One Hit - One Merchant & One Hit -
Multiple Merchants
This is one of the more difficult types of fraud to detect and prevent. In this scheme a fraudster will acquire a credit card profile and will make a single purchase from your site. They will not reuse your site again, or if they do it will only occur after very long periods, greater than three months. They are making more than one purchase on the credit card itself, but it is at different vendors rather than multiple purchases from the same vendor. The fraudster will also typically be drawn to very highly fence-able goods: electronics, jewelry, mobile phones, computer goods and gift cards.
Number of Purchases: 1
Billing & Shipping Address: Typically different; the shipping address will typically be a drop point or abandoned point
Shipping Method: Express Shipping
Phone: Bogus, or the real consumer’s number
Purchase Amount: High
Fraud-Prevention Techniques: High (£) Pound amount rule with express shipping rule, reverse lookup address and phone, use of fraud screening that does cross-merchant velocity-of-use checking, card security schemes
Consumer-Perpetrated Fraud
This is a scheme in which the consumer or an accomplice of the consumer makes a purchase and then denies they made the purchase, or that they never received the goods or services. All of the data points will look good but the consumer will swear they did not make the purchase and did not receive the goods or services. They may also say they placed the order but never received the goods or services.
The consumer calls their issuing bank for the credit card and disputes the transaction for one of these reasons:
-
- Claim they never made the charge
- Claim their account was abused by someone else
- Claim they never received the services
- Claim that their spouse never made the transaction
If the consumer says they never placed an order, take a look at
your past records to see if they have ever made a purchase from
you before, and make sure you put them into at least a warm list
to watch for them in the future.
Number of Purchases: 1 or more
Billing & Shipping Address: Typically the same; or if different, a real address with a real person
Phone: Real consumer’s number
Purchase Amount: Any
Morphing Fraud - Repeat Offenders
In short the morphing attack is where a fraudster is hitting a single merchant multiple times using slightly different data points each time. These attacks are typically of short duration with multiple purchases being made and sent to the same address or within a very close proximity. The fraudster may change every data point except one or two, so you have to be doing some good cross-reference checking to catch them.
This scheme has a couple of different variations. I call them the “bust-out,” the “slow morph” and the “multiple personality” morphing fraud attacks.
In the bust-out variation the fraudster will make multiple purchases from your site within a short timeframe with a number of different credit cards. All of the goods and/or services will be going to the same location, but all of the other data may change between purchases.
In the slow morph attack, the fraudster will make purchases over time with elapsed time between purchases to prevent raising any flags, and will change the credit card, address and phone slowly over time, just keeping in front of you.
In the multiple personality attack, the fraudster will set up several different personas with different cards and make periodic purchases over a 30 to 90-day timeframe. I have seen cases where the morphing attack was pulled off with 2 to 3 hits per month, all spread out over a 90-day period. The fraudster used three different credit cards and personas and made one purchase with each persona per month for a three-month period and then disappeared. The merchant in this case was using velocity of use and change, but was only counting usage and change for a 24-hour period to attempt to catch bust-outs. They finally caught on when they starting doing some research on past charge-backs to see the fraudster was using variations of the same name. For example “Sara, Sarah, Sam, Samantha, Bill, Bob, William, Willard and Wilda.”
The morphing attack is a little easier to spot if you have good velocity of use and change checks in place. The problem is determining how many purchases or changes constitute actual morphing. As a merchant we all pretty much assume and want to have our customers come back and buy from us. We never assume the fraudster knows this as well, and will play us based on this. Making a purchase once a month for three months wouldn’t in itself set off any alarms, but what they are buying and how the data points they send us change does.
In looking at catching morphing attacks you will have to really think about how you can look at previous account activity, and how you can look at the products purchased as well. The velocity of change and use checks are the best mechanisms to catch someone morphing their identity in their attack.
Some of the things you can look for to catch these morphing fraudsters include:
Look at the typical buying patterns for your merchandise. Would someone typically buy the product sold more than once in a day, week, month or year? For example if you sell televisions online, how often would the same person buy another television on the same day, week or month? If you sell jewelry, how often does someone buy the exact same piece of jewelry in a day, week, month or year?
If you are already looking at velocity of change and use on a daily basis today to stop bust-outs, don’t change it. Add another combined look at velocity of use and change over a 6-month period in which you look at the number of purchases on a given credit card, e-mail, phone and address. Track the number of changes of a credit card number to an e-mail, phone and address over time.
Look at the name associated with a credit number to see how many times it is changing. The name is typically not a good tool for doing fraud checks, but in the morphing attack, the attacker can change the name with everything else being the same. They don’t always do this. Though in the case I discussed earlier the fraudster used the same name, which is how we caught him, and stopped him from starting back up the following month with a fresh set of cards.
If you are doing e-commerce, track the IP address being used by the fraudster and check it against the IP address from past charge-backs to see if they are coming from the same points. It is very rare that they will have the same IP address, this typically means a real novice fraudster, but you can see trends to certain proxies or regions.
Number of Purchases: More than one
Billing & Shipping Address: Typically different, the shipping address will typically be a drop point or abandoned point
Phone: Bogus, or the real consumer’s number
Purchase Amount: Any
Velocity Of Use Technique Overview
CV
number
