July 1st, 2008 at 10:50 am    
Would you like to be able to avoid fraudulent charges and help warn others?
With the help and suggestions from Chuck at www.clrmarine.com (and others) we decided to put up a BLOG of fraudulent activity to help warn other Website Forge merchants of possible fraudulent activity.
We will also start posting some tips and advice to help identify and avoid fraudulent transactions.
Go to www.support.websiteforge.com and clock the FRAUDNET button on the menu.
I have protected the page with the following username and password:
user: fraud
pass: net
Please email any possible fraudulent activity to support@websiteforge.com and I'll post it to the blog so we can warn others.
Shane
The goal of this posts is to help you realize and achieve the most success from your website
|
June 18th, 2008 at 11:18 am    
After listening to you -- I delivered!
I am a home body. I don't travel unless absolutely neccessary... I put my butt on a train and went to Chicago, IL to the Internet Retailer Conference & Exhibition.

Of course only the G & L boys showed up! Everyone else stood me up -- I won't mention any names (Brian Shockley) but stood up nonetheless.
So I spent alot of time trying to take photos by myself!! (spare the "shiny head" jokes -- I've heard them all)

Do you know how embarrassing it is to get caught taking a photo of yourself in the restroom??!!

So I thought the elevator would work out better! But of course the door flew open just as I was clicking the photo... Needless to say the lady took the next elevator. Pathetic.
Enter the G&L guys! Finally someone to hang with at this amazing sushi bar. Lots to eat and drink.

After the lady took 4 photos of our plates -- she finally was able to fire off a photo of us. (I'm mumbling "Just hit the damn button lady..." while trying to hold a smile)

YES! There was SAKE involved! Or is that Saki? Or Socky? I'm too lazy to spell check. Just suffice to say international booze was involved.
The G&L guys had to jet.. So I was back on my own again.. Found someone to take a photo..

Made up my mind that people from Chicago just can't operate a camera so ... Back to the drawing board... Taking my own photos.

Shopping (no not for purses! It was the nearest mirror)

Orvis! Finally get to see all that cool stuff up close. Boy I wish I fished.

Checking out of the Hotel...

Wandering around Chicago picking up gifts for the family. (Found a traveler that knew how to work a camera. Thank goodness)

And the end. Just remember... I was there and you weren't (Brian Shockley)
I enjoyed myself overall. I also hooked up with the FiftyOne www.fiftyone.com guys and talked shop. It was a good trip.
Shane Merem
www.websiteforge.com
Web design and e-commerce
The goal of this posts is to help you realize and achieve the most success from your website
|
June 18th, 2008 at 10:52 am    
I'm writing this message because I feel it's very important that our community of online e-commerce retailers understand how fraud impacts your business.
Kevin from www.diveprodivegear.com has a horrific story that started with $28,000 of fraudulent orders. The end result was a frozen credit card account and over $7,000 of HIS LEGITIMATE money held by Visa and Mastercard.
Keep in mind that Kevin identified and refunded this money thinking he was doing the "right thing".
** IMPORTANT NOTE **
Kevin mentions Linkpoint many times in this story. Keep in mind that Linkpoint is merely a gateway and does not make these decisions. The decisions are made by the actual processing bank -- in this case "First Data Corp.". Which, in turn is regulated by Visa/Mastercard, etc. So "Linkpoint" is only the gateway that happens to be the company handling the complaint.
I'll post Kevin's messages verbatim since he does a good job of telling his story...
| From: |
kob159014 |
| To: |
smerem |
| Posted: |
16 Jun 2008 06:36 pm |
|
Subject:
|
Credit card fraud
|
|
|
Shane -- thanks very much for your prompt return of my call on Friday. I really appreciate it. Here's what happened ...
Over the last couple of months, we had 4 fraudulent orders get through the automatic Linkpoint authorization process and show up as new orders. These were large ($5000 - $11,000) orders and were suspect to us, so we called the credit card company, confirmed the credit card was stolen, cancelled the orders and processed credits to the cardholders. So far, so good.
Then our Amex orders started getting declined and shortly thereafter all our orders. Without notification, Amex's computer had decided that we were high risk and had suspended our account. That triggered Linkpoint into doing the same (again without notification). All this after 1) Amex approved the fraudulent transactions before we ever saw the orders and 2) in spite of the fact that we notified Amex of the fraud and promptly processed credits to the cardholders. Since last Friday, we have had to process orders manually and hold transactions while I sort things out with Amex and Linkpoint.
Amex has reinstated our account, and Linkpoint says they will within the next few days, but they aren't terribly responsive.
In any event, have you had website clients experience this before and, of so, what were they able to do to prevent re-occurance ?? For example, do they automatically decline any orders where the Bill To and Ship To don't match, then process those manually ??
Any advice is welcome. Thanks for listening -- KOB.
_________________
KOB www.DiveProDiveGear.com
Toll free: 1-877-55-DIVER
|
I asked Kevin to post the details so I could share......
| From: |
kob159014 |
| To: |
smerem |
| Posted: |
17 Jun 2008 12:16 pm |
|
Subject:
|
Re: Credit card fraud - the details
|
|
|
Hi Shane,
Here are the details ...
If you look on our website details, you will see the following orders:
#70600482 5/10/08 $7K+ Visa
#70600434 4/23/08 $5K+ Amex
#70600380 3/27/08 $10K+ Amex
#70600303 2/13/08 $6K+ Mastercard
Each of these orders was processed via Linkpoint and authorized prior to them being forward to us. Because of the large $ value, odd nature of the purchases (e.g. 20 of the same dive computer) and foreign Ship To address, we suspected that they were fraudulent and contacted the credit card company. When we confirmed that the credit cards were stolen, we cancelled the orders. Because the transactions had been approved by either the issuing bank or Amex, the funds had been automatically transferred to our bank account, so we also had to issue credits to the cardholders.
All of the above seemed to be "doing the right thing" and the credit card companies seemed to appreciate our efforts. We have not had a single bad transaction process to completion since opening in June 2007. And each of the Amex investigations was settled in our favor. There were no investigations for the Visa or MC transactions.
Nonetheless, last Tuesday 6/10, our Amex transactions started getting declined. At first, we thought that the customers were entering some incorrect information. However, just by coincidence, I had called Linkpoint and Amex and requested that they reimburse us for approx. $500+ each in credit card processing fees that they had charged us for the fraudulent transactions. Seems fair, doesn't it ?? They approve a transaction and charge us BIG fees, then we discover it's bad, refund the full amount and are out the fees. In this case, these 4 orders were more than $1000 in credit card processing fees.
So, when I spoke with Amex about these fees, they told us our account had been terminated, due to high risk. That is the ONLY notification that I have received to date. And I subsequently found out that the decision to terminate was made by a computer !! OK, I was pissed off and removed Amex from our website, but felt that was not the end of the earth because most orders are not Amex and most people have another credit card in addition to Amex.
Now it gets fun ... when Amex terminated us, they automatically put you on a TMS (terminated merchants) list, which is published to ALL credit card companies. So, Linkpoint picks that up and also terminates us (again, no notification). We realize that somethings up with Linkpoint on Thursday evening 6/12, when ALL orders start getting declined.
So, Friday most of the day I am on the phone with Linkpoint and Amex. Linkpoint says it's their policy to automatically terminate a merchant if they show up on the TMS list. They also say they'll reinstate if Amex takes us off the TMS list.
Now ... you're gonna love this ... I call Amex and finally get a nice woman who says something like "the computer did it automatically, let me take a look". I give here some details and a few minutes later she comes back and says something like "you shouldn't have been terminated, I will take you off the TMS list and can reinstate you with Amex if you'd like." Well, DUH, of course I'd like. So, she says "give me an hour or so and you will be reinstated". She also says that Linkpoint can confirm with them that they're taking us off the infamous TMS list.
So, now I am back on the phone with Linkpoint. And I tell the guy that we're now back in Amex's good graces and would he please reinstate us on Linkpoint for our Visa, Mastercard & Discover. He calls back several hours later and says that they will reinstate us, BUT just need to verify some orders. So he gives me a list of orders that are higher in value and asks me to fax copies to him, which I do. It's now about 4:30p on Friday.
Obviously, this guy's going home for the weekend, so we're unable to process any creidt cards over the weekend, which is usually a busy time for us. But, on your advice, I had put the website on manual, so at least the orders came in and we'll process the credit cards when we get reinstated at Linkpoint. We were able to log into our Amex account on Sunday evening, but can't automatically process Amex cards on our website, because they authorize through Linkpoint.
So, yesterday (Monday 6/16) I spoke with the Linkpoint guy and he says they're checking out the orders and will reinstate as soon as that's completed and they verify we're off the TMS list. Linkpoint does NOT seem to be in any big hurry to help their merchants (at least from our perspective).
That's where we are right now. Still accumulating orders that will need to be manually processed once we're reinstated with Linkpoint. I am calling this guy pretty regularly so that he knows I won't go away. I am hoping that we'll get reinstated today, but he makes no promises.
LESSONS LEARNED:
1. Pay very close attention to the orders coming in and, if you suspect fraud, confirm with the credit card company and credit the cardholder immediately. We were told by both Amex and Linkpoint that we had done the right thing by acting immediately in reporting these transactions and quickly processing the credits.
2. You will NOT be notified in a timely manner by either Amex or Linkpoint if they decide to suspend or terminate you. Orders will just start being declined.
3. You cannot prevent the bad guys from attempting fraud with stolen credit cards on your website. And some of the transactions will be approved. If they are approved, it counts against you even though you didn't do anything wrong.
4. In the near term, we are going to continue to process credit cards manually via the Linkpoint merchant portal, even after we're reinstated and could do automatic authorization, so that we will not get a fraud transaction that is automatically authorized. This has been too painful a process.
I will keep you posted on the outcome -- KOB.
_________________
KOB
www.DiveProDiveGear.com
Toll free: 1-877-55-DIVER
|
Later the same day Kevin sent me this message....
| From: |
kob159014 |
| To: |
smerem |
| Posted: |
17 Jun 2008 03:34 pm |
|
Subject:
|
Re: Credit card fraud -- update
|
|
|
Shane -- just got off the phone with Linkpoint. Reinstatement process has started (as of this morning). The party line is that it takes 24-48 hours, but the customer service person seemed to think it would take less time based on where we are in the process right now.
Hope the earlier details (sorry for the lengthy message) and this update were useful.
Thanks -- KOB.
_________________
KOB
www.DiveProDiveGear.com
Toll free: 1-877-55-DIVER
|
And the most recent update...
| From: |
kob159014 |
| To: |
smerem |
| Posted: |
17 Jun 2008 07:54 pm |
|
Subject:
|
Re: Credit card fraud -- update
|
|
|
Shane -- it gets better. About an hour ago, Linkpoint called and said that they are NOT reactivating our account, in spite of the fact that this morning they said that they were and that Amex has reactivated us, because of the fraudulent attempts (no actual losses, just attempts).
After a heated discussion (and some threats of legal action), they have agreed to reactivate our account for about 2 weeks to give me time to find another credit card processor. They are also holding more than $7000 of my money, just in case.
So, I will be contacting Dale Spenrath to find out who he can hook me up with to process our credit cards.
This is SO painful and time-consuming, you cannot imagine. Orders are coming in and we still cannot process the credit cards, so we're now at a point where we're having to ship some small orders (< $100) without having received payment. The large orders we're not shipping yet (too much risk).
Hope this saga continues to help -- KOB.
_________________
KOB
www.DiveProDiveGear.com
Toll free: 1-877-55-DIVER
|
I talked to Dale Spenrath, our Linkpoint provider. He is working with Kevin trying to see what he can do to help Kevin. Dale is not Kevin's Linkpoint agent however he is happy to pull any strings he can for all of our sake.
I'm waiting to hear from Dale to see if he was able to help. The main feeling is that the "First Data" computer is not going to change it's mind :).
In the old days everyone had some type of "banker" on the other end. Now it's just computers -- so we are at the mercy of the bits and bytes of a machine.
One important point I would add to Kevin's advice is to NEVER refund a fraudulent chargeback. Kevin had paid his 3% to charge the card and when he refunded it (thinking he was doing the "right thing") he was charged the 3% again -- Losing around $500.00 in fees that will never be refunded.
Either VOID the transaction or let the cardholder do a chargeback -- it's cheaper for the retailer.
Please post comments and questions for Dale, Kevin and myself to try to answer.
Shane Merem
www.websiteforge.com
Web design and e-commerce
The goal of this posts is to help you realize and achieve the most success from your website
|
June 8th, 2008 at 6:18 pm    
One of the most difficult things to determine is whether or not an international order will end up as a fraudulent order.
Will you ship the product only to find that it was a stolen card and because this crook is from a far away land -- you can hardly do anything about it?
What about trying to get a product through customs? Is it worth the time and effort?
I'm pleased to announce that we are working with an international solution provider to REMOVE ALL THE RISK FROM INTERNATIONAL orders!
New FiftyOne service will improve international shopping experience and simplify international fulfillment
We are planning on integrating a leading-edge international ecommerce and logistics service later this year called FiftyOne into the Website Forge platform.
FiftyOne is a service that will automatically present all of your products in foreign currencies to international visitors by detecting the country they are coming from, and for any international orders that results, FiftyOne eliminates all of the headaches associated with international order processing, including landed cost calculation, international shipping, credit card fraud and customs compliance.
FiftyOne will:
- Convert your USD$ prices automatically into the buyer's local currency based on their IP address
- Calculate and guaranteed fully landed costs at checkout (i.e. complete end-to-end shipping, duties, taxes)
- Provide international payment processing and protection from international credit card fraud
- Pay you at order time in USD$
- Manages all customs clearance, brokerage, parcel tracking and end delivery (your customer will never be asked for C.O.D.)
- Provide a view into all order detail within a new “International Tab” in your Website Forge Account Management Portal (i.e. returns, billing inquiries, tracking information)
- Send international order and shipment confirmation emails, providing international customers with complete tracking information
Once you sign up for FiftyOne, your website will automatically become multi-currency and be welcoming to an international customer.
You will not be required to make any changes to your existing business, financial, operational or fulfillment processes.
All international orders will be provided to you as U.S. orders with a U.S. credit card and a New Jersey shipping address that you will fulfill to and bill to as you normally would.
I think this service will drive more revenue for those who subscribe to it.
Website Forge Merchant Partners who would like to enhance their websites for international visitors with a risk-free fulfillment process will be able to sign up for the service for a low monthly subscription fee of $14.95 plus a reasonable commission on sales.
At a time when the volume of international orders are growing due to the sagging USD$, having an improved international ecommerce and logistics service in time for Holiday 2008 will be a great advantage. And saving time and money because you no longer need to handle customs paperwork is an asset.
Let me know if you feel you would benefit from using FiftyOne and you intend to enroll when it becomes operational later this year.
Shane Merem
www.websiteforge.com
Web site design and e-commerce
The goal of this posts is to help you realize and achieve the most success from your website
|
June 5th, 2008 at 10:18 pm    
Hello everyone. Some of you encouraged me to visit the Chicago Internet Retailer Expo this year. So I have purchased my tickets!
I'll be there from June 9th to the 12th.
A few of our Website Forge partners will be there too. Justin from www.gandlclothing.com and Brian Shockley from www.shopbakersnook.com to name a couple.
If anyone else is attending.. Drop me a line and I'll see if I can meet up with you to say hello.
The web site for the show is: http://www.internetretailer.com/IRCE2008/
Shane Merem
www.websiteforge.com
Web site design and e-commerce
The goal of this posts is to help you realize and achieve the most success from your website
|
June 1st, 2008 at 5:31 pm    
Today we received a few complaints that customers using USPS (US Postal Service) could not check out.
The error the customer received was "No Shipping Options Available".
After investigation we found that the USPS shipping API (web based shipping rating service hosted by the US Post Office) was having technical problems.
As far as we see this issue has been resolved by the Post Office.
Please let us know if you see any other issues. We cannot do anything when this type of issue occurs because the error is on the side of the Post Office.
The good news is -- this is a rare event. Let's hope the USPS keeps up and running in the future.
Shane Merem
www.websiteforge.com
The goal of this posts is to help you realize and achieve the most success from your website
|
May 15th, 2008 at 9:13 am    

Are you one of those people that have a hard time remembering your password?
Do you....
- Always use the same password so you don't forget it?
- Use a password that is easy to guess like birthdates, children names, spouse names, or pets?
- Think because you add a number 1 after the password it becomes safer?
Think again... You would be surprised how easy it is to guess your password.
If you are serious about the security of your web site and e-mail.... Make sure your password is difficult to guess.
For instance....
(I know many of you will resist a totally random password with upper case, lower case, and numerical digits because it's very hard to remember so here are some tips that are more reasonable)
- Use a random word in a document or book, then type it backwards or add random numbers to the word.
- If you insist on using a name -- use names of people that are NOT close to you. People that you met only once but can remember.
- Use punctuation in your password
- Use different passwords for different types of logins. Use harder passwords for your banking, etc. (some banks enforce harder passwords and changing it often)
- Change your password once per month
Ideally you should use a random password generator like this http://www.pctools.com/guides/password/ to generate a properly mixed and random password.
Hope this friendly reminder helps keep your important data secure!
P.S. If you would like to provided LIMITED access to your Website Forge account, please contact support and ask for "Sub Accounts" so that you can provide limited access to your team members or service providers.
Shane Merem
Website Forge
www.websiteforge.com
Web site design and e-commerce
******* IMPORTANT WEBSITE FORGE UPDATES ********
- Looking for fresh testimonials for our new site so please email sales@websiteforge.com with your testimonials and we may post them on our web site
- Our new Website Forge Community Forum is online. Make sure you join today! Share and Learn from other Website Forge users! CLICK HERE to visit the www.websiteforge.com/forum
- Weekly Teleclasses are available for your further education! Visit http://support.websiteforge.com/113.html to signup for your FREE teleclasses.
P.S.S. I have added every Website Forge user to this BLOG. We send important upgrade and system notifications via this BLOG. If you want to login to change your settings to be removed from the BLOG emails use the same username/password you use for your websiteforge.com login.
The goal of this posts is to help you realize and achieve the most success from your website
|
April 10th, 2008 at 3:56 pm    
How secure is this house? Do you know by this photo?

The house looks beautiful. Maybe a dream house. So how secure is it? There is no way to tell unless you look at the door to see what type of door knob and lock it has.
Web site security is exactly the same. Do you know that less than 10% of web sites are written to help avoid hacks or abuse!
Look at this door knob......

A very fancy door knob -- some may say it's stylish. However if it does not offer security then your family could be at risk.
Now look at this door knob......

Obviously more secure right? You would think so.. However if the door frame (jamb) is weak then even this impressive looking lock could be useless.
My point.... Most of us are not qualified to determine how well secured a home is. How many of you are going to know if your web site was developed with security in mind?
It's one thing to make a web site look good and appear to be secure. It's an entirely different thing to build your web site with security as a primary concern.
Website Forge has and always will help keep your site secure.
Web site security comes in many forms:
-
Secure programming practices to help resist abuse, attacks and hacks
-
Remove motiviation from potential hackers by deleting sensitive information after processing orders
-
Knowing what to secure and what not to secure
-
Informing our customers the best way to protect themselves
-
Active firewall and hack detection software
-
Have a plan WHEN you have a security breach (VERY IMPORTANT)
-
Constant backups
-
Constant security education of our development team
What is a hack?
- Usually a hack is defined as an unwelcomed intrusion. Somtimes hacks are kept secret or the hacks are displayed by the defacement of your web site. Sometimes hackers are trying to steal something from you or your customers. Other times they are just trying to get noticed.
What is an attack?
- Attacks are usually something designed to disable your web site or annoy you. Often your web site or web services can be used to attack another web site. A DOS (Denial of Service) attack is a popular one. Someone could simulate millions of "visitors" to your web site simultaneously causing your web site to stop responding.
How can your web site be abused?
- Abuse is when someone figures out how to use your web site other than how it was intended. For example -- a poorly programmed contact form can be exploited to send millions of anonymous spam or email. You would be surprised how many web sites are vulnerable to this type of abuse.
This email is designed to help you, the every day business owner, understand the difference between building a web site and investing in a proven web site system like Website Forge.
Nobody would purchase a home that has a weak foundation, unsecure locks or bad plumbing. Most of us can protect ourselves by hiring a home inspector. It's much harder to determine if their web site is properly secured.
I hope this helps everyone think.. We take security very seriously. You should too.
Thanks, Shane
The goal of this posts is to help you realize and achieve the most success from your website
|
|
|
March 6th, 2008 at 12:12 pm    
Ecommerce Module:
- Code change meant to fix the repeated order number issue.
- Customizable order status notifications. Admin can control which order statuses will trigger emailed notifications and which won't.
- A way to change the shipper in the order.
Ad Module: - mX_edit_item.html page can be called with ?mX:cat=XXXX parameter which will cause the category to be preselected when creating an ad.
- If the Add button is clicked from the mX_item_list.html page and if this page displays only ads from particular category (mX_item_list.html?mX:cat=XXXX), this category will be preselected on the Add form.
- Item List interfaces have "No items found" text configurable, HTML allowed.
- When adding to cart a product with Custom File options and if at least one file is selected, "Please wait" will be displayed while files upload.
Import/Export:
- On the import pages, there is now a message recommending to split files into pieces.
Members' FTP folders: Are now named after member ID and email, i.e. mXXXX-yyy@zzz.com, instead just XXXX. So the owner always knows whom the folder belongs to. Also, on the Edit Member page there is now a quick link to member's FTP area.
Feedback forms: - For File fields (with Max Number of Files=1), Please Wait message is shown while uploading.
- For File fields with Max Number of Files > 1, an in-page frame is now used instead of a separate browser window to select files for uploading.
- Form frame now has a new parameter, "Email Mode", which can be set to "Text" (suitable for automated processing), "HTML" (like before), and "HTML with Layout" (mimcs the form layout).
Multimedia Features:
- FLV thumbnail mode. On Product Types/Fields you can set fields of type File to display as a thumbnail. When clicked, the thumbnail will display a player in a popup window.
- FLV's and other media in ecommerce. COOL FEATURE!! Audio File, Video File and FLV file subtypes of File fields are now available for the ecommerce modules. This means you can put videos in your product details.
New File Upload Interface:
Multiple files and Java uploader support for Product Options. Product Options of type Custom File can be set up to allow multiple files, with limits on quantity and total size. They can also be set up to allow uploading via Java applet. If configured this way, the option will not display on the product list, but instead, when clicked "Add to Cart", it will open a popup for uploading. The popup can work both in regular mode and in Java mode (if enabled). All the uploaded files will be zipped and the link to this zip file will be added to the cart.
*** NOTE *** The Java uploader is not yet available to use in the Image/File store, it will be added soon.
Other features:
- Tree-like membership groups. Groups can now be organized in a tree like ecommerce categories. This will allow 3LG stores to divide users into companies, departments, subdepartments etc. This feature is systemwide and is available for all membership modules.
- Multi-level group selection. On Registration and Edit Profile forms, and also on Edit Ad forms of Ad modules, multi-level group selection is now supported. To enable, open the corresponding page in the memeber's area, select Frame Settings for the form frame, and change "Tree" setting to "Multi-level" for the group selection control. Republish the site. In this mode, the user first selects the first level of groups (e.g. companies) in one dropdown, the second level in the second dropdown etc. Like we have for tree-like options. This feature is available systemwide for all membership and ad modules
- Aliases in Google Sitemap. Made it possible to use aliases just like real pages.
- Membership. Trial Period for LinkPoint recurring payments.
- Site favicon feature.
- Login frames have now two configurable messages: a) for invalid logins and b) for inactive accounts. HTML is allowed.
- Shipping Source product field can be now exported and imported.
The goal of this posts is to help you realize and achieve the most success from your website
|