastly different from the customer’s billing or shipping address, then you would be wise to cancel the order and void the credit card transaction immediately in your online merchant account control panel.
Shipping Address Far Different From Billing Address — For example, if the billing address is in one country, and the shipping address is in another country, state or province, contact the customer to verify the shipping address. 99% of the time, the billing and the shipping address are the same for every order. So, for those that are different, follow-up with them.
Non-Working or Wrong Telephone Number — If you call a customer to question their order and the telephone number you call is a non-working number or the wrong number, cancel the order. If the customer wants the order that bad, they’ll contact you. Void the transaction, don’t keep the money, and let them order again. You can even use online phone books to check and see if a suspected telephone number is valid or not!
No eMail Response From Customer — This is my favorite and the easiest way to determine if you should cancel the order. If you suspect an order to be questionable, eMail the customer. They just sent you money. They’re anxious for their order. They may even be right there at their computer hoping their purchase went through successfully. If they’re an honest customer, they’ll respond to any eMail you send them. “Hi Customer, I was just wanting to verify your shipping address is correct. Can you reply with a yes or no response?” While that might seem like a simple question to ask, you can judge by their response (or a lack thereof) if you should cancel their order or not. Remember, SILENCE at the other end says something, and will help you decide whether to cancel the order or not.
In most cases, criminals don’t want to communicate with you, if they can avoid it. So, ENGAGE THEM IN CONVERSATION. In 99.9% of the cases, these con-artists will never contact you after they make their initial order. Remember, they just want to test the card to see if it’s valid. If the order goes through, they got what they wanted. Now, it’s up to you to prevent any charge backs that might occur because the original cardholder will eventually find out their credit card was stolen.
Orders Placed From Within Countries That Don’t Speak Your Native Language — Case in point, whenever I receive orders from other countries (outside my own English-speaking country), immediately I question the order. Why? In my case, I write books (in English). Why would someone in some third-world country be interested in buying my book? So instinctfully, I might void the order as soon as I receive it; maintain their credit card information on file; eMail the customer; attempt to engage them in some eMail conversation and see what results. I might be surprised and get a wonderful reply back, “Bart, I have been following your web sites and would like your book to read.” Oh, they speak English. Nice. That’s good. At that point, I might offer to call them and speak to them personally. They would love the opportunity to speak with the author/creator of the product/book/etc., wouldn’t you think? Then again, if I get …. “cricket … cricket …” (e.g., grasshopper sound of SILENCE at the other end), then I know to cancel the order and forget about it. This has been my experience. Take from it, what you can.
High-Risk Countries & Regions For Online Fraud — The following countries/regions are considered as high-risk for online fraud: Africa, Amsterdam in Holland, Belgium, Bulgaria, China, Eastern Europe, Egypt, Ghana, Indonesia, Malaysia, Russia, Nigeria, Pakistan, Palestine, Romania, Asia, Turkey, Ukraine and Yugoslavia. Now, while not every order you might receive from these areas will be fraudulent, it’s best to keep a watchful eye out for any order with any linkage to these countries/regions, PERIOD! Nine times out of ten? The orders are bogus, in my experience.
Several Orders Coming In Simultaneously From An International Affiliate — Just imagine, for a moment, that you run a very successful affiliate program from your web site. People from all over the world are allowed to sign up for your affiliate program, make sales and earn a commission. Sounds great, right?
Now imagine one of your affiliates is a potential loser-thief-criminal in possession of several stolen credit cards and identities to match. Now imagine this affiliate referring (i.e., placing a number of (bogus) orders him/herself), from the same IP location, within a single affiliate pay period to the tune of $1,000 or more in sales. You notice the IP Addresses, where the orders were placed, are the same, yet the billing and shipping addresses are all different because each order was placed with a different credit card owned by a different owner living in a different location around the world.
Hmmm!!! What winds up happening is, and depending on your commission structure, you might pay this affiliate $100, $300 maybe even $500 in affiliate commissions after you run your affiliate commission reports.
Now suppose, you didn’t verify those (bogus) orders that came through your cart (all at once from a single affiliate) and in the end, you wound up paying that affiliate $500 in commissions (i.e., real money) when it was time to pay them. A few months go by, you don’t see any more sales from that particular affiliate, and you get a letter from your merchant account company informing you that four of your customers are requesting chargebacks for the orders you thought were legit.
Now, what just happened? An ill-minded affiliate earned bogus commissions off bogus orders he/she placed through your shopping cart. This is one way affiliates in other countries scam legitimate online business owners out of hard cash. I say “international” affiliates, because they usually know you are not going to come after them (physically/criminally) in their own country. If they lived in the same country as you did, they might have reservations about pulling this stunt, because they know you could send the local authorities after them, press charges and toss their behind in jail!
The lesson? Verify all new affiliates (especially those living in foreign countries). You can do this with a simple phone call (interview). If they show up for the telephone interview, they get to participate. If they don’t, then they can’t. End of story. Another method would simply be to have an online affiliate application form for all new affiliates to fill out. Have them describe how they will promote your affiliate program. Then, decide if you want them on your affiliate team. Make them work a little by asking them a series of questions up front. It’s up to you, but these are all great ideas to help protect your interests.
What can or should you do if you spot a bogus orders coming through?
If you do spot a bogus order in your list of new orders, here’s what you should do:
Act Fast — Do not waste any time on this. Contact the customer immediately to verify the order or cancel it by VOIDING the transaction in your online merchant account.
Call The Customer — That’s right. Pick up the telephone and call them to “thank them” for their order. In reality, you’re actually checking to see if their order is legitimate. What’s this? The number is a bogus number? No one at that residence knows a (Customer Name)? Cancel the order immediately.
eMail The Customer — Immediately, hit REPLY in your eMail in-box and ask the customer to verify some information about their order and ask them how they heard of you. Engage them in a conversation. What? No reply back to you within 12-24 hours? Cancel the order immediately.
No Reply = Void The Order — Again, no-response on the part of the customer warrants a cancelled order every time.
Void The Order Anyway — If you feel in some way, shape or form the order is bogus, cancel it anyway and let the customer contact you again. “I never received my product,” says the customer. “Really? We never charged your credit card. Thank you for calling. How can we take your order, now that you called?”
How can you help prevent bogus orders from coming through your site?
Here are some very simple ways you can help prevent bogus orders from coming through your web site:
Mention The Fact That You Monitor All Transactions — You can deter a number of potential ill-minded folk from submitting bogus orders by simply placing a statement on your web site and at the top of the CHECK OUT / ORDER FORM page that says something like this, “We monitor your order by IP Address, and take credit card fraud very seriously. All orders are verified for legitimacy. Violators caught will be prosecuted to the highest extent of the law no matter what country you place the order in. Thank you, and we look forward to serving you.” Feel free to reword that sentence any way you like. You can also shrink the font size on your site to make it fit nicely, like this:
Use CVV2 Protection — Most shopping cart systems will give you the option to require customers to provide the 3-digit code on the back of their credit card. Those who possess the credit card will have it. Those who only have the number on the front of the card, typically won’t.
Use AVS (Address Verification System) — This feature is available to you inside your online merchant account. Simply select what variables you would like to authorize the validity of each credit card coming through your shopping cart gateway account. The Address Verification Service (AVS) is a tool designed by bankcard processors to assist in identifying potentially fraudulent credit card transactions. For every credit card authorization, AVS compares the billing address and ZIP code provided by the customer to the address and ZIP code on file at the card issuing bank. AVS then returns a response code indicating the results of the comparison.
Ask & See If You Receive — Ask suspected customers to fax you a copy of the front and back side of their credit card. No response warrants immediate cancellation of their order.
Mention “No Order Is Shipped Before Verification” — Make it clear that all orders are verified before anything is shipped to the customer.
How can you block future bogus orders from going through your cart?
Your shopping cart should be able to help prevent future, bogus orders from occurring by utilizing these special built-in tools within the cart:
IP Address Blacklist — An IP Address is a unique identifier that is assigned to each computer on the Internet. You can think of it as the equivalent of a person’s home address online. All traffic on the Internet operates under an IP address assigned by their own Internet Service Provider. Being able to see the IP address for every customer who places an order through your web site acts as a powerful fraud protection benefits, because if you ever find yourself the victim of fraudulent activity, you can set your shopping cart account to block a customer (at a specific IP address) from ordering from you again.
Credit Cart Blacklist — If you find yourself the victim of fraudulent activity, you can set your shopping cart account to block the use of a specific credit card that is causing the problem.
eMail Address Blacklist — You can also block orders coming in that use a specific eMail address when ordering through your web site. If you ever find yourself the victim of fraudulent activity, you can set your shopping cart account to block the email address that is causing the problem.
Is it really a big deal? Why should you be worried about bogus orders?
For these very specific reasons, you should definitely pay very close attention to (preventing) bogus orders from happening and stopping them in their tracks (by canceling and voiding the orders) when they come through your cart:
Possible Legal Costs — It’s possible, but not always the case, where a card holder might sue you for more money than the purchase value was worth. Again, not always the case, they just want their money back and acknowledge their own card was stolen and you too (the merchant) were just as much a victim in this situation as they were.
Additional Bank Fees For Transaction Reversal — This is almost unavoidable. They might be small, but still, they can add up over time. Remember, you were already charged a % when the original transaction went through. Now, the card holder wants 100% of their money back. You lost money on the fee being charged (can’t get that back), and now you just lost the full sale amount. Ouch!
Extra Costs of Time/Money to Manage Each Fraud Incident — If, for example, you received 5 bogus orders in a one-month period, that’s a lot of time wasted tracking down customers, calling telephone numbers, waiting for eMail responses, you name it. Avoid that B.S. by monitoring your orders closely and choosing to void (or cancel) bogus orders from being processed.
Potential Loss Of Merchant Account Status — If you have too many of these charge backs within a certain period of time, the company who issued your merchant account to you might take it away! Who wants the risk of hurting more card holders? Banks don’t. The merchant company doesn’t. That means, YOU would have to give up your privilege of charging people’s credit cards because you’re not doing a very good job at helping to prevent fraudulent orders from coming through.