Methods of Fraud Prevention

An effective fraud prevention strategy uses a number of methods that are best suited for your business while keeping any customer burden to a minimum. A strategy that uses too few methods of fraud prevention cannot prevent a lot of fraud. Likewise, a strategy that uses too many methods can result in false positives–this causes frustration for your customers as they may need to take additional steps to complete their order, or be unable to complete it at all.

This balance between an acceptable level of losses and customer conversion is central to how you develop your fraud prevention strategy and decide upon the methods you use. Too strong a strategy can be almost as detrimental to your business as having a weak strategy. Depending on the service you provide, the goods you sell, or how your business operates, certain methods are more effective than others.

Our fraud prevention toolset, Radar, is built directly into the payment flow and combines a customizable rules engine with powerful machine learning algorithms. This process detects patterns across payments from each and every business processing payments with Stripe, assessing each payment processed for risk. You can use the features of Radar to create a highly effective fraud prevention strategy.

Rules-based methods

Using rules, you can adopt methods that evaluate payments based upon your specific criteria, and take the appropriate action automatically. You can also create rules that make use of multiple criteria, allowing you to allow or block payments that meet multiple conditions. The following recommendations for rules can help prevent many common attempts at fraud.

Card verification code check (CVC)

The CVC (also referred to as CVV) is the three or four digit number printed directly on the credit card, usually either on the signature strip or the front of the card. Businesses cannot store the CVC number, so it’s unlikely that a fraudster who has acquired card details through the use of hacking has this information.

CVC numbers were implemented by the banks and card networks to reduce “card-not-present” fraud, so that only those in physical possession of the card should have access to it. However, this does not protect against physical theft of a card, or card data that is compromised when used on a compromised computer or website that isn’t secure. Making use of the CVC check provides an important signal to businesses. Issuers can, and do, authorize payments that fail the check, so rejecting these types of payments is well worth considering.

Radar includes a built-in rule to block any payments that fail the CVC verification check. This can be enabled or disabled within the Dashboard.

Address verification (AVS)

AVS is comprised of two checks: one based on the ZIP code and another based on the street address. AVS checks determine whether both of these pieces of information match the billing address on file with the card issuer. If either of these checks fail, there’s a higher chance that the person making the payment is not the legitimate owner of the card. It’s worth noting that there are situations where these address checks can fail on legitimate transactions. For example, a customer entered their address incorrectly, or has recently moved and not yet updated their address with their bank.

Despite the limited support internationally, AVS can provide you with powerful signals for fraud, and are particularly important if you ship physical goods. Shipping to a verified billing address provides a strong remedy against fraud, particularly if you ship with a signature requirement on delivery.

Radar also includes a default rule to block any payments that fail ZIP code verification, which can be enabled or disabled within the Dashboard.

Country limiting

If you’re experiencing increased fraud coming from certain countries, you can set up rules to block payments from any country you do not want to accept payments from, using the :ip_country: and :card_country: rule attributes. For example, you can create the following rule to block all payments and cards originating from Canada:

Block if :ip_country: = ca and :card_country: = 'ca'

Similarly, if your business only supports the country it operates in, you can create a rule that blocks any payments from all other countries. For example, a rule to block payments that don’t originate from Australia is:

Block if :ip_country: != au and :card_country: != 'au'

Card type limiting

You can set limits on which type of cards to accept, either by brand, (e.g., Mastercard), or by funding type (e.g., pre-paid). This can be particularly helpful if you see excessive fraud from certain card types.

To block payments from all Visa-issued debit cards, an example rule would be:

Block if :card_brand: = visa and :card_funding: = 'debit'

Manually review payments

Radar includes a review process that allows you to place certain payments into review–though keep in mind that these payments are still processed and the credit card charged. These payments are placed into the review queue for you to take a closer look at. Should you suspect that the payment is fraudulent, you can refund it.

Here are some considerations when reviewing a payment:

• Does the billing address match the shipping address?
• Has the billing address been verified by AVS? Does it also match the card’s country of origin?
• Does the customer’s email address match the cardholder’s name?
• Is this an order that the customer has asked to be expedited?
• Have multiple orders from different credit cards originated from this same IP address?
• Has this customer made many order attempts that have been declined?

If you are unsure about a payment when you’re reviewing it, you should always contact the customer by phone or email. If a payment’s billing and shipping address do not match, look into the shipping address using Google Maps & Street View to find out more. A common tactic that fraudsters use is to have orders shipped to a freight/mail forwarding service or storage facility that forwards the goods to their actual location.

Delayed shipping

If you’re shipping physical goods, consider delaying cthe shipment of goods by 24-48 hours. This time gives cardholders a chance to spot any fraud on their accounts. However, not all cardholders check their statements on a daily basis, and their bank may not proactively contact them about the transaction.

Customers that request overnight or expedited shipping should be considered higher risk, as the increased cost of such services is of no consequence to fraudsters. One tactic you can use to identify these types of payments is to offer same day or overnight shipping at a very high cost–many times more expensive than any other shipping option you provide. It’s far less likely that any legitimate customer would pay such a high cost, but a fraudster would want the goods to be shipped as soon as possible and have no regard for the additional cost. You can then manually screen any customers that opt for the expensive shipping option and scrutinize the order to determine if it looks genuine.

Auth and capture

When there is an attempt to charge a credit card, it is processed in two parts. The charge is first authorized by requesting authorization for the amount to charge from the bank. Once approved, the charge is then captured immediately afterwards and the amount deducted from the card.

Auth and capture is the process of performing these two steps at separate times. The authorization can be made first, which holds the amount on the card and appears on a customer’s statement as a pending transaction. The charge can then be captured up to seven days later. Capturing a charge completes the payment and the funds are deducted from the customer’s card. If a charge is not captured within the time limit, the authorization is released.

Similar to delayed shipping, this method can allow enough time for potential fraud to come to light, giving you the option to carefully review the transaction.

Statement descriptors

The statement descriptor is the line that appears on customers’ card statements with information about the company that’s associated with a payment. One use of this is to insert a short, random code that your customer then has to verify. When you suspect a transaction might be fraudulent, you can contact your customer and ask them to give you the code that is shown on their online statement.

You can use either edit your default statement descriptor within the Dashboard or set a dynamic statement descriptor whenever a payment is created through the API. While this method cannot help against a fraudster that may have access to a cardholder’s online bank or credit account, this is extremely rare. Using the statement descriptor in this manner can provide reassurance that the customer is likely to be genuine.

Card number blacklisting

If you see an increase in fraud coming from a small set of credit card numbers, consider blocking further payments from them. You can use the API to set up card restrictions, or click the Report Fraudulent Payment button when viewing the payment information in the Dashboard to refund it and flag the transaction with Stripe.

Identity verification

For some, verifying the identity of customers can be beneficial. Asking your customers to connect their Facebook or LinkedIn accounts, for example, can serve as further proof of their identity. Connecting a social networking account doesn’t prove who a person is, but it’s an extra step that a fraudster might not take. Of course, some legitimate customers may not want to go through this additional process, and your conversion rate may suffer as a result.

• Next: The Consequences of Fraudulent Payments