Web Hosting Talk : Web Hosting Main Forums : Running a Web Hosting Business : Fraudulent orders?

[thepremierhost]

Hello,

This month, 55% to 60% of my orders have been Fraud. Luckily, 90% of these were paying via Google Checkout and stopped before the payment went through. The other 10% paid via PayPal and was caught before any damage was done. Somehow, all these orders Passed the Max Mind Fraud test. The latest order was today. Max Mind passed but the IP was 13,000 miles from the Zip code they gave and the Zip code doesn't even exist.

I'm wondering from other hosts, have you guys gotten a lot of these orders this month or am I just their "easy target"?

Thanks for any input,
Jerry

[mjfroggy]

Although we have seen a spike in fraud orders we have had good success with using Maxmind it sounds like their is something messed up with your settings if an end user is typing in a fake zipcode and maxmind is not giving it a high score. You might want to make sure that the ip address you are feeding to Maxmind is the actual customers and not your own servers or something else.

[thepremierhost]

I went through the settings and it seems to be right..

The Old risk score was 7.50
The New risk score was 14.88%

As I said, this order passed but at the bottom of the report it says:

Explanation: This order is very high risk, and we suggest you not accept it. This order is higher risk because the distance between the billing address and the user's actual location is so great. The order is slightly riskier because the e-mail domain, gmail.com, is a free e-mail provider. The order is higher risk because the billing country and the country in which the IP address is located don't match.

This is an issue I should take up with Max Mind, I guess. Still interested to know if all hosts are dealing with this, this month or just me.

[rds100]

Go in your whmcs configuration - setup/fraud protection. Select MaxMind and click "Go".
There is a setting which says:
MaxMind Fraud Risk Score [ ] Higher than this value and the order will be blocked
Set the value which you consider reasonable.
Also check the other options.

[m8internet]

Originally Posted by thepremierhost

This month, 55% to 60% of my orders have been Fraud. Luckily, 90% of these were paying via Google Checkout and stopped before the payment went through. The other 10% paid via PayPal and was caught before any damage was done

That is incredibly high
I would look into this first to determine why such orders are being made

[quantumphysics]

"Max Mind passed but the IP was 13,000 miles from the Zip code they gave and the Zip code doesn't even exist"

Sounds more like something you should be asking them, since I assume you're paying them to be checking if a five digit number is valid..

[RBurns]

Fraud is a constant in any hosting company. Normally you can detect fraud based on purely ip. Cross reference IP and address listed, thats 99% of it right there.

[Zachary McClung]

I think phone verifying orders are great. You get to let your customers know you care and get to do a smell test. Most fraudster give fake phone numbers.

[quantumphysics]

Originally Posted by Zachary McClung

I think phone verifying orders are great. You get to let your customers know you care and get to do a smell test. Most fraudster give fake phone numbers.

I'd hope you would say that you "call to welcome new clients personally" or something, because some people (like me) tend to not like picking up from unknown numbers

[Zachary McClung]

Originally Posted by quantumphysics

I'd hope you would say that you "call to welcome new clients personally" or something, because some people (like me) tend to not like picking up from unknown numbers

We do not call new clients. I personally like the concept of calling new clients to "Welcome" them. You can call it whatever you want to but let's face it, it really is a fraud check call. The only difference is you place a personal spin on it by not having a automated system like Telesign do it.

I will tell you when I have implemented similar calling programs with other companies, sales increased because you could discuss the clients needs and upsell/right size them.

[parky1]

Are you blocking all orders made through proxies?

[SenseiSteve]

Ever since we re-set our MaxMind setting, our fraud has dropped considerably. On those orders that we've had to ask for verification, none of them (ZERO) have passed. Like Zachary said, calling new client's to welcome them aboard is great advice.

[BassHost]

Originally Posted by CheetahHostdotNet

Fraud is a constant in any hosting company. Normally you can detect fraud based on purely ip. Cross reference IP and address listed, thats 99% of it right there.

This is very true, and most times a simple IP location check will give us a general idea of whether they are a higher risk or not. Also, another idea for you might be to start blocking some of the higher risk countries. For instance, if you are getting a lot of fraud orders from China or Vietnam, then you might want to block them.

However, as someone else mentioned about calling their clients... it really is a fraud check with a personal spin on it. We find that if we do call them, then they generally are happier with our service and usually will go out of their way to post a good review about the service which they have received.

[Sinoco]

Originally Posted by Zachary McClung

We do not call new clients. I personally like the concept of calling new clients to "Welcome" them. You can call it whatever you want to but let's face it, it really is a fraud check call. The only difference is you place a personal spin on it by not having a automated system like Telesign do it.

I will tell you when I have implemented similar calling programs with other companies, sales increased because you could discuss the clients needs and upsell/right size them.

I never answer my phone to random numbers, so if that makes me fail your fraud check. Well...

[Zachary McClung]

Originally Posted by Sinoco

I never answer my phone to random numbers, so if that makes me fail your fraud check. Well...

If you want the product/service bad enough, I guess you would call the company back after they left a voice mail.