IP Geolocation and Preventing Fraud
This is my second blog post in the last few months that deals with helping prevent online fraud, so that provides some insight into what a major issue it has become for online merchants of all sizes and in many ways hits the small to medium sized online merchants the hardest.
For the most part small and medium sized merchants either do nothing to prevent fraud, or they use the AVS and Fraud features built into their online gateway to provide some very basic protection.
More and more however we see a new type of fraud that can be very challenging to deal with, where the fraudster actually has all of the info associated with the compromised account, including name, address and telephone number. In some cases they order things and have them sent to the cardholder, only for the cardholder to call and return the item they never ordered, or worse refuse the shipment and charge it back.
As the types of online fraud evolve, as well as the underlying purposes of the fraud, it's important to keep an eye out for new and innovative ways to protect yourself.
One of the things that's made a HUGE dent in fraud and chargeback issues to our merchants is implementing fraud scoring from companies like maxmind.com and others who do geolocation of the IP address and use it help determine a fraud score along with other factors.
They look at fraud from a different perspective then traditional AVS or Fraud Filters provided by your gateway. They evaluate the location of the IP address placing the order, they can also look at the Bin (the first few digits of the credit card) of the card being used and see approximately what part of the world that card was issued, see if the email address their using for checkout is from a free email service (and thus doesn't provide any real validation). They can also see if either the Bin of the card or the IP address their coming from is normally a high fraud Bin or IP, and finally they can tell if someone's using an IP Proxy to mask who they are. They add up all the pieces of information they gather and provide you with a fraud score.
So for example, if a card issued to someone in New York is trying to place an online order with an IP address in Brazil and ship the product to California, whilst using an IP Proxy and a free email service, that will trigger a very high fraud score. However if an IP address from New York is ordering something to be shipped to New York from a card issued to a New York residence and that IP doesn't have fraud normally associated with it, you'll get a very low fraud score.
Depending on how you've implemented this into your online store you can either stop orders from going through that hit a certain threshold of fraud score, or simply let all orders go through, and choose to void and cancel any likely fraud orders. By allowing all of your orders to go through and do your processing on the backend, you actually improve your security since you don't provide any feedback mechanisms to the fraudsters for trying to game your system.
Check with either www.maxmind.com, one of their competitors or your shopping cart provider to see how you can implement a feature like this to help keep your fraud down to the bare minimum. The pricing for this feature from most places I've looked is highly competitive and something that can be added very inexpensively and usually cover the cost in preventing only a single fraudulent order.
One final thought on using Fraud Scoring via geolocation, it doesn't just prevent fraudsters from far away with stolen cards, it also helps provide information against Friendly Fire Chargebacks where people claim they didn't place the order. I've heard more than one report of using the IP capture and fraud scoring information to prove to the client that someone in their house did place the order, and prevent the chargeback.
0 Comments
Connect with us