Alex Henderson

Credit Card Fraud

By Alex Henderson
XBIZ, April 19, 2007

In November, 2006, electronic payment and online security specialist CyberSource announced the results of its 8th annual survey on e-commerce fraud: It reported that credit card fraud would cost U.S. merchants up to $3 billion in e-commerce revenue in 2006, up from $2.8 billion in 2005. It was also in November that the Association for Payment Clearing Services (APACS), a British banking association, released its own credit card fraud figures.

The good news APACS reported was that overall credit card fraud in the U.K. had fallen by 5 percent, from losses of approximately $428.6 million in the first half of 2005 to losses of $408.7 million during the first half of 2006.

The bad news, however, was that credit-not-present (CNP) fraud, which includes Internet and over-the-phone transactions, had increased and accounted for 46 percent of all credit card fraud in the U.K. during that period. That overall decrease of 5 percent, according to APACS, was due to fewer fraudulent in-person transactions. And the fact that online credit card fraud remains stubbornly persistent in the U.S., England and many other countries is a major concern for adult webmasters, who are well aware of the fact that too many chargebacks ultimately can put them out of business.

Choice Experts

XBIZ recently contacted several e-commerce experts to discuss the ways in which adult sites can prevent, reduce and combat credit card fraud — experts who include Rand Pate, communications director of Epoch Transaction Services/Paycom, a leading third-party payment processor; Bjorn Skarlen, former Internet director of the Barcelona, Spain-based Private Media Group and now manager of business development for the third-party processor CommerceGate; Christopher Mallick, CEO of 24-7 Commercial Marketing Inc. and owner/founder of ePassporte.com; Ron Jenkins, CEO of payment processor DHD Media; and Harlan Yaffe, president of the gay-oriented, Miami-based affiliate program PrideBucks.

All of the experts said that while CNP fraud remains a major problem, adult sites are less likely to become CNP fraud victims if they are proactive rather than passive, and there is a long list of things that adult sites — both membership sites and online retailers — can do to avoid CNP fraud and increase their chances of staying in business and prospering.

"Credit card processing online is somewhat more risky than brick-and-mortar transactions due to several factors, not the least of which is that you cannot ask for a photo ID," Epoch/Paycom's Pate explained. "Nor are you able to acquire a customer's signature.

"Think of an online transaction through the following analogy: It is the equivalent of having someone walk into a store with a sack on his head and make a purchase by reading his card number to the clerk — not offering identification, not signing a draft and walking out of the store with the product — then being able to call their bank and reverse the transaction by saying 'I didn't do it.'"

But Pate added that while CNP transactions can be risky, diligent third-party processors — also known as Internet payment service providers or IPSPs — have learned to decrease the risk of CNP fraud through the art of good, effective scrubbing.

"The better the scrubbing, e-commerce experts say, the lower the risk of CNP fraud. And smart, careful scrubbing includes not only making sure that a credit card number matches the appropriate name, address and ZIP code, it also includes verifying the CVV2 or CVC2 number, which is the three-digit security code that Visa and MasterCard place on the back of their credit cards. In fact, asking for a CVV2 is mandatory in CNP transactions in some Western European countries.

CommerceGate's Skarlen noted that scrubbing can include white-listing or using VIP lists, which offer names of carefully screened and verified customers. According to MerchantSeek, a company that recommends merchant service providers, other methods of reducing the risk of CNP fraud can include scrutinizing orders from developing countries; scrutinizing people using free email accounts, such as those from Yahoo or Hotmail; and posting warnings that all IP addresses are being logged.

"Scrubbing will never be 100 percent, but you can ask a lot of questions," Skarlen said. "You can put people on the whitelist."

Vanessa Riles, customer service manager for Babeland, a company that started in 1993 and now specializes in selling sex toys online, asserted that adult sites need to be as vocal as possible when it comes to keeping law enforcement agencies abreast of fraud occurrences.

Stop, Thief!

"Often the same person will commit multiple acts of fraud with different aliases and different credit cards," Riles noted. "If you don't act to stop the person, he will most likely fraud your company again. It is also imperative that the adult company makes sure that the situation is well documented within their own order management system so that it will not ship to that same person again. There are many ways to limit the company's vulnerability, like increasing the number of parameters that must be met for an order to even go through into its system."

Riles estimated that in 2006, Babeland "lost about $10,000" to credit card fraud. But the adult sites that are the most vulnerable to CNP fraud, according to ePassporte's Mallick, are not sites that sell and ship physical merchandise but rather membership sites specializing in online adult content. Mallick, who before founding ePassporte.com gained considerable experience fighting CNP fraud during his years at Paycom, said that on the adult Internet, CNP fraud is "less severe in deliverables than intangibles, such as content. Adult webmasters offering content only are clearly the biggest victims."

For content/membership adult sites, Mallick said, most CNP fraud is not from stolen credit card numbers but rather so-called "friendly fraud." Mallick estimated that friendly fraud "accounts for 80 percent of all chargebacks in our industry. Friendly fraud is hard to fight. The reason is that a cardholder can make a 30-second call to his bank and bam, the chargeback is done. There is too little friction in this area, in my opinion. It should be more difficult than saying, 'It wasn't me.'"

But whether they are the result of friendly fraud or stolen credit card numbers, too many chargebacks can be devastating to adult websites — and Mallick asserted that adult membership/content sites that do their own billing instead of using third-party processors are taking a huge risk. Experienced IPSPs, he explained, have fine-tuned their methods of identifying and combating CNP fraud and keeping chargebacks to a bare minimum. In fact, Mallick said that CNP fraud would have been the downfall of adult content/membership sites were it not for IPSPs.

"I can tell you as an absolute fact that without third-party processors, adult content sold online would have been shut off by the card associations," Mallick asserted. "The card associations would not have allowed adult webmasters to bill for adult content. They would have simply gotten out of the space the same way they have done with gaming in the U.S. And I think that most people understand that. It's the people who have gotten into the business only in the last five years or so who don't know about the battle that went on and how close adult webmasters were to extinction with respect to credit cards."

Fraud is Rampant

DHD Media's Jenkins pointed out that while CNP fraud is a major problem for mainstream sites, it is even more problematic for adult sites. "The way that the card associations, Visa and MasterCard, profile online adult entertainment companies is very different from [the way they profile] mainstream companies," Jenkins explained. "Because of the adult nature of the content, banks are both more willing to accept the chargebacks from the consumer and are quicker to impose penalties on the website as a result of too-high chargebacks."

Pate said that because operating adult sites is demanding in so many ways, webmasters save themselves considerable time by hiring third-party processors to handle their billing.

"With an IPSP," Pate said, "both the site owner's interests and the interests of the billing company are completely aligned. Each is concerned with risk vs. reward, and the goal is to process as many transactions as possible while maintaining established thresholds. This isn't the case when working with your own merchant account; your bank does not share the same concerns, nor does it have the same commitment as your IPSP."

One complaint that some adult webmasters have had about IPSPs is that they think their customer service representatives can be too quick to give refunds — even if a refund is not really deserved and the rep thinks that friendly fraud may be occurring. But Mallick and Skarlen both emphasized that if IPSPs' customer service departments took a more hardline approach, the result would be more chargebacks.

"If we are doing refunds," Skarlen explained, "we will have clients calling us up and saying, 'Hey, why do you do so many refunds?' and we will tell them, 'Well, it's to prevent the chargebacks and keep your account alive.' They will say, 'Isn't this a little bit too much?' And we will say, 'We don't think it is too much because we know from our experience that if we keep it like this, you will stay alive and keep your account.'"

"If someone calls a call center and demands a refund, you can tell them no and explain why if you have enough data," Mallick noted. "But generally speaking, if you say no, that customer is going to hang up the phone, end the call to your call center and call their bank — and in 30 seconds, there is going to be a chargeback. The card associations have made it very easy for consumers to deny transactions. Understanding how to bill is a huge, huge undertaking for any company, and webmasters needs to understand that third-party processors are there because it is such a difficult industry and such a difficult business model."

Unforgiving Chargebacks

PrideBucks' Yaffe stressed that because Visa and MasterCard's rules on chargebacks are so unforgiving, adult sites must "keep their standards as high as possible" when it comes to sales — and if they have any doubts about a transaction, it is always best to "err on the side of caution." But unfortunately, Yaffe said, some adult sites are so anxious to make a sale that they do not scrub adequately and therefore put themselves in jeopardy.

"Getting an extra sale or two may help your stats look better for one day, but if it ultimately bites you in the posterior and eliminates your ability to make a living every day, then it certainly is not worth it," Yaffe stressed. "By lowering the standards to a minimum, you might get the most transactions, but you are also carrying the most risk. PrideBucks is much more interested in being around for the long haul. We absolutely err on the side of caution; if a sale isn't bona fide, it's not doing me any good. We would rather ensure ourselves and our affiliates that we are going to be around in another three years than go for the extra sale now."

Mallick explained that when it comes to credit card fraud, the adult Internet is battling an abundance of criminals who are as cunning as they are technologically sophisticated. But while it is impossible to eliminate CNP fraud altogether, Mallick said, adult webmasters can take comfort in knowing there are many experienced, savvy people in the adult Internet field — third-party processors and others — who remain committed to fraud reduction.

"The reality is that credit card fraud rises in direct relationship to the speed with which technology grows," Mallick explained. "When you plug one hole, another hole seems to open up somewhere else. There are a number of people with really bright minds who sit around thinking of new ways to be dishonest; those people are always going to be around, and as they evolve, sites will have to evolve. We will never be able to get rid of credit card fraud completely, but good minds can make it more difficult for the crooks."♦♦♦