Credit Card Fraud: protect your business!

Credit card fraud is one of the most common types of fraud that you can face. According to the Canadian Bankers Association, in 2023 there were over 100 million credit cards in circulation in Canada. Although less than 1% of cards are compromised, that still represents hundreds of millions of dollars lost.

Card present: stolen or counterfeit

Card present fraud is when the credit card is physically present during the transaction. According to Stats Canada, most retail fraud is done in person. Unlike shoplifters, who often will avoid eye contact and make a quick exit, fraudsters can be:

• Brazen
• Confident
• Friendly
• New to your store
• Making larger than normal orders
• Buying items in multiples
• Avoid using the Chip-and-PIN system

The importance of the Chip-and-PIN:

When a cardholder makes an in-store purchase at a chip-activated terminal, the chip card generates a unique one-time code that’s needed for the transaction to be approved — a feature that is virtually impossible to replicate in a counterfeit card. Canadian chip cards used at your place of business that are not processed using a chip device will shift the fraud liability to you.

If you suspect someone trying to commit fraud during a transaction, you can call your payment authorization centre and ask for a “Code 10”, and they can coach you from there.

Card not present: Fraud on the rise

Card not present means the buyer’s credit card is not physically present when completing the transaction. These transactions are often done for sales ordered over the phone, by email, or online. 

Without the credit card in-hand your business will not have the protections available through the security features of chip and PIN. This can lead to a chargeback for your business, requiring you to pay back the amount you charged to the credit card. This is lost revenue; and your losses increase if the goods and services are already in the fraudster’s possession and can’t be recovered

According to the RCMP, this is one of the fastest growing types of fraud in Canada.

How does it work?
There are several variations, here are two examples:

A fraudster will call wanting to make a purchase with a credit card. This could be the actual card holder who is intending to defraud your business, or it could be a stolen credit card. The script may sound like this:

“My son is going to school in your town, and I want to purchase him a computer on my credit card. Can I pay for that and have him come and pick it up?” The authorization will be approved on the credit card when the merchant calls it in. Naturally, the merchant will believe all is well and allow the merchandise to be picked up. Later the transaction will be reported as fraud.
OR
A fraudster will call and ask for products to being shipped or delivered elsewhere – this often happens with building supplies dropped off at “job sites.”

The transaction will be approved when called in, the supplies will be delivered to the job site – which is likely to be unmanned. The fraudsters swoop in, steal the materials, and disappear.

The next day or so, the merchant will be advised by their processor that the transaction is fraudulent

Unfortunately, because Chip-and-PIN is not used during card not present transactions, there is next to no recourse to help you to recoup the loss of income or product.

If you process card not present transactions, take steps reduce your chances of being a victim. 

Know the warning signs and train your staff so everyone is watching for the red flags. Common signals include:

• Orders are larger than what is normal for your business.
• A buyer wants multiple orders of the same product, especially big-ticket items.
• A repeat customer’s order differs substantially from previous purchases.
• The customer demands rush delivery.
• One credit card is used for many different shipping addresses.
• The billing address doesn’t match the shipping address.
• The customer wants extra funds to be sent to a third-party shipper.
• One online order from a single IP address is using different names, addresses and credit cards.
• The internet address is from a free email service.
• Name of buyer and card holder don’t match.

Make specific steps part of every card not present sale, including:

• Set a policy that all card not present transactions must be approved by the business owner, a manager, or a senior employee.
• Call the customer back to verify the transaction before delivering the goods or providing the service.
• If the buyer comes to pick up the purchase, request the credit card upon their arrival so you can complete the transaction with chip and PIN before releasing the goods.
• Use verification services such as Address Verification and Card Validation Code of the credit card network companies (Mastercard and Visa).
• Contact your credit card processor and ensure security measures are established.

“Friendly” Fraud

Friendly Fraud is a payment industry term used when a customer makes a purchase with their own credit card, receives the merchandise, and then files for a chargeback. A chargeback occurs when a customer suggests there was fraud, or disputes the transaction, and the credit card company reverses the transaction in favor of the customer. Friendly Fraud usually involves deliberate dishonesty and outside of the payment industry this is simply another form of shoplifting.

Chargebacks can happen up to two years after a sale. That means timely reporting of this type of fraud is nearly impossible and sales are basically reversible for two years after they are made. 

Note: In addition to the initial processing fees, and swallowing the cost of the merchandise, the merchant is charged processing fees when the transaction is returned.

Tips to protect your business from credit card fraud

• Create awareness - train your staff to recognize fraud. 
• Adopt a policy that credit cards transactions will NOT be taken over the phone.
• Look into e-commerce solutions that provide proper security for online transactions.
• Require customers picking up product to provide ID or the credit card that was used to authorize the transaction.
• Refuse to take credit card payments where the chip and PIN can’t be used.
• Always ensure your POS systems are chip-enabled. You can do so by contacting your Acquirer/Payment Processor.

Anytime your company is a victim of fraud, take time to report it:

• Canadian Anti-Fraud Centre: Call 1-888-495-8501 or report online
• Local police in your area
• The RCMP

Resources from Chase:

• POS Fraud Prevention
• Online Fraud Prevention  
• Three Ways to Protect Your Business from Cyber Attacks
• Merchant Support Centre