Subject:

Credit card fraud

Shane -- thanks very much for your prompt return of my call on Friday. I really appreciate it. Here's what happened ...

Over the last couple of months, we had 4 fraudulent orders get through the automatic Linkpoint authorization process and show up as new orders. These were large ($5000 - $11,000) orders and were suspect to us, so we called the credit card company, confirmed the credit card was stolen, cancelled the orders and processed credits to the cardholders. So far, so good.

Then our Amex orders started getting declined and shortly thereafter all our orders. Without notification, Amex's computer had decided that we were high risk and had suspended our account. That triggered Linkpoint into doing the same (again without notification). All this after 1) Amex approved the fraudulent transactions before we ever saw the orders and 2) in spite of the fact that we notified Amex of the fraud and promptly processed credits to the cardholders. Since last Friday, we have had to process orders manually and hold transactions while I sort things out with Amex and Linkpoint.

Amex has reinstated our account, and Linkpoint says they will within the next few days, but they aren't terribly responsive.

In any event, have you had website clients experience this before and, of so, what were they able to do to prevent re-occurance ?? For example, do they automatically decline any orders where the Bill To and Ship To don't match, then process those manually ??

Any advice is welcome. Thanks for listening -- KOB.

_________________
KOB
www.DiveProDiveGear.com
Toll free: 1-877-55-DIVER

Subject:

Re: Credit card fraud - the details

Hi Shane,

Here are the details ...

If you look on our website details, you will see the following orders:
#70600482 5/10/08 $7K+ Visa
#70600434 4/23/08 $5K+ Amex
#70600380 3/27/08 $10K+ Amex
#70600303 2/13/08 $6K+ Mastercard

Each of these orders was processed via Linkpoint and authorized prior to them being forward to us. Because of the large $ value, odd nature of the purchases (e.g. 20 of the same dive computer) and foreign Ship To address, we suspected that they were fraudulent and contacted the credit card company. When we confirmed that the credit cards were stolen, we cancelled the orders. Because the transactions had been approved by either the issuing bank or Amex, the funds had been automatically transferred to our bank account, so we also had to issue credits to the cardholders.

All of the above seemed to be "doing the right thing" and the credit card companies seemed to appreciate our efforts. We have not had a single bad transaction process to completion since opening in June 2007. And each of the Amex investigations was settled in our favor. There were no investigations for the Visa or MC transactions.

Nonetheless, last Tuesday 6/10, our Amex transactions started getting declined. At first, we thought that the customers were entering some incorrect information. However, just by coincidence, I had called Linkpoint and Amex and requested that they reimburse us for approx. $500+ each in credit card processing fees that they had charged us for the fraudulent transactions. Seems fair, doesn't it ?? They approve a transaction and charge us BIG fees, then we discover it's bad, refund the full amount and are out the fees. In this case, these 4 orders were more than $1000 in credit card processing fees.

So, when I spoke with Amex about these fees, they told us our account had been terminated, due to high risk. That is the ONLY notification that I have received to date. And I subsequently found out that the decision to terminate was made by a computer !! OK, I was pissed off and removed Amex from our website, but felt that was not the end of the earth because most orders are not Amex and most people have another credit card in addition to Amex.

Now it gets fun ... when Amex terminated us, they automatically put you on a TMS (terminated merchants) list, which is published to ALL credit card companies. So, Linkpoint picks that up and also terminates us (again, no notification). We realize that somethings up with Linkpoint on Thursday evening 6/12, when ALL orders start getting declined.

So, Friday most of the day I am on the phone with Linkpoint and Amex. Linkpoint says it's their policy to automatically terminate a merchant if they show up on the TMS list. They also say they'll reinstate if Amex takes us off the TMS list.

Now ... you're gonna love this ... I call Amex and finally get a nice woman who says something like "the computer did it automatically, let me take a look". I give here some details and a few minutes later she comes back and says something like "you shouldn't have been terminated, I will take you off the TMS list and can reinstate you with Amex if you'd like." Well, DUH, of course I'd like. So, she says "give me an hour or so and you will be reinstated". She also says that Linkpoint can confirm with them that they're taking us off the infamous TMS list.

So, now I am back on the phone with Linkpoint. And I tell the guy that we're now back in Amex's good graces and would he please reinstate us on Linkpoint for our Visa, Mastercard & Discover. He calls back several hours later and says that they will reinstate us, BUT just need to verify some orders. So he gives me a list of orders that are higher in value and asks me to fax copies to him, which I do. It's now about 4:30p on Friday.

Obviously, this guy's going home for the weekend, so we're unable to process any creidt cards over the weekend, which is usually a busy time for us. But, on your advice, I had put the website on manual, so at least the orders came in and we'll process the credit cards when we get reinstated at Linkpoint. We were able to log into our Amex account on Sunday evening, but can't automatically process Amex cards on our website, because they authorize through Linkpoint.

So, yesterday (Monday 6/16) I spoke with the Linkpoint guy and he says they're checking out the orders and will reinstate as soon as that's completed and they verify we're off the TMS list. Linkpoint does NOT seem to be in any big hurry to help their merchants (at least from our perspective).

That's where we are right now. Still accumulating orders that will need to be manually processed once we're reinstated with Linkpoint. I am calling this guy pretty regularly so that he knows I won't go away. I am hoping that we'll get reinstated today, but he makes no promises.

LESSONS LEARNED:
1. Pay very close attention to the orders coming in and, if you suspect fraud, confirm with the credit card company and credit the cardholder immediately. We were told by both Amex and Linkpoint that we had done the right thing by acting immediately in reporting these transactions and quickly processing the credits.
2. You will NOT be notified in a timely manner by either Amex or Linkpoint if they decide to suspend or terminate you. Orders will just start being declined.
3. You cannot prevent the bad guys from attempting fraud with stolen credit cards on your website. And some of the transactions will be approved. If they are approved, it counts against you even though you didn't do anything wrong.
4. In the near term, we are going to continue to process credit cards manually via the Linkpoint merchant portal, even after we're reinstated and could do automatic authorization, so that we will not get a fraud transaction that is automatically authorized. This has been too painful a process.

I will keep you posted on the outcome -- KOB.

_________________
KOB
www.DiveProDiveGear.com
Toll free: 1-877-55-DIVER

Subject:

Re: Credit card fraud -- update

Shane -- just got off the phone with Linkpoint. Reinstatement process has started (as of this morning). The party line is that it takes 24-48 hours, but the customer service person seemed to think it would take less time based on where we are in the process right now.

Hope the earlier details (sorry for the lengthy message) and this update were useful.

Thanks -- KOB.

_________________
KOB
www.DiveProDiveGear.com
Toll free: 1-877-55-DIVER

Subject:

Re: Credit card fraud -- update

Shane -- it gets better. About an hour ago, Linkpoint called and said that they are NOT reactivating our account, in spite of the fact that this morning they said that they were and that Amex has reactivated us, because of the fraudulent attempts (no actual losses, just attempts).

After a heated discussion (and some threats of legal action), they have agreed to reactivate our account for about 2 weeks to give me time to find another credit card processor. They are also holding more than $7000 of my money, just in case.

So, I will be contacting Dale Spenrath to find out who he can hook me up with to process our credit cards.

This is SO painful and time-consuming, you cannot imagine. Orders are coming in and we still cannot process the credit cards, so we're now at a point where we're having to ship some small orders (< $100) without having received payment. The large orders we're not shipping yet (too much risk).

Hope this saga continues to help -- KOB.

_________________
KOB
www.DiveProDiveGear.com
Toll free: 1-877-55-DIVER