Preventing Credit Card Fraud

Along with all the magic of e-commerce letting customer buy tickets with the tap of their phone or watch comes, unfortunately, credit card fraud.

Every seller can be a target at some point or another, no matter what sector you are in.

Fraud can be easy to understand, like buying tickets with stolen credit cards. Or it can be lots of tiny transactions that don't make any sense that are a fraudster testing credit cards.

Tickit's Built-in Fraud Prevention

Tickit already blocks any fraudulent charge attempts that we detect, looking at past purchase history, suspicious IP address, weird browsing behaviour and many more signals.

Fraudsters attempting purchases get nondescript "declined" messages, but in your dashboard you will be able to see these blocked charges.

Reviewing Suspicious Orders

Some orders get through even though something about them looked wrong along the way. The Orders for Fraud Review report, under Reports in your dashboard, lists completed orders from the last six weeks that had a suspicious payment, or that share a buyer with one that did. Each order shows why it is there:

• Declined card: before the order went through, a payment on it was declined because the card was reported lost or stolen, the issuer suspects fraud, or the issuer said not to retry it. The buyer then paid with a different card. That can be innocent, such as a replaced card, but it is also what card testing looks like.
• Refunded as fraudulent: someone on your team refunded a payment on the order and marked it as fraudulent.
• Stripe Radar: Stripe Radar classified a payment on the order as elevated or highest risk. Highest-risk charges are normally blocked, so a completed order with one usually paid on a second attempt.
• Shared email, shared session, shared IP address: the order was placed with the same email address, from the same browser session, or from the same IP address as an order that had a suspicious payment. Shared IP addresses are the weakest signal, since offices, campuses and mobile networks share them between many people.

Nothing on the list is proof of fraud. Open the order and check whether the name matches the email address, whether the quantity is normal for your event, and whether the buyer's location makes sense. If it looks wrong, cancel and refund the order before the buyer disputes the charge; a dispute costs a non-refundable fee whether or not you win it. When you cancel an order you can mark it as fraudulent, which records the buyer's email address, IP address and card so that related orders show up on the report.

Stripe Radar

If you are using Stripe as your payment processor, you also have access to Stripe Radar. Radar is a set of rules that flag or block suspect charges based on Stripe's view of its massive credit card network. If you find yourself battling with lots of fraud attempts, you can add on Radar and lock things down even further by blocking cards from certain countries or blocking payments from unknown purchasers.

Extra 3D Secure Settings

3D Secure is a system from credit card companies that add extra challenges to users when they pay with a credit card. You may have seen them before with your own credit card. Some card companies send a text message asking the purchase to approve the payment, and some bring purchasers to a separate webpage to enter a password.

The main advantage of 3D Secure is reduced fraud.

The main disadvantage of 3D Secure is higher cart abandonment. Sometimes buyers don't know how to complete the 3D Secure challenge, or sometimes they aren't able to complete it because they don't have their phone or forgot their password.

Stripe automatically shows 3D Secure challenges for some cards based on their own internal statistics, but you can also ask Stripe to show 3D Secure more often. To do so, go to your store's Settings page. Under "Advanced settings" you will find an option to "Prefer 3D secure."

Note: not all cards support 3D Secure. Editing this setting just tells Stripe to show it more often.

If you want to learn more, Stripe has a lot more information about 3D secure.