Our Business Is Being Scammed by Our Customers

Hello Ozbargainers;

I have been on Ozbargain for a few years now, and I am always impressed by the quality of discussions on this forum.
This topic has been a big deal for me, and has been on my mind for a while now.

As a business owner of an online e-commerce store, I have ran into an issue of "credit card chargebacks", and lost a bit of money from this.

To explain what a credit card chargeback is (to the best of my knowledge):
It is when someone calls up their bank and reports an unauthorised charge on their account. I think it is possible for people to do it even if they did genuinely make the transaction, but instead had an issue with their ordered item e.g. received broken.
The bank will then go through some sort of checking process (not sure), and once this is complete, the customer may receive all the money bank. And (the seller) will be forced to refund the money, even though the item was already sent and received.

What has happened to us?
As a ecommerce business, we sell products online. Roughly about 1 in 1000 orders we receive an email from PayPal saying:
“"One of your buyers filed a chargeback with their credit card provider. The buyer stated that they didn't authorise this purchase."
This usually occurs about 1+ months after we have dispatched the customers order.
We have probably received about 5-10 credit card disputes over the last few years, and from the best of my memory all of them had the reasoning “unauthorised transaction”
It occurs both on eBay and our website.
There are certain traits with the sale that link to these disputes, for example:
- If purchased on eBay, it is someone with a very low feedback score e.g. <5
- If paid with PayPal - an account is not used, only credit card.
- In PayPal, the transaction is not verified.
- The order amount is large
- Item being sent to a Parcel Locker or PO box.
- Sometimes (but not always) non-Au IP address

Now, I know what you will say: “why not just block or not accept orders if the order payment looks suspicious?”
Well, we have tried to do this in the past, but there are issues:
1. It is an inconvenient / inefficient to check every order.
2. The majority of orders that will be flagged as “possibly fraudulent”, will in fact not be. And we annoy customers when we block orders.
We also sometimes ask the customer to verify a code that will appear on their bank statement once the charge has been completed in PayPal. But we have been slack in doing this recently. And customers hate it.

What I think may be happening:
Scenario 1: A scammer is using a fake or stolen credit card to order something from our us, and sending the item either to their house, or a friends house.
Scenario 2: A scammer is using a fake or stolen credit card to order something from our us, and reselling the item online, then sending it to their own customers house.
Scenario 3: A scammer is using their own credit card to send the item to their house, or their friends house, then calling up their bank and saying the transaction was “unauthorised”

Some other relevant notes:
- We get the address and contact details of the receiver (obviously as we have to send the items to them).
- There was one scenario where I called the lady up, she was a Chinese woman (I had to speak Chinese to her as she did not speak English) and hung up straight away when I mentioned the situation. This particular item was sent to a Parcel Locker. Note also, I got her phone number from Australia post as the one with the order was incorrect.
- I have tried sending a friendly letter to the receiver of the order with no response.
- We once ran an OzBargain promotion and someone scammed us from an order linked from OzBargain.
- I have heard from other people that this is a natural occurrence in large businesses and they just “cop it”. However, Kogan have an advanced system where they require new customers to verify their bank account prior to making a purchase.
- All up, our business has lost between 5k-10k from this

If anyone has experience or information in this area, I would greatly appreciate your input. I am sure there are other people in this community who would be interested too.

What do you guys think is happening?
What you guys think I should do, or be doing?
Do any of you experience the same problem?

***I know this post is long, let me know if anything needs more explaining, or clarification?

Related Stores

WalkSmart
WalkSmart

Comments

    • -1

      tl;dr: 0.1 % of OP's sales results in an unauthorised chargeback.

  • I'm an admin of two e-commerce websites and we've never had any issues like this. Our store policy is PayPal payment only, Only shipped to Australia and No PO Boxes. We have also sold on eBay and Amazon.

    • Thanks,

      Something I have noticed is that it usually only occurs on certain category’s of products. For example, one area of our company sells power points, while the other area sells computers. We have never had a dispute on the power points - they have all occurred on products that are easy to resell (like MacBooks or Hoverboards/Electric Scooters)

  • Quick questions are you guys running WordPress on an open cart plugin?

    • We are running Woocommerce on our Wordpress sites

  • If you use paypal then paypal somehow links to your website via their ipn script (I think that's what they call it)
    I use paypal for online transactions, so have a rough idea of how it works.

    Paypal will give you all the important details via their post payment script.

    Why not take this info and run it through an algorythm to identify the risk?
    If order > $x add 1 risk point
    if address = po box then add 1 risk point
    etc

    It can then send you an email (via your server that hosts the script) with a warning if too many red flags or risk points are raised.

    Can the user see that you are tracking their Ip address when they order?
    This may be a deterrent - especially if you display the host name - like *.cht.nsw.bigpond.net.au

    Can you analyse the IP addresses and see if there is a particular risky location?
    The non au ip address is probably a vpn - they have done this before.
    How often do you legitimately sell overseas?
    Maybe this is worth more risk points?

    I don't sell on ebay, but I think there is a setting to ignore bids from those with a score below X - where X is set by you.

    For less than 25c per order you can automate your scripts to send an SMS to the end user.
    You can use this to then ask them to confirm something or do something to validate their mobile number.
    You may not use this directly - but they would (I think) have needed to provide ID to get the mobile number.
    All you are doing here is keeping honest people honest.
    OR perhaps even a 'thank you for your order' SMS.
    If its not a legit phone number - maybe someone will call back.

    One of my suppliers has a system where they bill you an amount between 1c and $1 and you need to tell them what it was.
    It is a pain in the bum as it is not in real time - it can take 2-3 days to see this on your statement.

    I don't think there is a single easy solution though.

    • Hi,

      Thanks for your detailed response,

      Yeah, I would like to come up with an automatic system- but we don’t have the resources to create something ‘automatic’. Our business is very spread out and diverse (so would be difficult) - and it’s probably not worth while for the amount of chargebacks we are currently getting.

      Even if we get their mobile number- there is not too much we can do without a lot of hassle.

      Yes there is a setting on eBay and I am going to activate it. I didn’t want to initially because I know there will always be someone legitimate with a low score.

      • This seems like such a basic part of online payments that there must be software or services already that do this …

        I have never used eBay without low feedback blocked, doesn't seem to have stopped me selling and I'm not a store. Set everything to maximum safety, the requirements do not block most of ebay so just let other people take the chance on low feedback accounts. Phone verified accounts provide a cost to most scammers so definitely block non-verified users, it will weed out less determined scammers.

        Also block every geographically outside AU from seeing the listing unless you want to sell overseas. Block regions you don't sell to if applicable

        • +2

          That's what happens when you vote for Liberal or Labor!!

        • Thanks,

          Yeah, it seems like common sense to turn it on.

          I've spent a bit of time researching, and It difficult to understand and figure out what to do.

          Stripe payments have a fraud detection app, but it doesn't work. I tried it out and it let a fraudulent payment through. Plus it would block genuine transactions. Note, this was about 1-2 years ago - so could have improved since then.

  • +1

    From my experience, I've won chargeback disputes on PayPal by providing tracking details showing the item is in transit/has been delivered. Is this not the case for you?

    PayPal will fight on your behalf during chargeback disputes.

    • To explain what a credit card chargeback is (to the best of my knowledge):
      It is when someone calls up their bank and reports an unauthorised charge on their account.

      • +1

        I know what they are, I've won against unauthorised chargebacks in the past by supplying a tracking number.

        PayPal will give you the opportunity to fight the chargebacks by allowing you to supply additional information such as the tracking number and they will fight on your behalf against the bank.

        • If it is unauthorised then presumably the thief got it sent to their own address, so I don't see how a tracking number would help. Unless it was held at the post office and they had to show id to collect it.

        • +1

          @Quantumcat: What you are failing to realise is that a lot of unauthorised chargebacks are fraudulent, that is what the OP is referring to in this case.

          My guess is with the tracking number they are able to compare this to the address of the buyer to see if it's fraudulent.

          I've been selling on eBay for the past 5 years using PayPal and I've been able to win unauthorised chargebacks by supplying the tracking number. Refer to the comment below, even they say that tracking numbers has helped.

          My suggestions for eBay:

          • Block PO boxes and Parcel Lockers as they provide a layer of anonymity for fraud (might deter some people from purchasing though)
          • Signature on delivery if you haven't yet (might weed out some inexperienced scammers using their own names and signatures and you can submit the delivery document as evidence for PayPal)
          • Blocking low feedback buyers automatically but ask them to message you if they would like to purchase (you can put this in the description). You'll have some of chat history you can submit as evidence if they chargeback the transaction which has been really helpful in my case
          • Deal with verified PayPals only (if they're inexperienced, they won't use anything to mask their IP address or delete cookies which PayPal extensively tracks so it'll be linked to their normal PayPal)
        • @moneybaby:
          I wouldnt block parcel lockers. I only get things delivered to parcel lockers since it is the only reliable way to get things I buy online. Australia Post are completely useless in delivering items to my home and it ends up taking a week longer to get anything, if it arrives in the first place.

          However, using a parcel locker, I've not had any issues with any delivery so far.

        • @moneybaby:

          Hi,

          Yes, they do give the option to provide a tracking number in PayPal - however, this has always been automatic and useless. (Automatic as our tracking numbers get posted to PayPal anyway)

          We have never won a dispute.

          I assume the tracking number is used to verify the delivery address and whether it matches with the credit card holder. If it does, then there is a much higher chance the credit card holder "authorised" the transaction. This is the reasoning to why I think the scammers may deliver the items to their friends address instead.

        • @moneybaby: if the potential thief is getting the parcel delivered to the address registered with their credit card then they are playing an amateur game. If the address doesn't match the credit card billing address what does it prove? That it got sent somewhere?

        • @ModernPowerSolutions: I've sold a giftcard for an online service via eBay which I received a chargeback for. The worst part is getting charge the chargeback fee (~$15) on top of your loss when you've done the right thing.

          I had a friend who worked at the company the giftcard was for and verified that it was redeemed to the email address on their PayPal account which was the best tracking I had.

          I find that calling PayPal on the phone is the only way to get things done. I've had to do this for a few things on PayPal, both as a buyer, and as a seller.
          Email didn't get me anywhere. Especially not quickly. When I called I waited on hold a while but had the chargeback taken off my hands and the fee reversed.

          I hate scammers/theives. Scums.

        • @MrHyde: Aren't parcel lockers for Australia Post delieveries only? How do you know if the store you're purchasing from uses Australia Post as the carrier rather than say, Couriers Please?

  • I Have been selling on ebay nearly 10 years - we also have those customer dispute with paypal ( unauthorised charge ).

    paypal always asked for TRACKING ID - The good thing is, all our parcels has tracking id. All we need to do , just provide it tracking id to Paypal. so far so good, paypal always protect us. I dont know IF Paypal taking the lost or not…. No one know this.

    • Ok I will see.

      I have recently had a chargeback go through on eBay/PayPal. The tracking number is already with PayPal.

      It is processing now.

  • -5

    I'm always impressed by the quality of discussions on this forum

    Me too. Things like "do you ever refuse to park at a maccas drive thru?" and "At What Stage Can You Go to Get a Car Wash Financially?" Really shows the quality of the people who use this site.

  • +5

    Sounds like you have problems with your selling practices, you had a post March 2017 about a possible scam of a different type and after all the advice never even bothered to update the thread with the results , did the guy pull a scam or was everything ok?

    • +1

      Yeah that was a different type of scam. I won't make that mistake again.

      Yes, the customer ended up opening a dispute, and I basically lost the laptop.

      I was lasy in doing anything to resolve. Just copped it as a loss.

      The guy who picked up the laptop was on drugs. I didn't want to get involved.

      • Sorry to hear that I was hoping it was just one of those maybe situations thanks for the update

  • Does the bank or PayPal not ask for proof from you, the merchant, before authorising a chargeback? It seems a little odd if they don't.

    • +1

      Yeah, thats the worst part.

      The only thing we can provide is a tracking number (and sometimes a basic explanation over the phone). But this has never helped.

      I have tried calling PayPal or Stripe in the past, trying to get more information such as "what is the credit card holders bank name?" etc… They cannot provide any information.

      I have told them in every case "I have sent the items, here is the tracking number and proof" and I still loose the dispute.

  • I've had a lot of situations like this in the past for about 8 years.

    Some suggestions:

    Fraud detection app: I noticed you said Woocommerce… Shopify? It's built for eCommerce so has a lot of benefits that come with that. I know it has a monthly fee, but the benefits are very good. For example, many apps that can not only detect fraud, but can increase conversions, boost marketing, run faster, etc and so forth.

    Debt collection: Presumably you have enough info to pass onto a debt collector? Even if not recovered, they will not get off scot-free.

    Financial Services Ombudsman: An option for dispute resolution with a payment gateway. When I have used this in the past, Paypal just throw some money at you to the value of the order. They do not seem to care about recovering this from the "customer".

    Carefully worded description: Is there something you can add to the listing? A well written, non-invasive, genuine-buyer-non-deterring piece of copy. Think of it like a "Trespassers will be prosecuted" or "24/7 Surveillance" sign. e.g. something to the FAQ "How do you handle disputes?", "What is your refund policy?" If you mention words such as debt recovery, it may deter some of the fraudsters.

    • Thanks,

      Unfortunately using Shopify won't work for us. We sell on too many different sales channels.

      What have you done in the past to resolve a dispute? Did you contact a debt collection agency? Or the Financial Services Ombudsman?

  • Scenario 1: A scammer is using a fake or stolen credit card to order something from our us, and sending the item either to their house, or a friends house.
    Scenario 2: A scammer is using a fake or stolen credit card to order something from our us, and reselling the item online, then sending it to their own customers house.
    Scenario 3: A scammer is using their own credit card to send the item to their house, or their friends house, then calling up their bank and saying the transaction was “unauthorised”

    All these scenarios looks like fraud and you could possibly file a complaint with the police. You would have IP address, and a delivery address. this should be good enough for the cops. PO boxes should usually have video surveillance as well.

    • Yeah, I feel like it will be a waste of time with the police. Its not like a "big deal" - I don't seem them investigating it.

      I have had other issue with the police in the past, and I think they have more important crimes to solve.

      • +2

        well a lot of eCommerce vendors are affected by these scammers. If the number of complaints keep increasing they will be forced to do something about it. I would recommend to report it at least for statistics.

    • Police don't care, they'll give you an incident number if you need it for your insurance and tell you to log it in Acorn, which won't do anything.

  • +1

    Does the company name which appears on customer credit card statements tie in with your actual company name?
    Because a lot of our statements will not say say "Fig Tree Cafe, Perth" but tell us that I had a transaction with Barebutt Holdings. (I'm making these names up, in case you are wondering).
    And I recall actually querying one payment with the credit card company and getting the money back, and then realising later that it was a genuine transaction. Felt bad about that, but also felt some justification…
    Perhaps this isn't the case with you. You don't have a problem with cheap powerpoints, only expensive items like computers. People tend to remember expensive transactions, it's the small everyday ones where this scenario occurs. But the way that the chargebacks come in after a month (when the credit card statements arrive) makes me wonder.

    • Hi,

      Yes, this is a good point, and no it doesn't always.

      However, we always attempt to try and contact the customer afterwards, and I haven't seen this as an issue yet.

      Also, the transactions we have experienced chargebacks with are all high amounts between 1-2k, so I think most of the time the customer could match the amount with what they ordered. I can understand this being more of an issue for smaller (more common) transactions.

    • Yep this can be an issue. I remember seeing a charge on my card once for what looked like a travel agent. Turned out it was the noodles I ordered a few nights previously.

  • +3

    I've used Paypal for high-value fraud-magnet products in a high-volume retail PC business for over 5 years, and have had a half-dozen chargeback attempts in that time - all I ever did was upload proof of shipping to PP in their "Resolution Centre", and they closed the dispute in my favour every time. Provided you follow their instructions and do one simple check, Paypal payments can be safer than cash in person.

    Go and look at any of your Paypal transactions in the Paypal Merchant "Activity" page. They should have the text "Seller Protection - Eligible" in the top section. If so, those orders are protected from chargebacks, provided

    1: you retain, and can upload, shipping proof for the order (online tracking is essential)
    2: you do not change the delivery address, even if the customer asks you to do so after placing the order (you must cancel the order, and ask them to re-order with the correct address in these cases).

    Any high-value transactions that do not have "Seller Protection - Eligible" should be treated as potential fraud, because PP have determined that the transaction does not have a matching address to the customer's past purchase history, or they found something else suspicious (new account, recent change to address, IP-location unusual etc). Go and check the "eligible" status for any of your chargeback orders - I'd be surprised if they were "eligible".

    As a procedural suggestion, whenever you get a high-risk product order, have your order-processing staff lookup the Paypal transaction in the merchant "Activity" page to confirm it's "eligible" status. They will only take a few seconds to do this once they are good at it. Any high-value transactions that say "not eligible" you can reject, and ask the customer to fix their address in Paypal. Alternatively, if you can take payment by card, refund the PP payment and ask them to re-order and pay by card, and then do a sub-$1 random amount refund for them to verify.

    If your order processing time is more than a 1/2 hour from the order-placed time, you should have received the PP "Notification of Payment Received" email, and this also has the "seller protection" notification status in it - you can have the staff doing orders check these emails, instead of logging-in to PP all the time.

    See : https://help.shopify.com/manual/payments/paypal/paypal-selle…

    I managed to come out ahead on fraud over the years by carefully "working" the system. FYI: your page at https://modernpowersolutions.com.au/updated-returns-policy/ is non-compliant with the ACL, and you may be exposing yourself to potential ACCC reprimands if you get any complaints. You can PM me if you want more details.

    • Thanks,

      Unfortunately though, we accept payments even if they are not verified i.e. no seller protection.

      The reason for this is because we get a lot that are legitimate via this method.

      I will need to go through our processes to come up with something better so I can lower our rate of being caught up in this.

      • "Verified" or "not-verified" buyer status does not matter - almost all Australian buyers are "Not verified".

        Only "eligible" or "not eligible" matters for Aus merchants. You should get almost all as "eligible" except for the fraudulent ones - I never saw any "not eligible" ones in over 5 years, other than the fraud ones.

        Check your messages.

        • Oh right, I might be mixing these up. I will need to investigate.

    • That kind of policy could end up costing more than all the fraud related activity up until now.

      Don't mess with the ACL and in particular, don't ever make it sound like you are placing any limitations on what is covered by ACL.

Login or Join to leave a comment