I have been lucky to only have gotten 2 fraudulent orders in the 6 months that I have been in business. But know I am getting a whole new site and with that I would like to start advertising. Now my problem is that I am afraid to start getting all these fraudulent orders as soon as I start advertising. Now what I would like to know is how to I find out where the order is coming from using the IP? Is there a free way of doing that? Or do I have to go out and buy software? What software should I get? Or there are things that I can do to prevent it? Like calling the number on the order to verify it or anything like that? I will really appreciate your help....

I think the best way to do it is to call the phone number and verify the order.

Just one tip here, most of our fradulent orders are for the "big ticket items". They'll usually go for the most expensive package. So orders for the most expensive package get scrutinized more.

We use the CVV (card verification value) from the back of the credit card and do AVS (address verification system). We also make sure that the name and adress on the card is the same as the address provided as a contact. If that doesn't match, then we normally call the owner of the card (not the person who ordered the service). Sometimes it's a surprised card owner that says they didn't authorize the charge and thanks us for calling.

We use the white pages to find the card owner, since we have their name and address (for AVS). We also verify the address of the orderer with software from the USPS which also conveniently gives us their 9 digit zip code. But that only works for our US customers.

But to answer your question, VisualRoute, a visual traceroute program is pretty good at guessing the location of an IP address. It either queries ARIN or has a database back end that it uses to get locations, I'm guessing.

http://www.visualroute.com

How do you know the CVV is really for that card or even a valid one? Cant they just make one up? Also my merchant bank does a AV they charge us like 10 cents more per transaction.

Sure they can make it up. But then it won't match up with the card number. There's a reason it has 'verification' in its name.

I know that. But my question again i guess i didnt make it clear is... how do i know it belongs to that card?

Well, hopefully, your credit card processor will tell you.

I guess they do have a 1 in 1000 chance of guessing the right CVV. If we provide a CVV to our credit card processor and it doesn't match, the charge won't even go through unless we override.

There are a lot of foreign banks that just say "CVV Not implemented", and you can't benefit from the extra protection.

The CVV is the 3 digit number usually imprinted on the back of the card after the account number. The CVV number is good because it doesn't get imprinted on credit card receipts and such. So most people who steal credit card information don't usually get the CVV too.

Our credit card processor prides themselves on not charging us extra for doing AVS. But for them, I think it makes sense. It's their way of encouraging us to do it, which will save everyone money in the long run due to less fraud.

You can use perl,php or cgi script to track visitors IP and other details. Using merchant account is the best solution.

right that is what i will be doing. the system will log their IP then it will be shown to them on the order form. but what good does it do to me to have it when i really cant check up on them with it? so what should i do buy a program for that, that will tell me where they are at or is there a site or something where i can look it up?