Editor's note: We recently updated this article with new data and insights.
The news for online businesses is good and bad.
The good news is that ecommerce is expected to surpass US$2 trillion by 2028.
The bad news? This growth in online sales will be matched by a growth in ecommerce fraud.
The cost of fraud to online retailers is expected to reach over US$40 billion by 2027. As the popularity of online shopping grows, so does the opportunity for cybercriminals and unscrupulous consumers to defraud online businesses.
If you own or operate an online store, you must protect yourself against online fraudsters who steal from you, wreck your online reputation, alienate your customers, damage your brand, and hurt your profits.
This comprehensive guide tells you everything you need to know about ecommerce fraud protection — what it is, how it works, and what you must do today to protect your online store from the growing threat of online fraud.
Let’s get started.
Ecommerce transactions are typically made from smartphones, tablets, laptops, desktop computers and gaming devices — and even in the metaverse. When we talk about fraud, we’re talking about criminal deception intended to result in financial or personal gain. Ecommerce fraud is typically conducted by a single fraudster, a crime ring, or an AI bot, also with the intention of a financial or personal gain.
Two things to remember about ecommerce fraud are that:
Online payment fraud takes place for several reasons, some of them historical, some of them geographical and some of them legal.
Juniper Research reports that worldwide ecommerce fraud is expected to reach US$206 billion by 2025, and businesses have the potential to lose more than US$343 billion to online fraud through 2027.
Additional ecommerce fraud stats from these reports include:
Every day, fraudsters are coming up with new ways to steal from consumers and businesses. Here are the most common types of fraud happening now.
Friendly fraud happens when a customer pays with a valid card and then claims their order never arrived, that it was damaged, or that it was substantially different from the product description on the website. Usually, friendly fraud is considered “accidental” and can happen for a number of reasons:
Friendly fraud accounted for 29% of U.S. ecommerce losses in 2021.
Return abuse happens when criminals take advantage of an online company’s return policy, and it costs U.S. retailers more than US$12 billion each year. It is most often perpetrated by an expert fraudster who has studied a business’s policies to find their loopholes. The most common types of return abuse include:
Fraud has evolved over time to become a business model for many fraudsters. Using bots and brand impersonation, fraudsters can rent bot networks from fraud "service providers" to launch large-scale fraud campaigns against websites and to phish victims. Fraudsters simply need to plug in victims' names and financial institutions or favorite stores, and the bots handle the rest – phishing the victim for their passwords, allowing for account takeover – all for as little as 15 cents per bot call.
As an online business, you can spot ecommerce fraud in a number of ways. Just remember that the success of ecommerce fraud depends on the skill and ingenuity of the fraudsters. As businesses increase their defenses against online criminal activity, online crooks also up their game and devise cunning ways to defraud their targets.
Here are the most common red flags to look for:
The ZIP code and city entered don’t match. Or the IP address of the shopper and their email address don’t match.
The order is far larger than your customer typically spends. Other red flags include multiple units of the same SKU in the one order, and expedited shipping (the crook wants to receive the order before getting caught).
Your customer always purchases from an IP address in North America, but suddenly makes a purchase from an IP address in an unusual location (Nigeria, for example).
The buyer makes multiple purchases under one billing address but ships the products to multiple addresses.
The fraudster makes multiple purchases back to back — and it’s not the holiday season.
Someone makes multiple purchases using multiple credit cards (either in one day or over a longer period).
The purchaser makes not just one or two attempts (honest shoppers make mistakes, after all), but four, five, six, seven, eight or more attempts without getting the card number, expiry date and card security code correct.
You’ve never received a single order from the Kingdom of Bhutan, and then you suddenly receive 11 orders from that country in the space of a week.
The key to protecting your online store or mobile app from ecommerce fraud isn’t just recognizing these activities when you see them — it’s taking steps to prevent them in the first place.
You have several tools at your disposal: some technical, some non-technical, some based on software, and some based on good-old-fashioned know-how. Here are the steps you can take today to prevent fraud in your online store.
Want to discover flaws in your security before criminals and fraudsters do? Conduct security audits—often. Ask yourself these questions:
If you operate an online store that accepts credit card payments, you must be PCI compliant. PCI stands for Payment Card Industry. PCI standards for compliance are developed and managed by the PCI Security Standards Council to ensure the security of credit card transactions in the payments industry. PCI compliance means your online store and your business processes meet these PCI standards.
Brick-and-mortar stores hire fraud prevention officers to catch shoplifters. You can protect your online store against fraudulent transactions by monitoring your store for suspicious activity. Monitor your accounts and transactions for red flags, such as inconsistent billing and shipping information, as well as the physical location of your customers. Use tools that track customer IP addresses and alert you to any addresses from countries known as a base for fraudsters.
Credit card processors and issuing banks offer an Address Verification Service (AVS) to detect suspicious credit card transactions in real time and prevent credit card fraud. AVS checks the billing address submitted by the card user (the customer) with the cardholder’s billing address that’s on file with the issuing bank. This check takes place as part of the business’s request for authorization of the credit card transaction. When addresses don’t match, the system either declines the transaction or flags it for investigation.
The three- or four-digit security codes on credit and debit cards are called the Card Verification Value (CVV) or Card Security Code (CSC). By requiring all purchasers to supply this code for every transaction, you ensure that customers have the physical credit card in their possession. This helps to keep you safe and reduces fraud.
One way to protect your store in the event of a data breach or hack is to collect and store as little customer data as possible. Hackers can’t steal what you don’t have. So only collect the data you need to complete a transaction and ship the product. Avoid collecting Social Security numbers, dates of birth and other unnecessary sensitive customer data.
Based on your order and revenue trends, set limits for the number of purchases and total dollar value you’ll accept from one account in a single day. This reduces your exposure to a minimum should fraud occur.
Every order placed on your online store comes from a unique, public IP address (a string of numbers separated by periods that identifies each computer using the Internet Protocol to communicate over the Internet). From the IP address, you can generally detect the city or region of the world where the purchaser is making the purchase. If this city or region does not match the address of the credit card being used, that’s a red flag.
Fraudsters commonly avoid detection by protecting their physical address, preferring to use a PO box or other anonymous location. After all, the police can’t come knocking if there’s no door to knock on.
If you are an online business, and if you want to prevent this type of fraud, never ship online orders to PO boxes and other virtual addresses, such as those of freight forwarders. You can spot addresses that belong to freight forwarders because they have a container number in the address, such as 726 Dock Road Suite 300 #KXQ-582899328.
When it comes to detecting and preventing online fraud, there is a variety of software solutions to suit your needs and your budget. Additionally, the tools you select may vary widely when it comes to how much work is involved in installation and ongoing management. Some may prefer a more hands-on solution, while others would rather leave it in expert hands.
Once you understand what ecommerce fraud is and why it is so prevalent, and once you learn how to detect online fraud, you are empowered to take the necessary steps to prevent fraud on your online store.
At ClearSale, we offer a hybrid solution that includes multiple strategies to offer one of the most comprehensive fraud and chargeback prevention solutions on the market.
It starts with an AI-enabled algorithm that leverages trends, intelligence and data gathered from decades of fighting fraud in the most high-risk regions of the world. Using this technology, we can automatically approve most orders quickly.
Suspicious orders are flagged for contextual secondary reviews performed by our more than 2,000 fraud analysts who have the experience to recognize some of the hardest-to-spot fraud patterns. If necessary, our analysts may reach out to customers, but they do so in a way that demonstrates why consumers can trust your business to protect their information.
We then leverage the data gathered from those contextual reviews to help our system better distinguish valid transactions from fraud. That means our system can more easily recognize “good” transactions as we process more for the client, which increases their approval rates and revenue.
We also offer end-to-end chargeback management.
For every possibility, ClearSale has a range of chargeback solutions:
Original article at: https://www.bigcommerce.com/blog/ecommerce-fraud/