Choke Point: Preventing Credit Card Fraud

In the struggle to prevent fraudsters from turning stolen credit cards into cash online, retailers are the country's last, best defense

"If you have enough cards and enough computing power, it's not tremendously difficult to figure out what the algorithm is," says Pelegero, the former Amazon.com executive who is now president and managing director of Retail Payments Global Consulting Group. "If I have 100 cards from the First Bank of Nowhere with the valid CVN, I can figure out how to generate additional CVNs."

All of which is why credit card fraud prevention is much more complicated than the streamlined checkout process would indicate.

Advanced Transaction Studies

Every day, thousands of people log onto ShopNBC.com, the fast-growing jewelry and electronics merchant that brought in about $127 million in sales for parent Valuevision Media in 2004. Joan Radtke, director of credit, wants to make sure that once customers fill up their carts, the checkout process is efficient. But Radtke also wants to ensure that the incoming fraud rate, which she says is near the industry average (about 3 percent or so, according to CyberSource), doesn't result in an unacceptable chargeback rate. (Rates under 1 percent are generally considered acceptable, although standards vary depending on the retailer's industry.) So after the customer completes her order, ShopNBC's homegrown systems kick in to evaluate the order for suspicious behavior.

Radtke's is a typical toolbox, with several outside sources providing information. If there is a legally permissible reason to suspect fraud, the company can check customer information with one of the credit bureausâ¬to find out, for instance, if the customer has put a fraud alert on her account. The company can also check against public records compiled by LexisNexis. (Is the customer listed as deceased? Not a promising sign.) And the company can check against a database from the U.S. Postal Inspection Service that contains addresses involved with fraudulent activity.

ShopNBC.com also has its own tools for catching anomalous behavior, such as IP geolocation. If the IP address of the computer on which the order was placed is not geographically near either the shipping or mailing address, the order may be suspicious. "This particular rule helps with foreign fraud," Radtke says.

In fact, fraud originating from outside the United States is such a problem that, according to Joseph LaRocca of the National Retail Federation, many merchants have implemented rules not to ship to certain countries or do transactions with individuals from certain countries. ShopNBC ships orders only within the United States, eliminating the need for country-based rules.

Another common tool that ShopNBC uses is what's known as "velocity checking"â¬looking for multiple orders that share common characteristics, such as shipping address, e-mail address or geolocation. Merchants don't divulge many details about their velocity checks, but the concept is simple. Explains LaRocca, who is vice president of loss prevention for the trade group: "The people that are really good at credit card fraud, that result in significant chargebacks, are the ones that can execute credit card fraud and multiply that routine over and over again." Velocity checks help stop the bloodletting.