2

I have a client who has, in the past, used the Saved CC payment method on their store (despite attempts to persuade otherwise) for the single purpose of having convenient access to their CC data in the case that they suspect an order may be fraudulent.

They would check each order manually, and for orders from international customers (or other apparent red-flags) they would submit an additional transaction on their CC for a small arbitrary amount ($0.50 - $2.00, say).

For very obvious reasons, this is not a recommended solution to handle these suspected fraudulent transactions.

The best I can see how this should work would end up being quite expensive for the client (for a seemingly boring "feature").

  1. Have client sign up with Authorize.net CIM
  2. Install Authorize.net CIM payment gateway module in Magento
  3. Develop a custom module to allow the client to submit these fraud detecting transactions for a small amount.
  4. Assume that the customer will opt to have their CC info saved during checkout so that CIM is available for subsequent transactions with additional communication with the client.

This seems like a fairly tall order. As it stands, I can only assume that the client will opt to continue using the Saved CC payment method since it meets his needs (though obviously introduces other security issues).

Can anyone suggest an alternative way to handle transactions such as this while at the same time minimizing the need for additional communication with the store's customer? To me, this sounds like a big can of worms.

2

They do not need CIM, and the native Authorize.net integration should work just fine. It will provide (very) basic protection such as AVS (assuming they enable and configure it in their account on authorize.net) and also guarantee that they have a valid and matching CVV submitted with the card. However, this will not prevent fraud transactions. Payment gateways do not detect fraud nor do they claim to. They verify the correctness of CC information.

A fraud prevention system will maintain records of information collected from transactions purported to be fraud and cross-check new transactions against it. Not the only technique employed, but one of many. If a particular IP address, for example, is consistently used for fraudulent transactions, that may be used as a check which would raise the fraud score of a transaction being verified. If the score gets to high (I believe the threshold is configurable) then the transaction will go into a suspected fraud or rejection state.

My suggestion would be to look into using a solution such as Kount. They have a working Magento integration via a module they provide you with and you install. It supports using Authorize.net as the payment gateway too.

One thing to keep in mind is that as with anything eCommerce related, the client will need to be willing to put some effort into learning about fraud and how to deal with it effectively. There are many different types of fraud, and the best approach to combatting it can sometimes be different based on the situation.

  • I'll have a look at Kount. It's an interesting concept, especially if it demystifies working with any number of random services any number of random clients may be working with. Thanks. – pspahn Jan 29 '13 at 2:14
  • 1
    Oh, one thing I didn't mention in my answer above. Kount will, I believe based on your configuration, reject transactions with too high of a score altogether and simply fail the order. However, if the score is not high enough to reject, but it is suspect, the order will be accepted and placed into a Suspected Fraud state for manual resolution in the Magento admin/Kount admin by a CSR. – davidalger Jan 29 '13 at 2:35
  • Good to know. +1 – pspahn Jan 29 '13 at 2:44
1

this may not be a code-oriented solution, but authorize.net has extensive fraud-screening, including varying levels of screening. for example, you can use AVS on the whole address, just the city/zip, etc. you can get pretty granular. perhaps show them these options and point out that authorize.net, as a payment gateway, is in the best position to determine fraud?

  • When they switched to Auth.net, they signed up for the Fraud Detection Suite(FDS) as well, which is flagging a high percentage of their orders as suspected fraud which he still wants to potentially process. Maybe simply fine-tuning the FDS will allow him slightly more control, but I'm sure he's still going want to salvage as many declined transactions as possible. – pspahn Jan 29 '13 at 2:01
  • AVS checking is not really fraud protection, it is a layer-1 defense mechanism. I've posted some information in my answer below which you may enjoy reading. – davidalger Jan 29 '13 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.