Credit Card risk scoring (was Re: UKNM: Re: Credit Card Fraud)

[Jay]

> I did read of one system that apparently uses a special technique to give

> merchants a scoring for a potential transaction, based on the information

> presented (e.g. name and address as well as CC details) then leaving the

> merchant to choose whether or not to proceed with the transaction. The fact

> that the company said it couldn't explain how it worked because that was

> their USP put a big question mark over it for me though.

>


This is known as the "Address Verification Service" and is run by (US) based

card processors for mail-order & telephone order merchants to manage risk.


>From Chapter 14 of "Philip and Alex's Guide to Web Publishing"

http://www.photo.net/wtr/thebook/ecommerce.html


- a book which I cannot recommend highly enough. If you are a site builder,

marketeer or manager and you are involved with an ecommerce site, you *must*

read this book cover to cover.


"If a merchant ships a $1000 widget to a crook and the real cardholder

complains, the merchant has to give $1000 back to the bank. In order to help

mail-order telephone-order merchants manage this risk, the card processors run

what seems to be an essentially separate system called Address Verification

Service. They take the first 20 characters of the street address and the billing

zip code and return a one-character code:


Y means "five-digit zip code and address both match"

A means "address matches, zip code does not"

Z means "zip code matches, address does not"

N means "neither address nor zip code matches"

R means "system unavailable or timed out"

S means "card type not supported"

...

As a merchant, you have to decide what to do in these various cases. ArsDigita

Shoppe encapsulates this business decision in a single procedure containing a

list of codes that are deemed sufficient to put an order into

authorized_plus_avs. The merchant also needs to make a business decision for

every order that lands into authorized_minus_avs. To ship or not to ship? That's

the question. ArsDigita Shoppe by default will solicit a customer's telephone

number and presumably the merchant will be advised to email or telephone the

customer for verification.

Note that in our experience AVS is not very reliable. For our first few

successful orders, all of which were from legit folks, here are our stats:


AVS Code Count


N 2

R 1

S 1

Y 11

Z 28


The 11 cases in which both address and five-digit zip codes match looks pretty

good until you look at our source code and note that we neither solicit the card

billing street address from the customer nor do we ever provide any street

address to CyberCash. We only solicit card billing zip from the customer and

send that through to CyberCash. Consequently, the 28 cases of "zip code matches"

are to be expected. In two cases, the AVS code raises an unreasonable suspicion

("no match"), and in two more cases we couldn't get an AVS code at all. The one

"card type not supported" (S) was a friend's Mastercard. Oddly enough, it was

issued by BankBoston, our merchant bank. "


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Jay Gooby

Tui Interactive Media [http://www.tui.co.uk]

34-35 Dean Street London W1V 5AP

+

44 (0)171 734 7757 jaytui [dot] co [dot] uk

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

post new media vacancies for free

uknm-jobschinwag [dot] com

 				*******************

 sponsor the uk-netmarketing list and website, contact

saleschinwag [dot] com

 for more details.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  To unsubscribe or change your list settings go to

http://www.chinwag.com/uk-netmarketing or

helpchinwag [dot] com