Anon Av:
FRAUD DETECTION SYSTEM
The Risk Management Toolkit
• AVS
• CVV
• IP/GEO/BIN
AVS – Address Verification Service
How It Works
•Provides a Match or Non-Match Result for the Billing Street # and Billing Zip Code… not the actual address. (i.e. “1234 Test Street” is parsed into “1234” just the same as “1234 Wrong Way” would be).
Implementation
•Available on any Internet merchant account and virtually any Payment Gateway.
•Most gateways provide an AVS configuration area where you can specify whether you want to automatically “decline” (i.e. do not settle) an authorization that has an AVS mis-match or non-match.
Benefits
•Easy to implement Limitations
•Works only for U.S., CA, U.K. cardholders. So, this does not help you scrub most international transactions.
•A growing % of compromised credit cards – especially those obtained through inside jobs or hacked databases– will also contain the necessary information to provide a valid AVS match result.
Recommendation
•If you handle a mix of int’l and U.S. sales, you will want consider scrubbing with AVS on the U.S. transactions but do NOT scrub via AVS for any international transactions as they will always fail. AVS should not be considered a primary means of verifying the validity of a transaction. Nearly 20% of the fraud can potentially be eliminated by scrubbing “Non-Matched” AVS match results.
CVV – Card Verification Value
How It Works
•A service with many names – CVV2, CVC2, CID – but the premise is the same for all.
•Provides a Match or Non-Match Result for the 3-digit or 4-digit number embossed on the back of the cardholder’s card. The CVV is NOT generally encoded on the magnetic stripe and therefore is less likely to be captured as part of a card skimming tactic.
Implementation
•Available on any Internet merchant account and virtually any Payment Gateway.
•Most gateways provide an CVV configuration area where you can specify whether you want to automatically “decline” (i.e. do not settle) an authorization that has an CVV non-match or non-entry.
Benefits
•Works for virtually ALL cardholder accounts – both U.S. and international.
•There is no valid reason why a legitimate cardholder, in possession of the card, would not be able to enter a 100% matching numberfor this.
•Merchants are not allowed to store CVV and as such the CVV # is less vulnerable than the data used for AVS.
Limitations
•CVV data can only be used for a real-time transaction. CVV data can not be stored and therefore can not be utilized for Recurring Transactions.
Recommendation
•CVV is a recommended service to utilize for ALL initial transactions processed. Based on our internal charge-back analysis, merchants can reduce their fraud rates by as much as 70% by simply requiring a matching CVV result.
IP/GEO/BIN Scrubbing
How It Works
•Compares the IP address of the customer purchasing with their stated geographic location (i.e. why is the customer from California ordering from Europe?)
•Compares the BIN # (first 6 digits) of the credit card with the IP or stated geographic location of the customer (i.e. the customer isusing an US-issued credit card but they are from Europe?)
•Based on the IP and BIN # and other customer-inputted data, a vast amount of information can be returned on the transaction.
Implementation
•Custom direct integration into a service such as MaxMind.com
•Use an existing integration that is part of a Shopping Cart such as X-Cart, LiteCommerce, osCommerce, ZenCart, ASPDotNetStorefront.
•Use an existing integration that is part of a Billing System such as WHMCompleteSolution, ClientExec or Ubersmith.
•Use an existing integration that is part of a Payment Gateway such as the Quantum Payment Gateway.
Benefits
•Fast, Cost Effective and Non-Intrusive
•Provides merchants with an excellent “do the pieces fit consistently?” analysis.
•Can block up to 89% of all fraud if properly implemented
Limitations
•Generally not reliable for AOL users due to the way that AOL routes its traffic (AOL users requir
Comments
Post a Comment