THE FUTURE IS ROSY:::::::::THE FUTURE IS RTD;;;;;;;;

'Tis the Season to Be Wary
With the holiday shopping season in full swing, small companies doing business online need to be especially aware of fraudulent activity on their Web sites. Jeff Foster, executive vice-president of fraud-prevention service Retail Decisions (LSE: ADVERTISEMENT


RTD.L - news) , spoke with BusinessWeek's Kimberly Weisul about preventing online credit card fraud. Edited excerpts of their conversation follow:

Q: Which online merchants are most vulnerable to credit card fraud?

A: Where we see small merchants getting into big trouble is where they have expensive merchandise and low margins. For some PC manufacturers, the average ticket going out the door is going to be about $800. If there's a 5% margin on that I'd be shocked. If they lose one order to fraud, they're in business for the next two and a half weeks to make up for that loss. Those folks really get hammered every single time they get a chargeback [a transaction successfully disputed by a customer or cardholder].

The other merchants at particular risk are those with low average tickets, high margins, and high volume. They're probably dealing in items that are easy to resell. Those merchants can be taken for dozens of orders before they get wind of anything wrong.

Q: If you can handle the monetary loss from fraud, how serious a problem is it?

A: You can get in trouble with the credit-card companies and with your payments processor. The credit-card companies get upset if 1% of your transactions are fraudulent, or if you have more than 100 chargebacks. You'll get charged a fee for each chargeback and be put in a global merchant-monitoring program. That carries a review fee of up to $25,000 a month. If you can't get the chargebacks down within a number of months, the credit-card companies are going to drop you altogether.

Even if you're only getting one chargeback a month, your payments processor still has a standard fee they're going to charge you, like a bounced-check fee. If you have chargebacks of 2% or 3%, the processor will dump you. That being said, if they think you're willing and able to turn things around, they're going to give you the benefit of the doubt.

Q: What are some of the very basic things that small companies can do to prevent credit-card fraud?

A: Merchants should make sure they are at least collecting the "bill to" and "ship to" addresses, and comparing them. You should ask your payments processor to verify the addresses. Verifying address doesn't take any longer than normal, and generally doesn't cost any more. There are also security codes on credit cards that are not embossed. Ask people to input those numbers. The credit-card companies have html pictures you can paste onto your payment screen to show where they're found.

Q: What if you're already being ripped off?

A: Try taking all of your chargebacks for a month and looking for patterns -- say, in the products people are stealing or in the time of day that people are stealing from you. Of Amazon.com's entire portfolio of books, I bet there are 1% anyone would steal.

And you haven't lost anything until you ship the order. Certainly there is some time after the credit card has been authorized to get your ducks in order and see if there are transactions you don't like. If you have a product where the average order is one or two items and someone wants 300, that's fraud. And they'll probably use a bunch of different credit cards or names or shipping addresses.

Q: How about something more automated?

A: Verisign (NASDAQ: VRSN - news) has a payment tool that connects to the credit-card processors. It has a very basic rules system you can use for about $20 to $50 a month plus a setup fee. You program it yourself using drop-down menus. You can put in rules based on how often people have shopped with you or how far away the "bill to" and "ship to" addresses are. If a transaction doesn't meet the guidelines, you can insert a prompt that will ask the buyer for more information or ask them to call an 800 number.

Q: What are some of the pitfalls of using rules?

A: People make them too broad. Generally, any small merchant using rules traps legitimate transactions. The typical rules system traps 17% of total transactions. You're trying to solve a problem with 1% to 2% of your transactions, and instead you're annoying real customers.

Q: At what point do you need to call in more help?

A: Certainly if you're over 1% in chargebacks you have to get help. It's only going to get worse. That's triple or quadruple what you should be. If you're doing 10 transactions a month but the average ticket is $5,000 with a 1% margin, you need something in place.

Q: What else is available?

A: You can use a service like ours or buy a software package. Our service runs all transactions through a database of 75 million bad cards. Two-thirds of the cards being tried today for fraudulent purposes have been tried before. People trying lots of different credit-card numbers often use the same domain name with different e-mail addresses. More than likely, the IP addresses will be the same. And there are only so many places they can have orders shipped. We look at a suspicious IP address and connect them with a shipping address, and maybe multiple credit cards. The software is usually rules-based, although some use screens to pick up patterns.

Q: How much does it cost?

A: Our service can be deployed at a low upfront fee, and then it's 10 cents to 25 cents per transaction. We've done it for a few thousand dollars. The software solutions cost from a couple of thousand to $10,000.