I have dealt with this exact scenario in our photography ecommerce product (http://nextproof.com). Ours just happened to have an extra 0 on the end. We almost lost our merchant account because of all the chargebacks. (I'm thinking of writing an ebook on the topic)
Through some social engineering, I was even able to get the name and location of the checking account owner and get him on the phone. I was actually quite close to visiting and beating the crap out of him. Turns out he was just some poor rube from Arkansas who answered a craigslist ad. In the end he was actually more of a victim than me (basically had his identity stolen, credit ruined).
Law enforcement at all levels were completely unhelpful (I dealt with CA police, AR police, and feds). Once I located the bank and got them on the phone, they at least were able to freeze the checking account (I believe they are required by law to do this once fraud/cybercrime is reported). That's really only a temporary fix though.
Any time you're doing payment aggregation or money transfers, you have to do as much verification as possible. We learned that the fraudulent charges had very predictable patterns (international cards, fake websites, very specific range of charge amounts, etc.). At a small scale, you should just manually verify all accounts, require phone/address verification, and more. I've seen some bitcoin startups that even require you to submit a photograph of your card + ID via WebRTC. This is what you should do right away. Once fraudsters realize they have to do work, they will move on to the next target. Our chargeback rate is now near zero and never fraud-related.
At scale, you can have in-house people write code to detect fraud patterns. There are also startups like Sift Science with APIs.
Hey there, I'm the CEO of Sift Science. Unfortunately, callmeed is spot on -- law enforcement typically won't get involved unless it's in the tens of millions of dollars, at least. Even trickier if it's across international borders.
This means that you're left to defend yourself. Typically, you'll start implementing some basic verification and rules in your code base. For example, "if num_credit_cards_per_destination > 5; flag_as_suspicious()". But, it's tough to be accurate with this approach, so you'll want to manually review activity flagged by rules, so that you don't insult your good customers. As your business grows, it's more challenging to scale these fraud detection rules and manual review operations. While adding more verification helps, it does negatively impact the experience for innocent customers. It's a delicate balance.
I wish I had better news. In some sense, seeing fraud means that you're on the map. Unfortunately that means you'll only attract more and more attention as your business grows. I'm happy to be a resource, even if we don't work together - jason at siftscience dot com.
callmeed, this excellent advice and information here. I urge everyone to read this before getting yourself into a hole. Many of the payment API's such as Stripe and Balanced Payments make it super easy to deploy an ecommerce site that it makes you think you're done, though as I have learned, that's only half the work. The other half is fraud and loss prevention. And as markbnj commented below, you need to monitor it quite often (24x7).
Law enforcement at all levels were completely unhelpful (I dealt with CA police, AR police, and feds). Once I located the bank and got them on the phone, they at least were able to freeze the checking account (I believe they are required by law to do this once fraud/cybercrime is reported). That's really only a temporary fix though.
I actually did call the bank 2 days after the transactions. I believe it takes 2-5 days for direct deposits to arrive to destination bank. When I called the bank, the support agent said they could see the deposits and that they would freeze the account. Though they haven't been very cooperative since then and communication has been limited. The bank agent I was assigned to has been difficult to reach and work with, even my processing company has had trouble getting a hold of them. I'm really hoping the account is still frozen and they will fulfill the reversals. That's my only hope.
Comments
I have dealt with this exact scenario in our photography ecommerce product (http://nextproof.com). Ours just happened to have an extra 0 on the end. We almost lost our merchant account because of all the chargebacks. (I'm thinking of writing an ebook on the topic)
Through some social engineering, I was even able to get the name and location of the checking account owner and get him on the phone. I was actually quite close to visiting and beating the crap out of him. Turns out he was just some poor rube from Arkansas who answered a craigslist ad. In the end he was actually more of a victim than me (basically had his identity stolen, credit ruined).
Law enforcement at all levels were completely unhelpful (I dealt with CA police, AR police, and feds). Once I located the bank and got them on the phone, they at least were able to freeze the checking account (I believe they are required by law to do this once fraud/cybercrime is reported). That's really only a temporary fix though.
Any time you're doing payment aggregation or money transfers, you have to do as much verification as possible. We learned that the fraudulent charges had very predictable patterns (international cards, fake websites, very specific range of charge amounts, etc.). At a small scale, you should just manually verify all accounts, require phone/address verification, and more. I've seen some bitcoin startups that even require you to submit a photograph of your card + ID via WebRTC. This is what you should do right away. Once fraudsters realize they have to do work, they will move on to the next target. Our chargeback rate is now near zero and never fraud-related.
At scale, you can have in-house people write code to detect fraud patterns. There are also startups like Sift Science with APIs.
Hope that helps.
Hey there, I'm the CEO of Sift Science. Unfortunately, callmeed is spot on -- law enforcement typically won't get involved unless it's in the tens of millions of dollars, at least. Even trickier if it's across international borders.
This means that you're left to defend yourself. Typically, you'll start implementing some basic verification and rules in your code base. For example, "if num_credit_cards_per_destination > 5; flag_as_suspicious()". But, it's tough to be accurate with this approach, so you'll want to manually review activity flagged by rules, so that you don't insult your good customers. As your business grows, it's more challenging to scale these fraud detection rules and manual review operations. While adding more verification helps, it does negatively impact the experience for innocent customers. It's a delicate balance.
I wish I had better news. In some sense, seeing fraud means that you're on the map. Unfortunately that means you'll only attract more and more attention as your business grows. I'm happy to be a resource, even if we don't work together - jason at siftscience dot com.
callmeed, this excellent advice and information here. I urge everyone to read this before getting yourself into a hole. Many of the payment API's such as Stripe and Balanced Payments make it super easy to deploy an ecommerce site that it makes you think you're done, though as I have learned, that's only half the work. The other half is fraud and loss prevention. And as markbnj commented below, you need to monitor it quite often (24x7).
I actually did call the bank 2 days after the transactions. I believe it takes 2-5 days for direct deposits to arrive to destination bank. When I called the bank, the support agent said they could see the deposits and that they would freeze the account. Though they haven't been very cooperative since then and communication has been limited. The bank agent I was assigned to has been difficult to reach and work with, even my processing company has had trouble getting a hold of them. I'm really hoping the account is still frozen and they will fulfill the reversals. That's my only hope.