From BNG Payments - How to Report Credit Card Fraud as a Merchant
Contact the Customer or Issuing Bank
Contact the customer by email or over the phone to ensure the order is authentic. You can also contact the card-issuing bank; they can reach out to the customer for verification.
Additional in...
+1. Your own payment processor is where I'd start, since they'd be the ones processing the charge back later. Showing you did your good faith diligence is going to help defending against the chargeback, if nothing else.
I suppose that if the card user has obtained the details fraudulently, they might also be intercepting the rightful user's email, so the "contact the customer by email" suggestion might not be so good.
@AndrewMorton and they probably had the chance to specify a phone number too. The advice quoted seems a little odd (I'm geo-blocked from the source but can see a cached copy, and there's no warning about that, plus advice for card-present and card-not-present transactions is all muddled together)
I wonder if any of this protects the merchant, i.e., "you can't charge this back as unauthorized because I specifically called you about this and you verified it as legitimate."
@AndrewMorton: It seems more likely that the merchant hasn't been told the e-mail address of the rightful user. Where would OP get any contact details other that the ones submitted with the likely-fraudulent transaction? The con artist doesn't need to be reading the real cardholder's real email, he just submitted the purchase with an anonymous throwaway email address that the cardholder has never controlled.
@littleadv No it won't, if it's unauthorized there is no defense the merchant can mount sufficient enough to avoid the chargeback and it's penalty fee. The only way to avoid the chargeback is to refund before it is filed. As an aside, a chargeback is your most powerful weapon as a consumer - it hurts merchants and they nearly never "win".
@SnakeDoc yes, it will. The merchant will most definitely avoid the chargeback fee if they show that they raised a flag and the processor told them to proceed, and may avoid the chargeback altogether and have the processor eat the cost. Which is why if they raise it to the processor - the processor will reach out to the issuer, to similarly shift the blame. The issuer will then reach out to the customer.
We've been burned in the past with customers sending forged verification documents (id, bank statements, credit card photos). This 'customer' was suspiciously too eager to provide whatever information we required. A call to the bank seems to be the best option.
@littleadv The processor will never tell a merchant to proceed or not, unless the merchant has opted into their typically paid fraud detection mechanisms... the merchant is on their own - consequences and all. Been doing this a while... you just do not win chargebacks pretty much ever.
@SnakeDoc I've been doing this as well, I used to work for a processor. Yes, the processor wouldn't tell the merchant to proceed or not, but the processor would most definitely call the issuer, who would then most definitely call the customer, who then would be the one telling the merchant to proceed. I've had these conversations numerously.
@littleadv And while all that phone tag is going on a chargeback lands and the merchant eats it + the fee anyway. It might feel good to be the Good Samaritan, but it just doesn't work that way out here in the real world unfortunately. Refund it immediately if you think it's fraud and move on... that's just how it works. Besides... no one with real volume is going to chase down every possible fraud attempt anyway. It works this way because the issuers are never stuck holding the bag, and therefore the incentive to fix this situation is not present.
@littleadv You're assuming they get a hold of this customer in a timely manner. Or that they get a hold of the customer at all. You're assuming the processor will even care enough to call the issuer who will care enough to call the customer... maybe you heard about this happening at your place but it doesn't happen in reality. If fraud will be stopped by the issuer, it's at checkout either with 3DS or some other internal screening mechanism (location, etc). It's not through a phone call hours or days later... sorry, not buying that one bit.
@SnakeDoc I didn't hear about it happening, I've been doing it myself, I was the one receiving these calls from merchants and processors and calling the issuers and customers. If the customer doesn't confirm, or can't be reached - decline. That's all.
@littleadv You cannot decline a transaction that is already settled. Majority of online CNP transactions are settled immediately these days. Some places still pre-auth, yes, and for those you do have time to maneuver - I'll grant you that. But that's probably not OP's situation anyway. Which brings us back to square one - no one is calling folks hours or days later to ask if some old already shipped transaction happened to be fraud. It's just not the reality for ecommerce.
@littleadv Look, the reality is all CNP fraud could be stopped dead at the issuer level. They literally know everything necessary to make a really good guess if something is fraud or not. However, they shift blame to merchants who get stuck paying for fraud majority of the time (or paying additional fees to offload the burden), making for a near zero incentive to do something about the problem.
@SnakeDoc in this case the merchant clearly has time and process to confirm the transaction, it's not someone who's taken something away and is long gone. The product hasn't shipped, and is clearly expensive enough for the merchant to do the due diligence. No-one calls processors over $20 purchase, but yes - when it comes to thousands and tens of thousands of dollars per transaction: call. Call the processor, and the processor will call the issuer, who will call the customer.
@littleadv I would be surprised to see CC fraud for tens of thousands, but I'm sure it's happened. OP probably isn't in that situation given the language in their question (they seem rather new to this, which is ok). Anyway, even for a thousand some odd dollars, it's not going to be worth anyone's time to track down. Just refund and move on. The CH will report the fraud eventually. Sitting on the order and attempting to chase down the real CH on the off chance it isn't fraud risks receiving the chargeback in the meantime - especially if it's a significant dollar amount like we're discussing.
And in ecommerce, sitting on a paid order for longer than a couple days will significantly risk a chargeback - especially for higher dollar purchases. Real customer's get antsy, particularly on first-time purchases on unknown sites. You either ship the package or refund it... it's that simple. Everything else has no benefit to the merchant, makes no sense to do, probably won't have any desirable outcome anyway, and risks getting the chargeback none-the-less.
@SnakeDoc You either ship the package or refund it - no. Address verification is an actual process that both Visa and MC may require merchants to follow. Especially for new customers with large orders.
@littleadv AVS is done at checkout though. You get a code, and depending on the merchants risk profile they will accept or decline some subset of those codes - or accept all codes and handle risk internally through other processes. Even if you get an X, indicating an exact match for the entire address - and it gets a chargeback, you are still on the hook. True story... we had a carder attempt ship a couple dozen packages to the actual billing addresses. All low value... we shipped maybe half before we caught it. A real CH called us saying they didn't order anything... that was a first.
Discussion on answer by 0xFEE1DEAD: C…
Discussion on answer by 0xFEE1DEAD: C…