Choke Point: Preventing Credit Card Fraud

In the struggle to prevent fraudsters from turning stolen credit cards into cash online, retailers are the country's last, best defense

As with most retailers that have sophisticated antifraud systems, the processes at ShopNBC are largely automated. Each order goes through a complicated, proprietary decision tree. At any point, the order can be released as good, pushed along for an additional check, or flagged as suspicious and sent to a team of 20 investigators. The investigators might then contact the customer, or have the bank contact the cardholder, to confirm that the sale is legitimate.

The rules are changed constantly to try to stay ahead of the fraudster's newest tricks. "The hardest thing about fraud is it is so dynamic," says Laura Lively, ShopNBC's credit investigation manager. "What we're chasing today is not what we'll be chasing six months from now. The fraud schemes pop up, and they test your perimeter. They pop up; they go away; they pop up; they go away." About 8 percent of orders make it to the investigators, and the majority of those orders are then cleared for shippingâ¬usually without the customer knowing that any additional screening has taken place.

And so it goes at merchants across the country. Moment after moment, decision after decision, day after day.

"It's all about analyzing as many parameters as you can," says Brown from the Merchant Risk Council. "Having a fraud list of people you know have been a chargeback is just as valuable as knowing that an e-mail account has been used for fraud or that a customer has just tried to buy 20 pairs of denim in the same order. Every piece of information has value. There is no single silver bullet for being able to separate a good order from a bad order."

ShopNBC opted to build its systems in-house, as many larger retailers do. But service providers such as CyberSource, eFunds and Retail Decisions sell similar systems.

The ongoing challenge for retailers, whether they build or buy, is managing the tools. This means tweaking the rules. Continually. "That is an art," Brown says, "because if you set [the bar] too high you're reviewing too many orders and losing good customers and losing good money. If you set it too low, the fraudsters will figure out where your thresholds are set and try to attack you in a different way."

The Liability Game

CompUSA has plenty of antifraud protections churning along, both homegrown and purchased. These include AVS, order screening, and an internally developed order and ranking system. The company also uses IP geolocation, which is part of a contract with CyberSource. But the privately held big-box electronics retailer took the bait on new services being offered separately by Visa (about three years ago) and MasterCard (about one year ago) that aim to make e-commerce a less risky proposition for everyone.