|
Overview
As criminals become more sophisticated in their attempts to commit online credit card fraud, new technologies are required to discourage and detect fraud before it occurs. Risk of fraud is a potential barrier to online purchases. It can also be costly to merchants, since they must bear the costs of successfully disputed purchases. In addition, too many “charge-backs” can cause merchants to have their merchant account status downgraded or revoked, thereby negatively impacting their business. A number of technologies are emerging to both secure sensitive data and reduce the amount of successful fraud at the various stages of the order cycle.
Input-Based Methods
Several technologies exist that verify data input by purchasers at the time an order is placed on a merchant’s website.
AVS (Address Verification Service) matches the street number and zip code that is entered by a purchaser with address information on file with the credit card companies. A message is then sent back to the payment gateway indicating the degree to which the address information matches (e.g. “Address matches, zip code does not”). Based on the AVS settings or "filters" the merchant has set within the payment gateway, the merchant can then make a decision about how they wish to proceed with the transaction when there are mismatches. One key drawback to AVS processing is that checking occurs only after a valid authorization is returned. This means that there will be a hold on the customer’s account for the amount of the transaction, even though the merchant may decide to decline based upon the AVS results. This method is widely used, however.
Most AVS tool enables merchants to control how closely the numeric address information must match in order for the transaction to be allowed to settle.
Another technology supported by the credit card companies is called CVV2 (Card Verification Value) by VISA, and CVC2/CID by MasterCard and AMEX respectively. These technologies use codes that are embossed on the back or front of VISA, MasterCard and AMEX cards. CVV2 and its counterparts require a card holder to enter the codes at transaction time to verify that they are in physical possession of the card. Since these values are not stored in transaction databases with other credit card information, hackers cannot gain access to them if they somehow acquire credit card numbers from a database. During the authorization process, the card issuing bank verifies the CVV2 value that was entered with the credit card number.
|
