At Realex Payments we have used the “fraud funnel” to help identify the controls needed at each stage:

» Gather as much information as possible (without compromising on the sales process);

» Ensure validation checks are completed on all accounts and (not just) card number data;

» Where possible consider the implementation of authentication processes such as 3D Secure (Verified by Visa and MasterCard SecureCode). As well as reducing risk by way of liability shift these processes can reduce the cost of processing;

» The uptake of these controls continues across the globe and Visa has stated that merchants who have used Verified by Visa have had 73% of their charge backs addressed;

» Furthermore some 25% of Visa Europe’s e-commerce transactions are now VbV and 10% are fully authenticated;

» When implementing authentication be sure to understand any implications of the customer being temporarily redirected from your site to another and then directed back – watch time-outs and measure any dropped sessions at this stage.

» From a development perspective the same framework developed for 3D Secure could support bank transfers and the authentication element of PayPal transaction for example;

» Where authentication is not available at industry level (e.g. Laser Cards in Ireland) consider implementing secure bespoke processes to address the risk;

» Analyse and score all transactions for potential fraud, look through automated black-lists/white-lists, and match the data (IP addresses, country of issue) and explore patterns e.g. this mobile has topped up with five other credit cards. No single check will confirm fraud but each can lead to better identification of potential fraud;

» Even with processes like 3D secure in place, always seek authorisation as this confirms funds are available and where possible include the security code (usually 3 or 4 digit) and address check;

» Feed your charge-backs into the system for automatic matching and possibly automatic additions to the blacklist – add card to blacklist on receipt of chargeback;

» With some transactions isolated from the normal flow, manual intervention may be required – these must be kept to a minimum but they and any charge-backs can help refine the process.