[Asterisk-biz] CC Fraud

[snacktime]

On 6/18/05, steve <steve at 17q.com> wrote:
> You guys know very little about credit cards.   First, it is true that one
> of the largest processors had their system compromised.
> 
> What this means is a lot a credit cards with their security codes have been
> stolen.  This is no big deal because most companies will not ship to an
> address that is not the billing address of the credit card company.
> 
> Almost everyone uses AVS (Address verification System) to verify the credit
> card billing address.   If a thief tries to use a valid credit card with a
> valid security code and the wrong billing address then the card will be
> rejected.

You might want to take a step back before making such sweeping statements.
The company I work for processes tens of thousands of transactions per
day for a lot of different business types, and I can tell you that
each industry has it's own patterns when it comes to fraud.  We
haven't really done much with the voip segment, and I was surprised to
see the number of chargebacks with both valid cvv and avs info. 
However it does happen and for a number of reasons.

And avs is separate from authorization.  A card isn't declined
automatically because it fails avs.  It's actually a real pain to
handle avs.  What actually happens is that if a card is authorized but
fails avs, you have to void the authorization, but it still takes the
authorized amount off of the open to buy amount on the card.

Cvv is similar.  depending on the issuing bank a bad cvv code will
either result in an outright decline, or will result in an approval
with a failure message for cvv.  In the latter case you then have to
void the transaction like you do for avs.

Plus avs simply doesn't work for orders outside the US if you are a US
based merchant (with Canada being a semi exception).  In the voip
industry that seems to be a rather large segment of the market where
you simply can't use avs.

There are no easy solutions.  IMO one of the best ways to deal with
chargebacks for business services is to get more information on your
clients, and require some type of identification and extra
verification (as others have stated).  What that is really depends on
particular circumstances.

Chris