Web Hosting Talk







View Full Version : WorldPay's fraud checking - deficient


Zolotek
11-06-2002, 02:27 PM
If I put a card through WorldPay and enter, for the card-holder's name, something like "Noddy", "FatherChristmas", "George Pretzel Bush", should WorldPay accept the transaction as being valid?

This is effectively what has recently happened. Someone used a stolen Visa card along with the correct address, but for whatever reason gave a false name. WorldPay accepted this and, now that the cardholder has disputed it, want to do a chargeback against me.

In my correspondence with WorldPay, they tell me, quoting inter alia: "We use authentication schemes although as you know the name is never checked. This is because when shopping people sometimes buy gifts and enter the name of the recipient of that gift. Please note the banks authorisation checks the card number entered to see if it is a real card number and has enough funds on it and has not been reported lost or stolen" .

My response was "utter nonsense". I did NOT know that WP never check the name, especially as their form lists the card-holder's name as "required". The recipient's name when it's a gift??? The rest I read as saying "so long as we get our cut then that's OK".

They wrote more nonsense which I won't bore anyone with, but I would like to know what others feel about this situation. Their "chargeback" team wrote the above yesterday. After a fairly blunt telephone conversation, they promised that their "customer relations head" would contact me today, but as they have failed to do so I am now putting this out to the board for opinions.

Note that even though I also have hostcharge.com, I am now thinking of changing to either charge.com or paysystems.com (or both) - these both assure me by telephone that they DO check the name and this scenario could never happen with them - as is only right. And instead of only sometimes, I will now *always* phone the card-holder first and then put the card through manually.

Cheers
Lyn St George

time-to-go
11-06-2002, 03:19 PM
yeah got the t-shirt on that one :)

Not sure if they have changed but they rely on the bank of the card holder for checks, now some banks don't give and response if the name and the address is incorrect so in worldpay terms you get the 'not checked' and yes Mickey Mouse from Disneyworld can order using such cards through worldpay

In reality they do no checks themselves unlike people like 2checkout who must use a third party system to check name and address, because we can process using our company card through worldpay using any old rubbish for the name and address but not through 2checkout it has to be 100% correct

Here is there reply to me regarding our Mickey Mouse order, surprised really as I thought Mickey would have gone for a windows machine:)

> Card authorisations are done by the banks/card issuers and are based on
> their rules. We have no control over this whatsoever. Whilst the banks
> perform and address check against the details they have, a transaction
will
> not be declined based on the result, merely flagged. Card holders name
does
> not perform part of this check, so you are correct that someone could
enter
> anything for both name and address and this would not stop the transaction
> being authorised.

The merely flagged part is rubbish to it just says 'not checked'

sphere2
11-06-2002, 03:32 PM
If that's the case, that's really bad. They have a really large international client base, so if this is their version of fraud checking maybe they should be doing more.

The banks as it is are really cracking down on fraud and chargebacks, so you would expect them to take better precausions, not just for themselves, but for their clients.

iWebbers.com
11-07-2002, 09:18 AM
That's why you should manually check each orders.

No processor can completely detect fraud.

ThomasC
11-07-2002, 09:22 AM
/me scores worldpay of my list.....

Zolotek
11-07-2002, 11:24 AM
Originally posted by iWebbers.com
That's why you should manually check each orders.

No processor can completely detect fraud.

Quite. But the point here is that WorldPay are not even doing the basic and simple fraud detection. If their only check is that the card is not reported stolen and has sufficienct funds that WP will get their cut, then this is simply not good enough.

You might expect some nonsense like this from a minor player in the field, but WP claim to be up there at the top of the tree, and charge accordingly. And they have a rather large customer base - though they have lost me and I would suspect a few others reading this. And they will no longer be on the list of recommendations given to any of my clients.

ThomasC
11-07-2002, 03:10 PM
/me Agree's with Zolotek.

apollo
11-08-2002, 03:07 PM
how much they charge for each chargeback?

chrisblack
11-09-2002, 09:03 PM
Worldpay charge me £10 GBP per chargeback - a little annoying. How much do other companies charge?

As for fraud detection, they do have something called WorldAlert (I think). It seems that you can enter names, e-mail addresses, ip addresses, hostnames you would like to prevent ordering from you.

Suppose if you are bored one afternoon you could think of some amusing, but likely to be joke, names and put them in - mickey mouse and harry potter to name two.

coight
11-09-2002, 09:10 PM
The thing that annoy's me is that they have removed the online statment feature.

Gernot
11-10-2002, 08:27 AM
Originally posted by Myacen
The thing that annoy's me is that they have removed the online statment feature.

They haven't, it's still there just under a different URL.

coight
11-10-2002, 06:04 PM
Originally posted by Gernot


They haven't, it's still there just under a different URL.

What is the url?

iSPtek
11-10-2002, 06:09 PM
go here http://support.worldpay.com/admin/index.html and you will see a link to online adhoc statements

It looks like worldpay have been having major problems with their backend

coight
11-10-2002, 06:21 PM
Nevermind it works under the old url:

http://select.worldpay.com/wcc/admin/

ServerCentreLtd
11-10-2002, 08:17 PM
Seriously thinking of dumping Worldpay and going with Barclays EPDQ service, especially after finding this out.

What is the extra charge per transaction for then, if it isn't used for fraud screening as per the description?:mad:

iSPtek
11-11-2002, 05:37 AM
WorldPay do give the option to pre-authorize purchases, in other words the card is checked to make sure funds are there and held but the payment is not processed (or their 4.5% taken) then you can accept or decline without charge

GordonH
11-11-2002, 09:15 AM
Seriously thinking of dumping Worldpay and going with Barclays EPDQ service, especially after finding this out.

You will be lucky.

They turned us down because web hosting was too high risk and we turn over too much of our income is from CC transactions.
They told me they were trying to "exit" other customers in the same field........

Anyway I dont think they check the names either or lots more transactions would be declined because someone put their name, nit the way it appears on the card.

My current RFI file has 9 entries

1 is an Indonesian who slipped through and was refunded within 10 minutes but I heard yesterday has been charged back as well.

The other 8 are customers doing malicious chargebacks to get free domain names or to obtain free services.

In two cases recently we have had signed documents from the customers stating they are no longer disputing the transaction and the chargeback has still gone through.
These documents have been sent to Worldpay within 72 hours of the RFI being raised.
I am of the opinion that they do not actually pass these documents to the bank.
In both cases I am continuing to badger Worldpay for refunds of the chargeback fees.

Gordon

ThomasC
11-11-2002, 05:35 PM
Sorry to hear that Gordon.

sphere2
11-11-2002, 05:47 PM
Why don't companies before doing a charge back contact the merchant. Have the merchant get in contact with the client.

Give them a week to two to work it out and if not have the merchant do a refund.

How many merchant would like a two minute head start to decide if they want a chargeback verses crediting an account?

Even if the merchant is right, I am sure I would rather credit back a client trying to get free hosting, (then close the account.) Rather than pay for a chargeback.

Why don't these 3 party companies give merchants a 2 second head start?

The banks should work with the third party processors. Give them and merchants 2 weeks to do a refund, work things out with the customer or face a charge back.

But I guess the banks make more off of chargeback.

GordonH
11-11-2002, 06:02 PM
But I guess the banks make more off of chargeback.

That appears to be the reason.

Gordon

Gernot
11-11-2002, 07:47 PM
Originally posted by sphere2
Why don't companies before doing a charge back contact the merchant. Have the merchant get in contact with the client.

Give them a week to two to work it out and if not have the merchant do a refund.

How many merchant would like a two minute head start to decide if they want a chargeback verses crediting an account?

Even if the merchant is right, I am sure I would rather credit back a client trying to get free hosting, (then close the account.) Rather than pay for a chargeback.

Why don't these 3 party companies give merchants a 2 second head start?

The banks should work with the third party processors. Give them and merchants 2 weeks to do a refund, work things out with the customer or face a charge back.

But I guess the banks make more off of chargeback.

Theoretically, that is already the case.

Whenever someone files a chargeback against a charge on his credit card his bank sends a RFI (Request for Information) to the aquiring bank which then forwards it to the merchant who then has about a week to clarify the situation by giving the card holder's (issueing) bank the requested information stating that the charge was indeed correct.
The problem is that, in order to successfully finish such an RFI, the merchant has to supply a signed receipt which most online merchants naturally don't have. Therefore most RFIs get delayed by either side so much that it either never arrives at the online merchant at all or too late, because there is virtually no chance of winning the RFI process.
Thus what definitely ends up in the merchant's mailbox is the notification about the chargeback along with the chargeback fees.

If you do get a RFI on-time you should contact the customer and if he is not willing to take that RFI back and agrees to the charge in writing, you should always refund the disputed charge. Then there's only a rather small chance that you will get double-billed which means that you refund your customer but the chargeback goes through nonetheless :) But still that does happen because many of those bank clerks in charge of chargebacks are idiots. Then you have a realistic chance to get the money back with the support of your bank / 3rd party provider. In fact WorldPay does help you quite well with that sort of things.

ServerCentreLtd
11-11-2002, 07:50 PM
Has anybody tried these www.protx.com only 5p per transaction! No setup Charge or monthly fee!!! and no I don't work for them or affilated with them in any way (Well apart from signing up)

Regards