FRAUD ADVICE: Characteristics of this order are similar to fraudulent orders observed in the past

[MaskMore]

Hi, this post is to help advise you, another Shopify store owner, on what to do, if you get a possible fraudulent order that looks to almost be okay. 

My name is Bruno, and I own several e-commerce stores, most using Shopify. I have experienced almost every type of scam from scammy chargeback to fake addresses. I started out searching for advise but in most cases the response I found was lacking actual proof and what to do from Gurus and others, so I wanted to contribute. 

The Fraud Analysis system is a great tool. It helps you learn how to pay attention to potential scammers and how they operate. I found that 8 out of 10 will try and use a PO box, freight forwarding company, or a delivery address in the middle of nowhere. 

Remember, sales are nice, but scam sales will cost you money, chargeback reputation, and wasted time. It is much better to cancel than taking the risk. 

FIRST EXAMPLE. THE CLEAR CUT ONE.

This order was easy. Six warnings and a shipment going to another country. They tried to pay with five different credit cards, no CVV and address is not a match for the one on the credit card. This type of order, I don't spend a minute on. There might be unique circumstances, being another country etc., but the risk is not worth it, so here I email them that the order is canceled due to fraudulent risk from the payment company. If they wish to have this elaborated I ask them to write me back. Done - cancel order. Move on. 

SECOND EXAMPLE. THE TRICKY ONE.

As a general rule for all my shops, I have it in my terms that I DON'T allow orders shipped to PO Boxes or freight forward companies. If the come, I always initiate a dialog with the customer before doing anything with the order. Don't take the money or fulfill it. Know that Shopify fraud system often marks PO box / freight forward orders as potential fraud orders, as some might have been used for it before. I would say 1 in 200 is real. I recently had an order where everything checked out, it had one potential fraud alert. When I reached out, I got to talk with the customer. He was a truck driver and away a lot. He got things sent to the PO box when he was out and he really wanted to get my product. It all checked out for me enough to take the risk and that order was fine. 

Now here below is an example of when it is a SCAM. 

The facts. 

1. Shopify marked it as potential but EVERYTHING else checked out and looks good. 
2. I am located in Miami, the shipping address was PO number for a Miami freight forwarder. They checked out.
3. The billing address was in WA 98012. The name and address, CVV etc. for the Creditcard all confirmed to be the name used for the order. Seemed legit.
4. I noticed the customer only wrote the phone number for the freight forwarder and not themselves.
5. They ordered 10 products, giving them free shipping, yet they choose to pay for UPS.

This would make most new shop owners question what to do. They see a good order and only a potential fraud risk where EVERYTHING else checks out. Even payment method. Here is why it is still a high risk order and how to spot it. 

Step one. 

Send the customer an email. Make it short and friendly. You want to have the customer understand why you are reaching out and why the order isn't shipping just yet. Tell the customer you wanted to validate the order information and that you usually don't send it to PO's. Most scammers will never reply back, as they don't waste time if you are already a little alert. Give it max of 48 hours. If you don't hear back, cancel the order and send them an email about that.

Step two.

In this case, the customer replied back fairly quickly. It seems legit, but here is why it is not. 

1. You just told the customer their order/payment has a fraud notification. 100% of real customers I have told this, all mention this, and we have a quick talk, that their credit card might be exposed. This customer doesn't even question that part of the order review.
2. A charitable donation is fine, but now the shipping details don't add up. You don't need a freight forwarder for that, using UPS on the order already. They could have sent directly and it would have been cheaper. Many scams involve using and often paying EXTRA for you to use a freight forward company - it is a way to get you in the mindset that they are spending money and giving you money to help. A quick way to remove barriers when businesses only think about MONEY. Makes them easy targets.
3. Look at the email clip below. There is a grey backline on all the text. That is common if you use a system to translate a text. So there is a big chance they copy-pasted an English translation. So why would a rural WA person need to do that? Another red flag. 

At this point, we are not sure IF this is real or not. There are more red flags, so the last stage of this is the final confirmation.

Step three - final confirmation

Now we want to close it up. We will send the customer an email for the final confirmation. Explain it is for their order safety about the documentation of the order. Ask them to please confirm where the order was placed from, the bill to name and address, and a phone number to call and confirm. 

The location question is because the order was placed on a Miami IP-address. For a bill to in WA and a forwarder in Miami. If they answer WA or something else, you know that something is off. But maybe they answer Miami, and then the IP is confirmed. 

Billing address information is because most scammers work on many sites at once. They rarely keep track of billing information, so providing it again can be a hassle. We are also back to the point that they can see that I am looking into the order and not just sending it out. They don't want to waste time on me if I am not easily fooled. 

Finally the phone number. It is always good to call and talk to a customer. I have had scammers send me the phone number and you can hear the typical crappy connection used from fake burner numbers online and when you talk to them they are in a hurry and try to rush you to ship and pay more etc. All red flags. Never rush orders. Losing that one order is always better than taking the risk. 

CONCLUSION

I have now waited 48 hours and the final email never got a reply. The scammers stopped and didn't want to waste their time and that is perfect because your time is also the most important asset you have. Spending time on chargebacks, scams etc. is not something you should prioritize. Spend time on creating a great experience for actual customers is more important. 

ADVICE FOR FIRST TIME SHOP OWNERS

I know the feeling of the first orders is amazing and you reaaaaaaally want it to be real. Don't take the chance. The loss of time, money and reputation you will get on just accepting these risky orders is not worth the potential profit. As they are rarely real. Spend a little time to validate as I showed above. Don't go into long email chains and DON'T click links from customers where they want you to download something or read a PDF document for shipping information etc. these are most likely phishing emails that take over your computer, emails, and possibly bank information. 

I hope this post helped you on your way to greatness. 🙂

All the best, 

Bruno Langholm
CEO, MaskMore LLC

[BobsMojo]

Great post @MaskMore  Bruno!

Very helpful for new sellers & should be pinned!

I will contradict one piece of information though - your 1/200 number for legitimate PO Box addresses. While this may be true for some stores, we do have a number of customers (including several repeat/returning customers) who use PO Box addresses for a variety of reasons. Certainly a PO Box addy is something to make one stop and take a second look at least, but I wouldn't say that its a 99.5% chance of being fraudulent.

Thanks for your contribution!

[MaskMore]

Thank you and you are absolutely right. I wanted to add your feedback, because it is of course subjective to your customer base. I should have stated that the conversion facts are based on my three stores and the customer segment they have. All three are within the fashion industry. 

Great input. Thank you. 

[Jason_Lizuna]

@MaskMore Thanks for contributing and helping out the community! This is a great starting guide for beginners just starting out an don't really know what to do with a high risk order with low volume of orders.

I would just like to add caution that fraud orders and chargebacks can still happen to orders not flagged as fraud by the fraud analysis.

it's best to be aware of your typical customer segments and usually contact with the customer is key in this situation and if the customer does not reach back out, simply cancel the orders.

For anyone looking for more resources, consider these articles I've written in the past about this very topic.

How to best configure your shop to better reduce fraud.

Five data points to look at to help you identify high-risk orders.

And also consider giving the official fraud guide a read written by Shopify.

https://help.shopify.com/en/manual/orders/fraud-analysis

https://help.shopify.com/en/manual/payments/fraud-prevention

[My-Yellowcakesh]

Hello everyone-

I'm in need of some advice. I’ve been selling w/shopify online for over 10 yrs and I’ve never dealt with these kinds of fraudulent orders. They seem to be very unique and I have talked with Shopify support and they can’t seem to figure out the problem.

Over the last week and a half I keep receiving orders daily for very similar products-one of our Cami tank dresses or these Artisanal cookies that we sell for another local maker. All of these orders are under $40 typically but most of them have similar characteristics. The buyer is typically outside of Ohio so they are in California, Tennessee, sometimes even London. And they provide a different billing address than the shipping address-so it is typically in the same state they are ordering from. Shopify has not flagged any of these orders as fraudulent and they are all using the shop pay app. What’s even more strange is that when they order a Cami dress it is typically the same size and the same color black which is the default color on the product listing. Not all clients are aware that they are placing these orders but there have been a few so far that reached out saying they’ve never heard of my company and they would never buy this dress because they are male or they would never buy these cookies because they are allergic to gluten etc. So they are claiming that these orders were made in error or that their children made the order by mistake.

Shopify support assumed that there would possibly be a way for a client to accidentally order these products via the shop pay app without knowing. However, there are a few orders where a different size has been ordered other than the default. And I have a few orders when I turned off the items that were being ordered most frequently where the other items that were under $40 have been ordered by the same clients That claimed they had never made an order with us before.

But now they are ordering other products under $40 such as masks or hand sanitizer. And I’m not sure how to stop it. I could refund the client but I don’t know which orders are bogus and which ones are not. I have a good idea now based on patterns that I’ve seen but I don’t want to assume something and then not send a client a product they actually ordered. The other issue is that if I refund the client the full amount then I am losing the credit card processing fee. So when a client places an order for $40 that full amount is captured but only $36 of it is added to my account. Then when I refund the full $40 I’ve lost four dollars per transaction. There are over 12 fraudulent orders like this in the last six days on my website. I’m not sure what to do.

Shopify does not seem to have a solution on how to prevent this. I have removed the items that were getting ordered most frequently but no other items are being ordered. I could remove the shop pay app completely but a lot of my real clients use that app and that is one of the apps that is eligible for fraud protect. PayPal does not allow fraud protect. Any solutions would be helpful. It’s wasting so much of my time and money at this point. I can’t be bothered to continue dealing with fake orders when I should really be focusing on actual paying clients.

[Anythingd1]

It sounds like a shopping bot . Do yo have a partner that speaks code.
I have my children as my advisor in these situations. Getting a good
security service may be the answer.
Look for other merchants online in your area with the same problem.
If you can find code use it put on git hub and post it as a bad bot and
need assistance in countering it.
It is an on going problem but as bots advance so do scammers.
I hope this helps.
I'm sure Shopify complaints have more info for you.

[My-Yellowcakesh]

I hadn’t thought to combat a bot bc I’ve not had this issue but will definitely look into it now. 

are there any services out there you recommend?

do you recommend that I remove Shop pay app and shop pay payments?

[Anythingd1]

I'm afraid I don't know enough to advise a direction .I can confirm its
will be solved in time . Forums are talking on similar issues.
Just confirm in your own mind that it's not just.
Human error on either side.
Most of the to ime errors like this could be an in clicked box in some sub
section.