Has anyone else been receiving a lot of "high risk for fraud" orders? How to verify idenities?

[allstarr]

Recently, I have had 4 orders, all marked "High risk of fraud detected." It's possible, but I'm mixed on this.

First order:

1. Characteristics of this order are similar to fraudulent orders observed in the past
2. There were 4 payment attempts
3. Payment was attempted with 4 credit cards
4. Shipping address is 2117 miles from location of IP address (This could be tripped by the person using a VPN.
5. The IP address used to place the order isn't a high risk internet connection (web proxy)
6. The billing address is listed as Mexico, but the order was placed from United States

Second Order:

1. Characteristics of this order are similar to fraudulent orders observed in the past
2. There were 4 payment attempts
3. Payment was attempted with 4 credit cards
4. The billing address is listed as United Kingdom, but the order was placed from United States

Third:

1. Characteristics of this order are similar to fraudulent orders observed in the past (They all seem to have this?)
2. Shipping address is 1514 miles from location of IP address
3. The billing address is listed as Mexico, but the order was placed from United States

Fourth:

1. Characteristics of this order are similar to fraudulent orders observed in the past

Red, I figure, is high fraud. I think the gray items weren't a problem, and items light blue are ok?

"Contact the customer to verify their identity and the purchase before you fulfill the order." <- How do I do that?

[Horrorfigures]

I just recently received a similar order, 3 attempts, placed from Mexico, 

 

[Beacon-Jason]

Hi @allstarr 

There is a lot of fraudulent activity this year compared to last, due to more people doing their shopping online. You can either email the customer or reach out by phone. The phone option is best because you can actually speak to confirm the identity of the person in real-time and to see if the phone number provided is real or not. Otherwise, you can contact them by email and ask to make sure they have made the order they intended.

Just a quick FYI, Shopify's fraud analysis isn't always accurate and it's known to miss classify good and bad orders. Treat it as a warning and for those orders that have a medium to high risk, make sure the actual person has intended to buy what they wanted and that they know what the return policy is. It's really up to you as a merchant to decide whether or not you want to go ahead and process the order.

In case of a possible chargeback, contact your payment gateway provider and ask them what you should do and what evidence can you submit in order to help your case. If you want to know what else to look out for, I recommend you read the following article for more resources on what to look out for to determine a bad order. 

Five things you can look at to prevent fraud orders from happening to your Shopify site.

I hope this helps you.

[dylanpierce]

Unfortunately just judging an order's legitimacy based on metadata like IP address, billing address vs shipping address & device details aren't enough to know if a card card is stolen.

Masking your IP address and finding the personal details of stolen credit card holders  is much easier for criminals than it ever was before. 

To make matters worse, the line of signs of fraudulent activity vs legitimate online orders is more blurred than it ever has been. Customers are buyings gifts for friends and family in far off locations, mismatching billing & shipping addresses are the new norm.

These fraud signals are now noise.

You can use an ID check to 100% verify the riskiest of your orders. That way you're not stuck guessing if an order will lead to a chargeback or not. You can verify the details of the customer's government issued ID with their billing information.

https://apps.shopify.com/real-id

[thomassalelab]

With the risk of sounding super dumb here, but am I missing something blindingly obvious with regards to checking to verify an order?

If an order comes through as risky, and there's an email to write to and a phone number to contact, which Shopify recommends that you do, how would contacting them via these means verify whether they're fraudulent or not? Surely if a person is using a stolen card to place orders, they'll still be using an email address that they have access to and will simply answer 'yes I placed this order it is real I am not a fraud'? Same with a phone call.

So then we get a response from the person who placed the order, we despatch it because, well, we've done what shopify recommended we do, but then later down the line a chargeback happens, what do we say then? How do you stop the chargeback? 

Like I said, I know I'm fully risking coming across stupid here, but I'm just failing to understand what emailing/phoning does? How does it verify anything?

[dylanpierce]

@thomassalelab you're right, you can never take a customer's word for it.

Verification means to check details that are not easily spoofable, and correlate as many details as possible to make a judgement call.

A bad actor might be able to use a VPN to mask the country but it would be very difficult or impossible to proxy an IP address close to the billing address.

You can also use phone number look up tools to see if the phone number is registered to the same name as the customer, or if the phone number is from a VOIP service which are widely used by bad actors.

Last but not least, you can ask for additional documentation such as an ID or proof of address to correlate shipping or billing addresses.

ID verification is the highest level of security available now, with biometric facial recognition against the photo on the ID, and the ability to correlate the shipping/billing address against the address on the ID.

Hope this helps.

[Paolo01]

I got the same message on the company´s shop when I made a test purchase by using a VPN connection. So I guess most of the time it´s due to the Vpn.