BUCKAROO-PAYMENTS.COM

Transcription

1 Fraud prevention BUCKAROO-PAYMENTS.COM

2 1. Unsafe web shops Introduction In practice, web shops are regularly vulnerable for fraud. If a web shop environment is not secure, fraudsters can change and/or add data without the web shop owner being aware of this. As a result, the fraudster gets goods delivered for little money or even for free and the web shop owner s business suffers (substantial) losses. Here follows a description of various possible security vulnerabilities in web shops. We also describe how to prevent these vulnerabilities by using Buckaroo s functionalities before they impact your business operations. 1.1 Vulnerability when calling an online payment service In this scenario, the fraudulent customer changes the amount and/or other parameters when calling an external online payment service. This is how it is done. The fraudster copies the HTML code of the checkout page to his own hard disc, changes the values of the parameters and carries out the payment from his own computer. The digital signature of Buckaroo s Payment Engine safeguards the integrity of the call and the authenticity of the fields. If the digital signature is not valid, the payment request is denied. This way, we can recognise payment requests to the Buckaroo Payment Engine that aren t made by the web shop, but by another party. So when another person with an invalid signature calls the Payment Engine, the transaction is not processed. 1.2 Vulnerability when payment status is confirmed In this scenario, the fraudulent customer changes the amount and/or other parameters in the payment confirmation from the external online payment service. The scam is based on the same principle as described under 1.1, but here the fraudster changes the payment status. The altered parameters are then sent to the web shop from his own computer. By doing so, the payment request will appear to be have been successful, while in reality the payment failed or was not processed. Fraud prevention 2 van 5

3 The digital signature of Buckaroo s Payment Engine ensures that the payment confirmation is actually generated by Buckaroo and not by another computer. If the digital signature is not valid, it is clear that the payment status confirmation is not coming from Buckaroo. In such case, the website owner should notify Buckaroo as quickly as possible and, of course, cancel the delivery. 1.3 Vulnerability once payment has been effected In this scenario, the content of the order (shopping cart) is changed after payment has been effected or completed. This is how the scam works. The fraudster copies the HTML code of the web shop s order pages to his own computer. As soon as payment has been effected (or sometimes even after completion) via the checkout page, the scripts are used to modify the content of the order in the shopping cart. Some web shops even have a Keep shopping button that remains active on the checkout page after payment is initiated, thus facilitating the scam. The shopping cart, i.e. the order, should be closed for changes as soon as payment has been effected. Naturally, interrupted or failed payments should be taken into account, so that: - the customer can either continue shopping - or initiate a new payment transaction (possibly using another payment method). It goes without saying that this security measure should not create too much hindrance for reliable customers. Developers of web shop software should generally be aware of the vulnerabilities of the Internet architecture. In principle, each call of a website leaves traces and therefore visible to everyone and susceptible to replay attacks and unlawful acts. Only sufficient security measures as session management, process management and quality control can prevent fraud. Fraud prevention 3 van 5

4 2. Credit card fraud Credit cards are a popular and reliable means of payment that provide consumers with the extra assurance that the acquired goods are (usually) insured against theft and/or damage. If necessary, consumers also have the option to reverse transactions via so-called chargeback payments. Unfortunately, they are occasionally used improperly by fraudsters. This also happens online. In order to prevent fraud, you should pay attention to a number of aspects Pay attention to strange orders Keep an eye on orders, including a long-term check. For instance: - Have strange quantities been ordered? - Is there an unusual delivery address? - Keep on the safe side and check whether the order is correct. Other examples: - orders from adjacent house numbers; - orders from different addresses made using the same address; - orders from geographical areas that do not make sense because the products are difficult to ship or because the products are cheaper in that area; - orders of multiple quantities of the same article to a single address if it is does not make sense to use more than one in the same household/family. Analyse the orders and compare the various orders/situations. Try to work out whether a certain order would make sense coming from a sympathetic, bona fide consumer? - Exclude certain countries (option offered by Buckaroo). - Only allow credit card transactions for amounts up to e.g Check ship-to address, IP address and in what country the credit card was issued (option offered by Buckaroo). - List criteria for suspicious or strange orders on your website. - Make sure suspicious or strange orders are only paid for with guaranteed payment instruments, such as ideal and/or bank transfers. - Create a monitor function to check orders at a later date and, preferably, in advance. Fraud prevention 4 van 5

5 2.2. Ask for order confirmation by fax or telephone We recommend extra checks, particularly when large sums of money are involved. For example, ask for an order confirmation by fax or call the customer by phone. Check to see if the telephone number is in the phone book. You can make it compulsory to enter a telephone number and address. Refuse to accept mobile numbers and free addresses (like Hotmail). 3. Ask for the Card Validation Code The 3-digit CVC2-code (MasterCard) or CVV2-code (Visa) or CAV2-code (JCB) is an extra check besides the expiry date and card number. You can make it compulsory to enter this code too, which is what Buckaroo has done. 4. Ask for a signature upon delivery To ensure that the order is delivered to the correct address, ask for a signature upon delivery. Only deliver to the addressee in person. Do not deliver to neighbours if the addressee is not home. In addition, we also recommend that you do not deliver to post box numbers. 5. Be alert with certain products Electronics (mobile phones, cameras, hardware, etc.), video and music content, software, expensive brand articles or erotic articles are examples of products that have a higher risk of fraudulent orders online. After all, these products are very desirable, so extra vigilance is required. When using the Buckaroo Online Payment Services, you have the option to only accept payment instruments as ideal and bank transfer payment for fraud-sensitive products. For less fraudsensitive products, you can decide to also accept credit cards. Fraud prevention 5 van 5