Understanding E-Commerce Risk

If you have spent any length of time in the e-commerce industry, chances are that you have become all too familiar with the various types of risks involved in selling products and services over the internet. Fraud, customer disputes, chargebacks come in various shapes and forms, yet all of them are costly, time consuming and require constant attention. Risk exposure in a card-not-present environment is determined by the established business policies, operational practices, security controls, fraud detection and prevention tools and the types of products and services sold. If your business is to be successful in minimizing fraud and chargebacks, your entire staff should clearly understand the risks associated with processing e-commerce transactions.

Understanding e-commerce risk. Understanding e-commerce risk will help you better design your business and operational policies and in selecting the right fraud prevention tools and security controls for your organization. The typical risks that an e-commerce organization will encounter are:

• Fraud. E-commerce fraud can take several shapes:
  • Use of a stolen card number to fraudulently purchase products or services.
  • A family member uses a card to make purchases without the cardholder’s authorization.
  • A customer falsely claims that he or she did not receive a shipment.
  • Hackers penetrate an e-commerce merchant’s system and issue credits to themselves.
• Account information theft by hackers. There are a couple of ways for hackers to access personal account data:
  • Intercepting customer account data during transmission to or from the merchant.
  • Accessing inadequately protected systems and stealing data from them.
• Account information theft from a physical site. Data can be stolen from a physical site in a number of ways, including:
  • Stealing cardholder data by an outsider from a merchant’s site and using it or selling it for unauthorized use.
  • Stealing cardholder data by a?ámerchant’s employee and using it or selling it for unauthorized use.
  • Stealing unshredded cardholder data by a dumpster-truck’s driver.
• Customer disputes and?áchargebacks. There are many reasons why a customer will dispute a transaction but the most common are:
  • The product or service is not as described in the promotional material or website.
  • The customer is billed before the product is shipped or the service provided.
  • There is a misunderstanding about the cancellation of an order (often in a recurring payments?áplan) or the return and refund of a product.
  • The customer is billed twice for the same order, or the transaction amount is incorrect.
  • The customer does not recognize the merchant’s name on his or her credit card statement.
  • The customer’s card is charged without his or her approval.

Understand the chargeback process. The importance of understanding chargebacks and developing procedures to deal with them cannot be overstated. Chargebacks are not only costly and time consuming but if they exceed 1 percent of the total number of your sales transactions, your account will be suspended and, if you cannot reduce the rate, it will be closed altogether. The following suggestions will help you keep chargebacks under control:

• Work with your payment processor to understand chargebacks and to develop protective mechanisms against charged-back transactions. A special emphasis should be given to:
  • Transaction authorization requirements.
  • Expired authorization rules for unshipped products.
  • Time limits for fulfilling sales receipt requests.
  • Customer disputes.
  • Fraudulent transactions.
• Understand your rights for re-submitting transactions charged back for fraud reasons.
• Implement fraud prevention tools.

Train your staff in e-commerce risk management. If your staff is unable to implement your risk management procedures, all of your efforts will be in vain. Every member of your organization should:

• Have a complete understanding of e-commerce data security issues and fraud risk.
• Understand the chargeback rules in regards to internet transactions.
• Be well-trained and capable of implementing your risk management policies.

Image credit: Dx3canada.com.