Merchant Fraud Awarness - Takeover Targets

[SIGP250]

If you accept credit cards and especially if you do business by mail order or Internet, I would advise you to adopt some merchant fraud fighting priorities to lessen your exposure losses.

The vast majority of US consumers have credit and debit cards. Plastic is an easy way for retailers to accept payment since cash transactions may not be possible. You also will usually not want to risk billing an unknown customer.

As online shopping has increased it has also become more appealing to criminals who steal credit and debit card accounts of legitimate consumers. Criminals can not only steal a credit card number, they can also take control of the account, change information in various way that makes it easy for them to steal valuable merchandise online.

It is reported that about 44% of fraudulent account takeovers include changing the card holders address. This makes it possible for the criminal to have the merchandise sent to what is seemingly a legitimate address and may not raise a red flag to the merchant when the card holder billing address and shipping address appear to match.

Checking for fraud transactions is not an easy task. Phone verification seldom works because so many people now use mobile cell phones.

Credit card thieves sometimes use scanners that can read the magnetic strips and decode a credit card number. This is only one way to steal a credit card. Frequently, many fraud credit account takeovers begin with the criminal stealing the cardholders credit card statement from their mailboxes. Once a criminal has a stolen credit card, they often will find a foreclosed house to have the merchandise delivered to. Sometimes they will break into the house but many times they just wait for the delivery, sign for the package and then take off with the goods.

Unfortunately, Merchant Service that retailers pay to process credit cards for them do not actually "Approve any transactions." It is up to the merchant to approve a transaction and take ALL the risk.

Credit card companies namely MasterCard & Visa bind the credit card gateway, the card processor and the retailer to their terms and conditions by contract. Credit card companies often advertise to cardholders that they are protected from any fraudulent transactions.

The way they are able to guarantee the cardholder is is by issuing what is known as a Charge-back to the retailer. The banks and credit card companies never pay a dime of their money to the cardholder.

The retailer in effect becomes the victim of the fraud. The cardholders money is credited by debiting the retailers Business ACH account for the Charge back. Penalties and additional fees may also be charged to the retailer depending the merchant services agreement the merchant services provider agreement with the actual processor.

Dealing with fraud is expensive. for every $100 in fraud, a retailer should expect to pay about $235 in recovery costs not including the merchandise that is almost never recovered.

Fraud and theft should be expected as part of the cost of doing business but can be minimized.

This is a busy time of the year for most retailers and even busier time for criminals. For gun shops fraud will seldom involve guns. It will be usually involve fraud purchases of firearm accessories.

Educate employees to spot unusual transactions. This should be done in a way the does not alarm or offend honest legitimate customers.

A few suggestions:

• Educate employees to spot unusual transactions. This should be done in a way the does not alarm or offend honest legitimate customers.
• Do not accept personal checks.
• Do not accept money orders these are easily counterfeited too. If you do accept money orders only accept USPS certified money orders.
• Do not accept phone in credit card orders. There is no paper trail with this type of transaction and criminals know this.
• Always require an address, 5digit zip code and 3 digit security code (CVV2) match from the back of the card for any non-swiped card transactions.
• Ask for a second form of valid Id for all swiped purchases over $50.00.
• Do not ship to an address other than the cardholders unless it can be verified. A company address can usually be verified by phone and the use of tools such as a white pages search and Google maps.
• Criminals will often target merchandise that is in high demand and easy to sell. These items include expensive rifle scopes, lasers, night vision equipment, some knives, uppers and parts for M4 and AK rifles, large quantiles of ammunition, etc. Anything that can be delivered directly to the customer is a potential thieft target.
• It is often difficult or next to impossible to contact the cardholders credit card company or issuing bank. If the item(s) amount is $500 or more, it is wise to try calling the customer to confirm. I also always send an email order confirmation with a read and acknowledge flag.
• Police are aware of fraud and identity theft but do not have the time or resources to investigate cases less than $5,000. While the FBI has an Internet fraud division, they will not act unless the crime involves seven figures or more, yes, I said $1,000,000 or more.
• Do file an incident report with your local police department if you become the victim of cardholder fraud. This report will be your receipt for loss (theft) that you may be able to write off on your taxes.
• Don't expect any common carrier to take responsibility even though your package should be insured. An adult signature is all that is required. Carriers are not required to obtain the card holders signature, only a signature. The purpose of the signature is for proof of delivery, nothing else.

Good luck to all retail, e-retailer FFL dealers.

[DefensiveCarry.com]

[ctr]

[*]Do not accept personal checks.[*]Ask for a second form of valid Id for all swiped purchases over $50.00.

Speaking as a customer, these 2 practices will anger me enough to take my purchases elsewhere. I often pay higher dollar purchases by cash or personal check.

If the merchant swipes my card and then asks for a photo ID, I'll just cancel the transaction and walk out. I'm more concerned with having my identity stolen from your business because you collect personal information that is not relevant or required for the transaction. In short, I don't trust your business to safe guard the information, and I don't trust your employees behind the counter with my personal information.

[SIGP250]

Cash is always welcomed by retailers. For your protection, make sure you get a receipt and keep it for the life of the product warranty. In fact many retailers will offer up to a 3% discount for cash. Paying by check or debit card works fine for paying utility bills but can be trouble for both customers and retailers. debit cards are not credit cards. All money is debited directly from your checking account. If you become the victim of a stolen debit card, there is a good chance that your bank account can be cleaned out in a matter of minutes. Debit cards, while convenient offer less protection for the card holder though they are issued by credit card companies such as MasterCard and Visa.

Due to high numbers of lost or stolen credit cards, it has become standard practice to require a picture ID for purchases of over $50.00. This includes stores such as Cabalas, Gander Mountain, Home Depot Best Buy, Office Depot and even many super markets. Payment by check may work for you if you only shop locally. If you buy over the Internet or stay in a hotel out of town, good luck trying to pay by check.

[high pockets]

Talking about checking difficulties; the last time I re-located was a nightmare. As a result of several transfers close together, for my first three months in Atlanta, I had a Missouri drivers license, an Indiana address on my checks, and an Atlanta address for my mail, and deliveries. Oh yeah, also had Los Angeles and Atlanta addresses on my business cards.

What a circus that was! Needless to say, I spent those months using cash and Amex, because everyone was leery of taking my checks. I even had to have my office pay my rent until I bought a house here, and changed all my IDs.

[ctr]

I shop at both Cabela's and Home Depot. Many purchases over $50 and I have never been asked to show a photo ID, ever.

[Tubby45]

Ask for a second form of valid Id for all swiped purchases over $50.00.

You cannot ask for ID for any credit or debit card transaction. Doing so violates your merchant agreement and they can drop you and blacklist you permanently so you cannot obtain a merchant account again.

I'm a cash only business.

- Retail mail order customers pay in USPS money orders only.
- Dealer mail order customers pay in USPS money orders or bank/CU drawn certified money order/cashier checks only.
- In person retail customers pay cash money only.
- Transferable machine guns are the exception and I accept bank transfer only on these.

[QKShooter]

Do not accept phone in credit card orders.

I use my credit cards for phone orders all the time. In fact...three times just today. I always shop on line and then phone in my order w/ a C.C.

A merchant these days is going to lose a ton of business if they don't accept phone in C.C. orders. That's crazy talk.

[CaptainBob]

Speaking as a customer, these 2 practices will anger me enough to take my purchases elsewhere. I often pay higher dollar purchases by cash or personal check.

If the merchant swipes my card and then asks for a photo ID, I'll just cancel the transaction and walk out. I'm more concerned with having my identity stolen from your business because you collect personal information that is not relevant or required for the transaction. In short, I don't trust your business to safe guard the information, and I don't trust your employees behind the counter with my personal information.

Asking for a photo I.D. is not "collecting personal information" it's just verifying that you are who you say you are right there, right then. There's no record taken of this 2nd form of I.D. and a legitimate customer should actually appreciate this verifying service because, if you had lost your card and someone else is trying to use it, it can save you money.
I never mind being asked for extra I.D. and I tell the clerk so and thank him/her.
I do try to avoid CC sales (with cash discounts) but, if you don't advertise that you do accept cards, it makes your business look a bit less professional. Accepting only USPS money orders is a good idea and that is what I already do. Personal checks are accepted but only through the mail with waiting time for clearing. real cash is best but even then you could get stuck with a counterfeit bill.... I've only been hurt once and that was with a check that had "cleared" but actually later bounced (legitimate account and person but insufficient funds that they never made up). It was for $350 and in Ohio anything over $300 on a bad check is a felony. They declared bankruptcy thinking all their debts would be wiped but a bad check isn't. Took 8 months working with a police detective but they paid (in court on the day of the hearing) to avoid that felony charge.

[ctr]

Asking for a photo I.D. is not "collecting personal information" it's just verifying that you are who you say you are right there, right then. There's no record taken of this 2nd form of I.D. and a legitimate customer should actually appreciate this verifying service because, if you had lost your card and someone else is trying to use it, it can save you money.
I never mind being asked for extra I.D. and I tell the clerk so and thank him/her.
I do try to avoid CC sales (with cash discounts) but, if you don't advertise that you do accept cards, it makes your business look a bit less professional. Accepting only USPS money orders is a good idea and that is what I already do. Personal checks are accepted but only through the mail with waiting time for clearing. real cash is best but even then you could get stuck with a counterfeit bill.... I've only been hurt once and that was with a check that had "cleared" but actually later bounced (legitimate account and person but insufficient funds that they never made up). It was for $350 and in Ohio anything over $300 on a bad check is a felony. They declared bankruptcy thinking all their debts would be wiped but a bad check isn't. Took 8 months working with a police detective but they paid (in court on the day of the hearing) to avoid that felony charge.

I just told you what a legitimate customer thinks. The practice is wrong. Security cameras are often set near or over registers at business. Information can and is collected. Lots of cashiers have camera phones - I should know, my credit card number was stolen that way once already. I have been subjected to credit card theft and attempts at identity theft. I now guard my identify, including photo id, drivers license number, etc, with complete seriousness.

You do want you want in your business - I won't be your customer.

[SIGP250]

There are always going to be differing points of view in any open forum discussion. This topic is about best practices for merchants. These practices do include valid concerns consumers may have. No one wants their identify stolen and many feel that security cameras infringe on privacy. the flip side of this argument is that many criminals have been identified by security cameras and later convicted based only on this evidence.

There have been cases were a person wearing a vial was not served in a mattress shop. The person claimed it was her religious right and culture to cover her face in public. The Shop owner insisted that he had the right to see the persons face for visual identify and his security. The shop owner won the case because he has the right to refuse business to anyone for any reason.

You cannot ask for ID for any credit or debit card transaction. Doing so violates your merchant agreement and they can drop you and blacklist you permanently so you cannot obtain a merchant account again.

What? From MasterCard Rules - Merchant edition Security Rules and Proceedures

http://www.mastercard.com/us/merchan...ual_public.pdf


3.11.1 Formset Contents

Each copy of a retail sale, credit, or cash disbursement formset shall satisfyminimum statutory and regulatory requirements in the jurisdiction in which theslip originates and any applicable regulations, issued by the U.S. Board ofGovernors of the Federal Reserve System or other regulatory authorities, andshall contain the following:• In the case of retail sale and credit slips, a space for the description ofgoods, services, or other things of value sold by the Merchant to thecustomer and the cost thereof, in sufficient detail to identify the Transaction.• Adequate spaces for:– Customer’s signature– Card imprint and the Merchant or bank identification plate imprint– Date of the Transaction– Authorization number (except on credit slips)– Sales clerk’s or teller’s initials or department number– Currency conversion field– Merchant’s signature on credit slips– Description of the positive identification supplied by the Cardholder oncash disbursements and retail sale slips for certain unique Transactions.• A legend clearly identifying the slip as a retail sale, credit, or cashdisbursement and identifying the receiving party of each copy.• On the customer copy of the formset, the words (in English, local language,or both): “IMPORTANT—retain this copy for your records,” or words to

similar effect.


Asking for a second form of ID for large purchase is actually a MasterCard Visa rule that must be agreed to by merchants. It may or may not be enforced by some store owners but in case of a dispute or charge back situation, the ID serves both the merchant and the bank that issues the card in determining the outcome of a claim.

I know of no state law that prohibits additional ID although there may be one. Even Banks will ask for positive id before allowing you to access your account or write a check for cash. Any private establishment can accept or deny any form of payment. Stamps are no longer an acceptable form of payment but could be taken if the merchant was willing to accept them. This is barter and exchange for trade.

I do know of a case where a individual attempted to pay a utility bill by dumping a large sack of pennies on the clerks counter in protest. He was arrested. I don't know what the exact charges were.

As for phone in credit card orders, You can accept them. Many merchants do. I don't for the simple reason is that It is not secure as an SSL encrypted on line shopping cart system, I could make a mistake causing a shipping delay or an invalid card response. This angers customers. When they fill out their on line order with our Encrypted system, it is consumer insurance underwritten with a $1,000,000 guarantee by VeriSign, Network solutions or any company that offers guaranteed SSL encryption.

As for doing business by Internet. Current consumer protection laws and the new federal consumer protection act require that all website post their privacy policy on line. This requirement is now being enforced by most on line advertisers in their terms and conditions.

[SIGP250]

Do not accept phone in credit card orders.

I use my credit cards for phone orders all the time. In fact...three times just today. I always shop on line and then phone in my order w/ a C.C.

A merchant these days is going to lose a ton of business if they don't accept phone in C.C. orders. That's crazy talk.

What you are describing, I think is buying from a source that you have an established business relationship with. I will phone in certain orders with some distributors. They have all my information on file but is not quite the same as an open account. We have ACH accounts with large distributors that we regularly buy from. The entire order and banking process is 100% electronic.

If you are now paying by credit card you might inquire about faxing Echecks instead. This can save you 3% with some suppliers.

[QKShooter]

Your thread is an interesting thread from a "strictly consumer" point of view. Which is what I am.
I'm one of these folks that seem to do a lot of C.C. consuming.
For some weird reason I have this long standing stigma about typing my C.C. info even onto Https: Secure Internet pages so I always "shop on line" but, phone my actual orders in.
If any on-line merchants have a PayPal option (and it seems like the business might be a bit less than 100% professional) (based on their web site being half-assed) I will sometimes just pay on line with the "credit card option" through PayPal - since the merchant then just gets paid but, does not get my actual C.C' information.

Very recently I've made Quantity 6 (pre-Christmas) C.C. payments by way of phone order. I've never dealt w/ any of those merchants before.
Just posted as a FYI - only two merchants asked for the 3 digit code that appears on the rear of my card.
Most merchants seem to be satisfied that the ordered item is being shipped to the same address that the card is issued to.

Some places that I deal with all the time (like Brownell's) my C.C. # & shipping info. is already on file and they always just ask me if all of my info is still the same.

Recently on the radio I heard it suggested (for making in store C.C. purchases) that the card holder sign the back of the credit card and then right below their signature write REQUEST PHOTO ID to help protect against stolen credit card use.
I'm one of those folks that never sign the backs of any of my credit cards.


Even for non-firearm purchases Gunbroker type sellers always want a postal money order. That's cool but, it IS a bit of a PITA for the buyer AKA hitting the bank - getting the cash - standing in line at the P.O. - filling out the M.O. blah blah. My local Post Office is understaffed so it's an extra PITA.

Very often I will pass up on an Ebay or a Gunbroker seller that will only take a M.O. and I will pay a bit more $$$ and go with a different seller that will either take PayPal or a C.C. by way of a phone order.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"If you are now paying by credit card you might inquire about faxing Echecks instead. This can save you 3% with some suppliers."

That's an interesting idea that I never even considered.

[phreddy]

I appreciate it when merchants ask for my ID with credir cards transactions. Even though I may be protected against losses by the card, it takes a lot of time to deal with when your card is used fraudulently. I want the companies I do business with to protect themsleves and me by doing whatever they can to verify the identity of their shoppers.

[SIGP250]

Not to beat a dead horse but... Buying by Internet increases each year. Last year it amounted to 15%. This year the estimate is 17% of ALL retail holiday purchases.

Internet fraud is very much on the rise. I get one or two criminals trying to purchase expensive items daily. It is usually a $600 Eotech scope Or a $1,000 Leopold. These are non regulated firearms accessories that can be sent directly to legitimate customers, unlike firearms that must be transfered to an FFL in the buying customers state.

The billing address is that of a stolen card, The shipping address always includes the cardholders name but a different shipping address. The phone number is always bogus as is the required Email address. Most do not include the 3 digit security code.

We just void the transaction and ban the fraud customer (each time using a different card number and address), over and over.

We also check IP addresses. Most of the time they are the same. These could be traced but the Issuing Banks have no incentive to prevent fraud since they are able to turn the merchant into the victim. An LA FBI Internet Fraud Agent told me they would not touch a case under Seven figures and the thieves know this.

[avery]

It is indeed important that we are equipped with enough information that could guide us about the pros and cons of having financial assistance. For numerous small businesses, taking charge cards is almost entirely necessary. For some smaller businesses, however, the agreements required to take charge cards can cause severe problems, and a rare open-court suit is bringing these contracts into question. Resource for this article: Merchant account agreement cited in rare court fight