Card not present

Preventing fraud when a credit card is not present

Transactions where the credit card and cardholder are not present are referred to as card not present transactions, for example where a customer provides their credit card number by mail order, telephone order, fax or Internet.  The anonymity of the card not present environment can make it difficult to detect fraud.

With a card not present transaction and where no signed sales voucher or EFTPOS receipt exists, you may find it challenging to prove that the cardholder authorised the transaction.

Unfortunately, in the event of a dispute, the responsibility rests with you, the merchant, to prove that the cardholder did authorise the purchase. It is also your responsibility to ensure that the cardholder receives the goods or services.

Authorisation - what protection does it offer?

The authorisation number you receive via your terminal or by phone verifies that the card number and expiry date are valid and that there are sufficient funds available for the sale. The authorisation number also allocates the sale amount to the merchant (for a set period) until the sale comes through and is matched.

Authorisation does not identify the person the card belongs to or who is placing the order in the card not present environment. The key to reducing card not present fraud is verification of the customer's identity and address.

While authorisation is helpful, therefore, it should be combined with various other checks if the transaction appears suspicious. You should both review the transaction and create an order database to keep track of past fraudulent activity.

Check the transaction

Be alert for card not present transactions with several of these features:

• First purchases, since they may allow fraud offenders to minimise the possibility of identification
• Large dollar value orders that may be maximising purchases on stolen or falsified credit card accounts
• Multiple unit orders that maximise resale value and profit potential of the goods being ordered
• Orders shipped to Post Office boxes that may provide anonymity to fraud offenders
• Orders shipped "rush" or "overnight" to deliver fraudulently obtained items as soon as possible for quick resale
• Orders from free email services that do not require a billing relationship or verification that the email account was opened by a legitimate cardholder. These accounts may provide anonymity to fraud offenders
• Orders shipped to an international address that may be falsified

Create an order database

You can reduce your exposure to fraud by developing and maintaining a customer database to identify good customers, fraudulent customers and high-risk orders. Your order database should identify low and high-risk orders.

In your database, do not store full card numbers. Only keep a record of the first 6 and last 3 numbers on the card.

What to do if you suspect a fraudulent card not present order

If you are suspicious of an order, you may choose to:

• Decline the order
• Request additional customer information
• Confirm orders separately before shipping by follow up phone call, phone number verification and address verification