Fraud isn’t going away, but retailers and payment processors are getting smarter about dealing with it
Like the reporting on an ongoing war, the news about Internet fraud is becoming more and more just part of the background noise of doing business on the Internet. Only major scams make the front page these days. But online fraud is a continuing threat to the online retailing industry and one that retailers need to pay closer attention to. 60% of online merchants report fraud rates higher than 1%, with an average of 1.7%; offline fraud is 0.07% of volume, by contrast.
Retailers have adopted a number of technology solutions, but fraud still happens and so retailers still must take other steps to combat fraud. “They’re applying a lot of common sense,” says David Kerlin, president of Portland, Ore.-based AmeriNet Inc., a debit payments processor. “A lot of merchants have gotten smarter about knowing where to ship and how to ship.” For instance, he says, many are refusing to ship overseas. “In general, retailers are very afraid of overseas shipment of items that can be fenced easily,” he says. “The international credit card platforms aren’t as robust as they are in the U.S.”
More independent involvement
In addition to applying common sense, retailers also want to be actively involved in the fraud screening process themselves, says Joyce Van Horne, vice president of product management for First National Merchant Solutions, a division of First National Bank of Omaha. “The most common request we get from merchants is for fraud tools that they use independently of payment acceptance tools,” Van Horne says. “Merchants want stand-alone systems so they can submit transactions against other files based on various parameters.” And they want flexibility to change those parameters easily and at will, she says. For instance, she says, a merchant may want to change its velocity threshold—the number of times in a day a customer uses a card—during the holidays to flag fewer transactions based on heavy card use, then change it back to a tighter parameter after the holiday shopping frenzy is over. “They want to be able to do fine-tuning and we work with them to facilitate that,” she says.
Fraud, however, isn’t simply a matter of catching someone using someone else’s card without authorization. It also involves spotting and preventing identity theft, one of the fastest growing crimes both in the U.S. and overseas. Incidents of identity theft grew 80% just from 2002 to 2003, reports Harris Interactive. “Everybody’s got concerns about not just fraud but also about how easily someone’s identity can be captured,” says John Perry, CEO of InterCept Payment Solutions. InterCept provides transaction processing as well as customer service support to 20,000 retailers, 2,000 of which have online operations.
To address those concerns, InterCept maintains a database of transactions against which it compares incoming orders. “We operate an entirely home-grown fraud screening system” Perry says. “It has history on millions of transactions. We do a very, very good job of turning down fraudulent transactions.” Among the components that InterCept analyzes are time of transaction vs. time of day in country where the cardholder resides, how often the card is used in a single day and the computer’s IP address. It also contracts for additional database screening from third parties. InterCept processes $3.5 billion a year in MasterCard and Visa transactions; online sales account for about half that volume.
Securing the consumer data
Similarly, First National Merchant Solutions focuses on security of consumer data, as well as of retailer data. First National monitors security measures of every vendor it uses to screen consumer data. “We evaluate the vendors every step of the way,” Susan Rue, senior product manager, says. “We ask where they store the data, how they protect it and make sure that they work behind multiple firewalls.” Rue adds that First National actively participates in the Electronic Check Council and the Merchant Internet Risk Council.
InterCept also offers other payment-related services that, while they seem at first blush to stray afield from processing and payment security, nonetheless feed into the company’s security efforts. For instance, it creates shopping carts for retailers, develops payment pages for display to customers during checkout and can host those pages itself if the merchant so desires, operates a call center to help customers resolve transaction problems and provides chargeback processing without retailer intervention, following the retailers’ guidelines. “We prefer to do more rather than less because we like having the ability to collect all that data,” Perry says. “It gives us a more robust e-commerce offering than if we offered just one piece.” And, he adds, it makes the data in its transactional database that much richer and thus enhances its ability to spot fraud.
To that end, InterCept also is providing consulting services to customers. “We found that we have all this experience, so why not share it,” Perry says. “It tends to drive more transactions and that’s exactly what we want.”
Other forms
Merchants also are turning to other forms of payment partly as a way to avoid dealing with online credit card fraud. For instance, AmeriNet is offering a cash payment product, under an arrangement with Western Union, a unit of payments processing company First Data Corp. A customer places an order and chooses cash as the payment method. The customer receives a transaction number which he takes to any of 47,000 Western Union locations. He gives the transaction number to the clerk who looks up the transaction and collects the cash. Western Union through AmeriNet notifies the merchant that the customer has paid for the order and the merchant then is free to ship the product or, in the case of the Internet games sites that AmeriNet supports, release the game software to the customer. While the outcome is a virtually guaranteed transaction—it carries the same non-chargeback status as cash in the real worldóthe service also opens the market to new customers. “It was designed for customers who don’t have checking accounts, let alone credit cards,” Kerlin says.
Kerlin notes that acceptance of the cash alternative has been strong among AmeriNet’s client base, especially sites that support Xbox and PlayStation gaming devices. AmeriNet is processing up to 400 such transactions per week, he reports. “Internet gaming is a potentially huge growth spot,” he says.
Getting more settled
AmeriNet’s primary business is in processing debit payments and e-checks. Kerlin says the company is experiencing strong growth in those areas as well. Especially as retailers get their online operations down pat, they are more willing to look at payment alternatives such as e-checks, he says. “There has been hesitancy by some processors who sell our services to take new things to their larger accounts until they were through a break-in period,” he says.
He adds that AmeriNet’s e-check business has doubled in the past year. “Web merchants are getting a little more settled down,” he says. “They now have the technology and funding issues under control and they can focus on other things like incremental sales. They’ve always understood the concept of e-checks, but they had 10,000 other things to do.” As a result of the industry’s growing maturity, he adds, “We’re seeing a nice build there.”
A cheaper alternative
InterCept is experiencing a similar phenomenon with its electronic check product. “It’s a secure, guaranteed payment,” Perry says. “Retailers would rather take an electronic check because it’s cheaper than a credit card.” That’s especially true among the large group of InterCept customers who sell information on the web, such as news stories or specialized commentary. “Even though the content sites would like to sell subscriptions, consumers often would like to buy content by the drink,” he says. “But if you’re charging 80 cents for, say, a news story, it’s too expensive to accept credit cards.” After stumbles by some initial providers of small payments, the market is coming back, he says. “Their idea was dead-on, but those who were in it before came at the market obliquely,” he says. “If they had approached it not from a security point of view but from a payments point of view, they might have had more success.”
That said, the number of credit card transactions still far out-distances the number of e-check transactions. Part of the problem with e-checks is still that the authentication process is not as smooth or well-established as it is for credit card payments. “A major issue is authenticating the person presenting the information,” Rue says. “With credit cards you know the name of the person tied to the card number. That’s not true with checking accounts. Guaranteeing a transaction like that is fairly expensive.”
Getting over the extra step
That split becomes even wider when retailers look at password-based protection programs that MasterCard and Visa are rolling out. Verified by Visa and MasterCard’s SecureCode require cardholders to register their cards with their issuers and choose a password. Then when they make a purchase at a participating merchant’s web site, they enter their password as part of the checkout process. That guarantees the transaction and relieves merchants of any liability. While some critics have pointed out that it adds a step to a process that online retailers have been streamlining, First National says it has heard few complaints from retailers. “Customers expect the extra step,” notes Dillon Allie, associate marketing manager for First National. “Customers have gone to their issuers’ site to sign up, so when they go to a retail site, they expect the extra step to check out.”
The quest for payment security is a running battle between retailers and their payment processors on the one hand and criminals on the other hand. One of the latest scams involves criminals using stolen card numbers to make small donations at not-for-profits’ web sites to make sure a card number is still active and valid, Allie says. “They lay the foundation for using the card with very small amounts at not-for-profit sites, then use the card number for bigger purchases at other retail sites,” he says. Adds his colleague Rue: “The bad guys are always one step ahead. It’s a challenge to stay even with them.”
As more e-retailers charge sales tax,
they’re looking for streamlined ways to collect and file
One payments issue that more retailers are agreeing about is sales tax. As
online retailing becomes more mainstream and as local and state governments
hurt for money, opposition to online sales tax seems to be fading. “We’re getting
more companies that have come to the conclusion that they are going to have
charge sales tax, whether they like it or not,” says Mike Blandina, architect
for sales and use tax at CCH Inc., provider of tax information and software
for tax processing. “A lot of people have seen through the scare tactics that
this was going to cost millions and be really hard to implement.”
Once Wal-Mart Stores Inc. and Target Corp. announced a year ago that they
would start collecting online sales tax, the battle was virtually over, analysts
say. Now the question becomes: How? Or more accurately, two questions become:
How?
Dealing with sales tax is a two-step process, both of which offer challenges
to the online retailer. The first is simply knowing how much to collect and
when. For that, CCH offers its ZIPsales CertiCalc tax calculation product that
keeps track of the rates and policies of all nearly 7,000 taxing jurisdictions.
The second is filing returns with those jurisdictions. For that, CCH offers
its ZIPsales Returns product.
At the end of last year, CCH introduced an integration package that ties CertiCalc
directly into ZIPsales Returns. G.A. Wright, a marketing company and seller
of collateral marketing material to franchisees, started a beta test of the
integrated offerings in December. The test went smoothly enough that CCH is
rolling it out now to retailers and other customers, Blandina says.
In addition to confirming that the integration approach works, Blandina says
CCH also realized from the beta test that retailers wanted to maintain the processes
that they already had for filing taxes. And so CCH built more flexibility into
the integration system. “Typically customers already have forms that they’re
using and they don’t want to change how they file,” Blandina says.
CCH provides its service on an ASP basis—maintaining the data on a server
that customers access via the web, whether that be the calculation of the sales
tax due on a purchase or the filing of forms. That way CCH can easily keep retailers
abreast of the frequent changes in local tax codes and filing practices without
retailers having to make an ongoing investment in such information, Blandina
says. While some retailers have been resistant to ASPs for a number of reasons,
including control and security, Blandina says CCH has been successful in selling
the concept to even large retailers who like the DIY approach to technology.
“We can demonstrate that our security is usually stronger than what they can
do and we’re as responsive as their own systems,” he says.
