I have an onlineshop for Russian watches www.poljot.com - and everyday
there is sevreral attempts of fraudulent creditcard payments. More
often also from US Adresses (formerly only Nigeria and Indonesia) Is
there an Adress (webform) to report them? How can i contact US police
as a Swiss citizen? Why are creditcard companies not doing ANYTHING
against that ? (VISA and MASTERCARD are ONLY protecting the
cardholder, even when he is clearly a criminal)

Dear subwave-ga

The US authorities have established :The Internet Fraud Complaint
Center (IFCC), which is a partnership between the Federal Bureau of
Investigation (FBI) and the National White Collar Crime Center (NW3C).
IFCC's mission is “to address fraud committed over the Internet. For
victims of Internet fraud, IFCC provides a convenient and easy-to-use
reporting mechanism that alerts authorities of a suspected criminal or
civil violation. For law enforcement and regulatory agencies at all
levels, IFCC offers a central repository for complaints related to
Internet fraud.”
In the small print it states “It is the IFCC's intention to review all
complaints and refer them to law enforcement and regulatory agencies
having jurisdiction. Investigation and prosecution are at the
discretion of the receiving agencies.”
The site is at: http://www1.ifccfbi.gov/index.asp

As you have discovered, the problem of verifying of the identity of
credit card holders over the internet is a tremendous problem for the
retailer and the card companies will say the retailer is ultimately
responsible for making the decision whether to supply the goods when
the customer is not present despite you having carried out the
relevant checks with them and authorisation. The credit card companies
do not discuss security in-depth on their web sites but they are
trying to invest in new technology. Visa has some discussion on “The
Next Generation of Fraud Detection” at:
http://www.usa.visa.com/business/merchants/afs_overview.html
Citibank are also trying out new technology according to their web
site: http://www.citigroup.com/citigroup/press/020625a.htm
You seem to be successful so far at spotting the fraudulent card but
perhaps these sites will contain some more tips:
http://www.windowsix.com/Controlling_Online_Credit_Card_Fraud.html
(with a case study)
http://www.wiscocomputing.com/articles/ccfraud.htm

I hope this research is of assistance. 
Please ask for clarification of this research, or if the links do not
work, before rating the answer.

answerfinder-ga

Search strategy
Known sites
"credit card fraud" retailer
://www.google.com/search?q=%22credit+card+fraud%22+retailer&hl=en&lr=&ie=UTF-8&oe=UTF-8&start=0&sa=N

---

Request for Answer Clarification by subwave-ga on 20 Dec 2002 07:28 PST

very interesting, did not expect such a professional response!
In 3 cases i have lost watches, Mastercard / Visa just charged back
the amounts.
In germany, the card companies bear the risk of the transactions
(decision of main court in april this year). Is in the US still the
retailer 100% responsible? Or in other words - is there a chance to
get an amount or the watches found by the police back ? ..for me, as a
non-US citizen ?
Thanks VERY much !!
(if needed you can treat this also as another payed question)

---

Clarification of Answer by answerfinder-ga on 20 Dec 2002 10:13 PST

Dear subwave-ga 
I cannot answer your additional question completely so please post it
as a further question for another researcher if you wish.
It seems whether the retailer is 100% responsible very much depends on
your agreement you have with your Visa Representative or Acquirer. The
US retailer position is referred to in the case study in the original
research.
I note that the USA Visa site has developed a new online security
feature called Verified by Visa where participating online merchants
receive added protection from fraudulent charge back activity. The US
pages:
http://www.usa.visa.com/business/merchants/verified_index.html
http://www.usa.visa.com/business/merchants/verified_mrchBfits.html
The European pages:
http://www.visaeu.com/for_business/for_card_accepters/want_to_accept_cards_online/coming_soon.html#1

You may need another researcher as I am not a US resident and I am not
familiar with their criminal justice system, so how compensation and
restitution  payments are applied for and paid I do not know. I know
in the UK if you as a retailer lost goods and notified the UK police,
upon conviction of the criminals, compensation and restitution orders
can be made by the criminal court even though you are overseas.

answerfinder-ga

---

Clarification of Answer by answerfinder-ga on 21 Dec 2002 04:52 PST

Dear subwave-ga
Glad I could help and thanks for the tip.
answerfinder-ga

very professional, very fast - much more than i expected !

Unfortunately, in a card not present transaction such as on-line, the
merchants are ultimately left holding the bag.  The various law
enforcement agencies probably due to resources, right or wrong, just
do not get too excited over small scale fraud due to the lack of a
victim in the agencies jurisdiction.  Steal someone's watch off their
wrist in the Mall and the police will catch and prosecute them.  Do
the same thing with a stolen credit card online and enforcement will
rarely happen.  The consumer is protected with the chargeback and the
issuing bank gets restitution from the merchant.

There are, however, a couple of things you can try:

1.  Prevent it from happening in the first place.

a.  You can talk to your card processor about using a fraud scoring
service that will score each transaction and give you a relative level
of risk.  There is usually a per transaction fee associated with this.
 There are also logical anti fraud engines (or homegrown) that will
look for red flags such as known bad email, ship to, etc

b.  If it is not critical for your business to allow gift purchasing
(I buy the watch then send it to someone else), you can require
purchases to be sent to the billing address of the credit card.  For
US Banks and some international banks, you can obtain AVS information
about a credit card.  Basically, this verifies that the address
entered with the credit card is the billing address for the card.  If
you only send to this address, you dramatically lower your risk for
fraud from stolen credit cards.


2.  Dispute the chargeback.

This can be difficult but possible.  Here's a link of a site that
gives a table showing some common chargeback scenarios and how a
merchant can dispute them.

http://www.atlanticpayment.com/Chargeback.htm

Only shipping to the billing address for the card and getting a
signature upon delivery can really help.

Hope this helps, good luck!

Paz-ga

I also, run an online shop, I recommend you use http://www.paypal.com
as your payment processing system, they are free and cheaper than any
other processors.
They handle all fraud attempts for you, and all you do is collect money.

You'll know the good payments went thru when the $ has been transfered
to your account successfuly.
I hope things work out for you.
http://www.wwjd.com