HELPFUL HINTS

HELPFUL HINTS FOR REVIEWING SUSPICIOUS TRANSACTIONS

RECOMMENDATION The transaction-specific recommendation provided to you by ReD Shield. Examine all transactions with a Recommendation of “Challenge” or “Deny”—ReD Shield is telling you that these transactions appear to be fraudulent and should be examined before any goods or services are delivered to the customer.

DEVICE ID A unique ID generated by combining the customer’s computer, browser, and other machine-specific parameters. Suspect fraud when multiple transactions come from one Device ID, but each transaction has a different Customer Email address, Customer ID, Card Number (Card No.), First Name, Last Name, Address, Phone number, Customer IP, and/or Real IP.

CUSTOMER EMAIL The customer’s email address.

01

Email addresses look to be randomly generated. For example, [email protected], [email protected], o3505951@ rtrtr.com,[email protected].

CUSTOMER ID Your company’s unique identifier for this customer.

02

Email addresses look difficult to remember, and therefore seem implausible as “real” email addresses. For example, [email protected], [email protected], or lkjsdfo978@ hotmail.com.

Suspect fraud when multiple transactions come from one Customer ID, but each transaction has a different Device ID, Customer Email, Card Number (Card No.), First Name, Last Name, Address, Phone number, Customer IP, and/or Real IP.

CARD NO.

03

Email domain looks unusual for example - audiqq.com.

04

It is free to register the email address (e.g., Yahoo, Hotmail, Google). Not necessarily an indicator on its own, as free gmail.com (for example) are commonly used legitimately.

A unique payment card number. Suspect fraud when: • The same Card Number (Card No.) is used in multiple transactions, each having a different Device ID, Customer Email address, Customer ID, First Name, Last Name, Address, Phone number, Customer IP, and/or Real IP. • The same Card BIN is used (first 6 digits) and the Card Number’s last four or five digits vary.

CUSTOMER IP

FIRST NAME & LAST NAME

The IP address of the customer’s computer at the time the customer placed the order.

The customer’s first name and last name.

Suspect fraud when: • In a relatively short span of time (less than 24 hours), a single Customer Email address, Customer ID, or Card No. is associated with multiple Customer IPs. • The Customer IP is different from the Real IP on the same transaction.

Suspect fraud when: • The name is unpronounceable. • In English, French, German, Italian, Portuguese, or Spanish, the name contains no vowels (the letters a, e, i, o, u, and in some cases, y). In these languages, a name with no vowels is usually fake. • Google the customer name - look for a LinkedIn (or similar) profile with same name/location

ADDRESS, ADDRESS TYPE, ADDRESS LINE 1, ADDRESS LINE 2, CITY, ZIP/POSTAL CODE, STATE/PROVINCE/PREFECTURE Either the billing, shipping, or recipient address for this order.

01

Multiple transactions having different shipping addresses all have the same Customer Email, Customer ID, Card Number (Card No.), and/or Customer IP. (Note: In the months immediately preceding holidays where gift giving is customary, this pattern will become more common, and during those times, this pattern may not, by itself, be used as a reliable indicator of fraud.)

02

Address Line 1 or Address Line 2 contains a word or phrase such as Ship To 123 Main Street, Home 124 Main Street, Ship2 to 123 Main Street, H0me 123 Main Street.

03

Address Line 1 or Address Line 2 contains unexpected special characters.

05 06

04

Multiple transactions on one card or a similar card with a single billing address, but multiple shipping addresses could represent organized activity.

To judge likelihood of fraud, look for: • •

•

• Shipping or Recipient Street Address Line 2 contains unexpected information. .

Multiple orders are made to the same shipping address, using different cards and/or other details.

Seemingly fake Last Name and/or First Name. Seemingly fake Address, City, State, or Postal Code: If the consumer ordered non-physical goods or services (such as downloadable content), then a fake shipping address could be entered without affecting delivery. A Country where fraudulent transactions frequently originate. Your company may have a list of origin countries that, by themselves, suggest a high likelihood of fraud. Google the address and customer details in an attempt to validate identity or correctness.

TIME ON FILE

PRODUCT LINE ITEM DETAIL

The length of time this person has been a customer

These fields describe what the customer ordered (Product Description and Product ID), and in what quantities (Product Qty.).

Suspect fraud: • If the customer is a new customer. Most fraud occurs from customers who are not regular or repeat customers. • If a customer does not create an account, this is a reason to treat them with caution.

Depending on your business, fraud may be more likely if the consumer ordered an unusually high quantity of a product, a high-risk item such as an iPad, or if the Product Unit Price is considered high Suspect fraud when: • A customer makes multiple orders of single high ticket items. Transaction size rules may be helpful here • Custom large value orders can be indicators of fraud, particularly for a first time customer To judge likelihood of fraud, look for: • Behaviours that are outside the ‘common’ or ‘normal for your business. Fraud has many factors and the specifics can be local to an industry or business type, so it’s important to get an understanding of what is usual customer behaviour and use that as a guide.

OTHER BEHAVIOURS Suspect fraud when: • A customer requests to overcharge a card and pay out those funds to a third party (courier, transport company, driver) via wire transfer • A customer requests to refund a transaction to a different payment method (e.g. another card, or wire transfer) • A customer requests to split orders across multiple cards