allwhois.com - I use it to validate the domain information they provide

http://www.geobutton.com/IpLocator.htm?GetLocation - I use this to validate that the ip address they used to signup matches the address information they provided.


Anything else out there any good?

I'm not sure there really is a solution yet, the order IP gets mailed to the admins but I think the best check is simply having their CC charged or verified when the order is placed. Most CC companies will decline the card if the address does not match the owners address. The AVS system its called.

aNc

We verify and compare the following:

IP address
domain name whois
Signup address
AVS (Address Verification System)
CVV2 - that little code on the credit card

Originally posted by dandanfirema
We verify and compare the following:

IP address
domain name whois
Signup address
AVS (Address Verification System)
CVV2 - that little code on the credit card

[We verify] the AVS, CVV2, and loggs the IP. what method do you use to "verify" the IP and what "signup address" are you refereng to the source IP?

acameron: RTFR

AVS is the best way to verify the ADDRESS of the credit card. Ideally, you should have some way to physically confirm a successful purchase. IPs can easily be spoofed, so geographically tracing the IP may still end up in fraud.

You could:
Phone the customer to verify the order. Simon at AQhost does this (i think) and I'm pretty sure he's got a low chargeback rate.

Ask for a fax of a copy of the credit card. A digital picture might also work.

Ask for photo id. This can also be easily spoofed, but it's a step closer.

Those are all very good suggestions but I was thinking more of the lines of an automated check verses an active administration initiative to verify info. A "need signed confirmation" should always be part of a hosting Co's welcome letter.

*sighs, and wonders how many years it will be until credit cards have a public key infrastructure that makes verification 100% automatic and fraud almost impossible*

We let Paysystems take care of it. :D

Originally posted by NexDog
We let Paysystems take care of it. :D

The perfect lazy person's answer, but effective none the less.

Damn, you got me. :)

We have someone to do billing but that's mainly to make sure people are paying and Paysystems are paying us. Leaves me free to co-ordinate looking after HostNexus's customers and develop new services - that's what I enjoy the most. Got projects coming out my ears and wouldn't have it any other way. :cool:

AVS (Address Verification System)

Where can I find such a solution that allows me to do this?

Originally posted by progex


Where can I find such a solution that allows me to do this?

Most CC processors and software packages do this. So you might want to check with your merchant providor. I also saw a javascript thing once that did it for a small monthly fee to connect to thier network. Search google, you can find something I am sure:)

aNc

It would be cool if there was some kind of Voice IP solution that would automatically call people once an order is placed, ask if they did place the order, etc., and then confirm it in your orders db. I think calling is the best answer but unfortunately, people like to chat and that really cuts into working time. I guess I could just call and claim I am a paid caller who knows nothing but to confirm orders :-)

Some service make you call from the number on the credit card file and enter a PIN from a confirmation email:) But thats a whole lote of codeing!

aNc

It would not even need to be that complicated. Instantly, you are going to cut out all credit card fraud from people who have stolen US card numbers and are trying to purchase hosting from overseas (because they will not have a US number to call).

Secondly, you could record the conversation and phone number dialed so you have proof that they did confirm (or some number/voice to track down if a fraud phone is used) the order. If the phone number they give does not match the credit card number or if it is in a different US city, it could be redirected to a queue for a human to call.

I unfortunately no 0 about voiceXML or I would try to do something like this. Heck, seems like a service that other web hosts would probably even pay for. I am pretty sure it would cut down on a lot of fraud, probably even prevent many attempts if you explain the phone confirmation step at checkout (why even try to put a fake order through if your server will not be activated).

Okay,

First of all fraud will never be impossible. As new technology evolves new ways to work around it also come into being. As for protecting yourself from fraud some nice tips have been given by people. Altough, IP can easily be spoofed, Signup address will also match and many times advanced credit card fraud guys know how to change phone number because they have complete information of a person. The only thing one can not change is the address on the credit card file. The phone number, fax number other various information can be easily changed by making one phone call. The best thing to probably protect yourself is by doing a next day letter thru fedex or ups costs only about 10 or 15 bucks for shipping from one coast to another. In the letter you can maybe have the password or something of that nature that can be verified.

;)

Originally posted by bjseiler
It would be cool if there was some kind of Voice IP solution that would automatically call people once an order is placed, ask if they did place the order, etc., and then confirm it in your orders db.

I just ordered a voicemail number at uReach.com, and they had a *very* cool system for doing something similar, but I have *no* idea how they do it.

Basically, when you add your credit card to your uReach account for them to bill it, they then generate a code (I think it was a 10-digit number) which you then have to phone their toll-free phone number from your home phone and enter the 10-digit number. Their system then contacts your credit card company, looks up the phone number your credit card company has on file, matches it to the phone number from which you are calling, and if it matches they approve the credit card for use to buy uReach services.

I have *no* idea how they do this, but I like it. I like it a lot. I wish there were a publicly-available (and inexpensive!) system that companies like ours could itilize for this.

Jason

My credit card processor uses AVS, as well as a few other measures, including geo ip tracing. They track where the ordering ip originated from and compare it to the address on the order form. For instance, one time I got an order from texas, but the IP originated in Belarus. As you can imagine, I couldn't press the refund transaction button fast enough :)

Most of my clients are people I've spoken with and I know they are signing up, but if I get someone that doesn't look familiar, I call them up and welcome them to the service. Most people appreciate it.

I am 90% sure you have to pay for the geo ip information. If everyone had listed phone numbers, you could just have them call into an 800 number and leave a "confirmation number" for example (after telling them to call from the billing address phone number). You could then go to anywho.com/rl.html and do a reverse lookup on the phone number to see where they were calling from. It would still probably work most of the time, but people move, numbers aren't listed, etc., so it is a pain in the rear.

removing this, to many people interested to ignore it:)

aNc

I am 90% sure you have to pay for the geo ip information.


Yes, I have an actual Merchant account.
has it's benifits.

Which merchant account service has geo IP? I have a merchant account with Wells Fargo through Authorize.net. If they have it, then I have totally overlooked it.

I'm with internet secure. ( www.internetsecure.com ) They are a great service, lots of reasons why I like em over in the long thread about 2 checkout.com's problems, but they aren't perfect. Overall, I'm happy though.
Here's a quote of me from the other thread:


The Good:

I use www.internetsecure.com I looked into companies like 2checkout, but I decided I didn't want to mess around with something as important as billing. The start up cost is somewhat steep, but you get what you pay for. I've been incredibly happy with their service, I've never had any problems and any technical support questions sent via e-mail were answered same day. They personally check all your order forms and recurring billing scripts themselves to ensure that they have been done correctly. I actually visited their offices, and it's not a fly by night operation. They have a rather large building and staff. They offer accounts for Canadian or US dollars or combined accounts.

The Niether Here, Nor there:

The deposit money directly into your bank account on the 13th and 28th of every month (minus a standard hold back). They aren't usually right on time though, sometimes it takes a day or two for the deposit to be made.

The Bad:

They have their own order form, that will bear your companies name, so you can't totally integrate them seemlessly into your site. I was a bit unhappy about this at first, but my customers don't seem to mind.


The Shameless plug:

If you look into Internet Secure, sign up with them and are feeling overly generous, you could put in www.realityhosting.ca as your referrer. No pressure though.

Just my two bytes,