Card Fraud and Chargebacks for a Small Store

The order that looked like a good day

On a Friday afternoon, a small store takes its largest online order of the month: three of its most expensive items, express shipping, paid in full.

The card is approved, the parcel goes out that day, and tracking shows it delivered on Monday.

Five weeks later a notice arrives: the cardholder has told their bank they never made the purchase, and the money has gone back, with a fee on top.

The goods are gone, the sale is gone, and the store has a few days to respond.

What a chargeback is

An approval only means the card was valid and had room for the amount. It says nothing about whether the person typing the number owns the card.

When a cardholder disputes a charge, their bank reverses it, and the payment processor takes the money back from the store, usually with a fee. The store can send evidence; the bank decides.

For orders placed online, with no card inserted and no ID shown, the store usually carries the loss if the purchase was fraud. That is how remote card payments work.

Not every dispute is fraud

• Stolen card details, used by somebody other than the cardholder.
• Item not received, whether lost, taken from a porch or never shipped.
• Not as described, where the customer expected something else.
• A charge not recognised, because the statement shows an unfamiliar name.
• A promised refund that never went through.
• A real customer who disputes instead of asking for a return.

The fourth is the cheapest to prevent. If statements show a name customers have never seen, change it to the store's own name and web address, which most processors allow.

Warning signs worth a second look

No single sign proves fraud. Several together justify a pause before anything ships.

A shipping address far from the billing address, especially a parcel forwarding service that sends goods abroad. Several of the same expensive item, or the most resaleable stock, with the fastest delivery.

Repeated declined attempts before one card works, or several cards tried for one address. An email address that looks generated, or a phone number from nowhere near the billing address.

And a first-time customer who asks, after paying, to change where the order goes.

The checks your payment settings can run

Address verification compares the numbers in the billing address and postal code with the issuing bank's records. It works for most Canadian and American cards, less often for others.

The security code, the three or four digits printed on the card, suggests the buyer has the card in hand.

Depending on the processor's settings, a failed check may decline the payment, flag it, or simply be recorded. Find out which, and decide what you want.

The card networks also offer an extra step, in which the cardholder's bank checks it is really them, often with a code. A payment that passes it usually moves responsibility for fraud to that bank.

It adds friction, so many stores keep it for larger or riskier orders.

Holding an order costs less than chasing it

When warning signs stack up, do not ship until the order is verified. A day's delay costs a genuine customer little; shipping to a fraudster costs everything.

Phone the number on the order. Genuine customers answer and usually understand; fraudulent orders often carry numbers that go nowhere.

For expensive items, offer pickup in store with photo ID and the card. Somebody using stolen details will not come.

If doubt remains, cancel and refund in full. A refunded payment leaves nothing to dispute, and the goods stay on the shelf.

A worked example

A store selling refurbished laptops, from a storefront and its own website, ships across Canada.

In the spring it shipped two orders a week apart, each for two high-end laptops with overnight delivery, to one address in another province. The billing addresses were in two other cities.

Both cards were approved, and both were disputed as fraud a month later. The delivery address belonged to a parcel forwarding service.

The processor had recorded mismatches on both orders and approved them anyway, because nobody had changed its default settings.

Tracking and order emails went back in reply, but delivery to an address the cardholder never gave is weak evidence against fraud. Both disputes were lost.

It now declines payments that fail the security code, holds larger orders whose shipping and billing addresses differ, and phones those customers before anything ships.

Answering a dispute

Every dispute arrives with a reason and a deadline, often short. Answer each on time, even small ones; an unanswered dispute is lost by default.

Match the evidence to the reason: tracking and a signature for an item not received; the product page, photographs taken before shipping and the customer's emails for one not as described.

Keep it short and factual: what was ordered, when, by whom, where it went, and what was said.

Fraud claims are the hardest to win, since the store cannot easily prove who placed the order. The checks before shipping matter more than the reply afterwards.

A flood of small payments

Some fraud uses small stores as a testing ground. Somebody with a list of stolen card numbers runs them through a checkout with small purchases, to see which still work.

The store sees dozens of tiny orders or declines within an hour, and the approved ones come back as chargebacks.

A challenge on the checkout page, a limit on attempts and an alert when declines spike spoil the test, and whoever maintains the store can set them up.

Processors also watch the share of payments that end in disputes. Cross their threshold and a store can face higher fees, held funds or a closed account.

The counter-case

A store selling inexpensive items, or goods that are hard to resell, sees less of this and can use lighter checks. Every extra step at checkout costs some genuine customers.

A store that ships only locally faces a narrower problem, and a hosted checkout with screening built in may already do much of the work.

For any store shipping valuable goods to addresses it cannot see: switch on the checks, hold the doubtful orders, and answer every dispute.

This week

1. Read your processor's settings for both card checks.
2. Decide what happens when a check fails.
3. Change the statement name to one customers recognise.
4. Hold orders that stack up warning signs.
5. Phone before shipping anything expensive and doubtful.
6. Use signature delivery for valuable parcels.
7. Answer every dispute before its deadline.

Step four is the one that saves the goods. It is the last chance to stop a fraudulent order before the parcel leaves.

Taking card payments for services at the moment of booking is covered in taking a deposit online for a service.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.