Repeat Fraudulent Order Help

[cactuspcaz]

I'm struggling with a recent dilemma and looking for possible solutions before proceeding to another processing/online site company other than Square.

I've had a brick-and-mortar retail location and also a Square online e-commerce site for my products. I've successfully shipped many orders around the country to happy customers without any issues. This past holiday season, I received a string of related orders, all clearly fraudulent. They were using different cards, a freight forwarding address, and obvious fake names. I can go into Dashboard > Reports > Transaction Status and see hundreds of declined attempts all from the same person with different card numbers. After the first order I almost immediately received the "Payments Under Review" email asking me to hold off on shipping until Square can double-check the order. I thought great, they recognized the fraud, will cancel the order without having to charge me the processing fees (2.90% + $0.30). Unfortunately 99% of the orders that have been assessed for possible fraud somehow pass through the filters and then I receive a follow-up email that explains "Account Reviewed, Deposits Pending" basically saying that I'm good to go through with shipping this order out. Now I obviously recognize this repeat customer, and the obvious fraud that's occurring, so my two options at that point are:

1. Ship out the order, take notes, pictures, tracking with signature, etc. and hope that I don't receive a chargeback request once the item is out of my hands. If I do, we all know it's a 120-day process with funds pulled and a 50/50 chance of keeping the money dependent on what the person's bank decides.

2. Cancel the order through the Square portal and eat the 2.90% + $0.30 processing fee per order since this technically was not a fraudulent transaction in Square's eyes and more-so me, the user, cancelling the order manually. I've called before to try and reverse this and it's an absolute nightmare talking to Square's outsourced customer service representatives and trying to explain how and why I shouldn't be charged a fee on a cancelled order that was obvious fraud.

Each time I have even tried to call and talk to numerous departments to have them double-check the order and try to get them to mark it as fraud on their end so that I don't keep eating these fees by cancelling, but no luck. Finally, I got so sick of this constantly occurring that I shut down shipping fulfillment from the site for weeks around Christmas, the busiest time of year for me, and clearly missing out on possible sales.

Today, I decided I'll turn shipping fulfilment back on and maybe this fraudster has moved on since they haven't been able to order for months now. Within an hour, the same name on an order popped through. Again, almost immediately "Payments Under Review" email came through.

I called Square again to look for solutions and I continually get the same thing:

- There is no way to prevent a user from creating these orders. (Bogus way of not looking for a solution.)

- You can "purchase" additional risk manager program coverage for your account. (I shouldn't have to pay extra to prevent obvious fraud orders.)

- You can cancel the order and eat the fee. (This adds up quick and is not sustainable as a small business, the person just continues to fraudulently order.)

- Request a contract to be signed by this customer to try and prevent chargeback requests. (They do not respond, they use fake contact information.)

- Accept a payment outside of Square, such as cash. (This clearly does not work with a customer that does not respond communication-wise, and "lives" on the other side of the country.)

This seems like a broken system, a "double-edged sword" from my viewpoint if you will, that needs some attention. I have resorted to turning off multiple states at this point that these fraudulent orders are being continually requested to be shipped to (Florida & Texas), but again, I'm now missing out on legitimate sales from customers that actually reside in those states, and I'm certain they'll just find another freight forwarding company in another state and start ordering to there instead.

Is there anyone higher up that can:

1. Change the policy of processing fees on cancelled orders.

2. Create the capability of blocking a customer, whether that's by address, IP address, etc.

3. Someone higher up that would like to work with me to try and catch this obvious credit card fraud and try to prevent this repeat offender from continuing this illegal activity.

[Candlestore]

@cactuspcaz ,

I am sorry that this scammer is what brought you here to the Square forum.  Problem is that we can not look into your account here as most of us are just other users of Square, with a few moderators that can escalate things that are not working correctly.  I figure a huge company like Square and Weebly would have the ability to block an scammers IP address if you know what it is.  My webhost allows me to block users by email (wont work for you if they keep changing email) , and by IP address.  I did this because I kept getting items added to a cart totalling $15,000 from 1 Ip address which was traced back to amazon.   I use Shift4Shop and was using Square for the payments there until that fell apart and now had to go to Shift4payments for my online store.  Just something else to watch for, if you choose another webhost you may also need a new company for your online payments.  Having a retail and online shop that do not communicate is a pain, but can be done.  Good Luck and maybe make an ideate to block someones IP address, just watch because most people do not always have the same IP address, mine changes every 14 days I believe, and when I use a vpn it changes everytime Iog in.   This is a pain since it will show me logging into my bank or my website from any of the lower states.  I get the 2 step verification notice, is this you trying to log in from TX, we just saw you logged in from California 30 minutes ago.  When I blocked the IP address it was the same for over 3 months, and the same types of suspicious behavior.  I was afraid a legitimate customer may get that IP and be blocked accidentally.

[faheem]

Hi @cactuspcaz:

Risk Manager is now free for all Square, and Square Online, sellers. It sounds like you may have engaged with Risk Manager, but not one of its most powerful capabilities.

With Risk Manager, you have access to create a 3D Secure (3DS) rule to screen your Square Online payments. 3D Secure rules are powerful because if a payment is 3D Secure verified and results in a fraud dispute, you as a seller are not held responsible. (Note that if the dispute is non-fraud e.g. a customer is unhappy with purchase, broken items, etc., payments are still subject to chargebacks; also, note that in the event of a fraud dispute, you may still be required to submit a dispute response and other documentation to be protected) 

https://squareup.com/help/us/en/article/7623-risk-manager-3d-secure-3ds

Risk Manager and 3DS are available free to all Square Online sellers in the US and several other countries. You can set up a 3DS rule here: https://squareup.com/dashboard/risk-manager/rules 

[cactuspcaz]

Hi @faheem,

Thanks for your response. After posting this yesterday I received an email from Square detailing Risk Manager and how to use it. I now understand this is a free service and tool. While I did check it out and enable a few additional "rules" to my current online store, there is still large flaws in this system that I am unsure of how I will overcome with Square. It mainly comes down to: if a fraudulent order can circumvent the risk manager rules, for example, a legitimate credit card being utilized by a fraudster who is shipping to a freight forwarding address, they're unlikely to get flagged as actual fraud, leaving me with options of shipping out the order and hoping for no chargeback once the actual cardholder finds the unrecognized charge, or to cancel the order in the Square order system, resulting in the processing fees still being charged to my account.

I am fully aware of our responsibility as sellers accepting credit cards that if a customer were to receive a defective, broken, or undelivered item, then they would withhold the right to filing a chargeback to get their money back, however this doesn't pertain to my question or situation. I'm dealing with an obviously fraudulent repeat offender utilizing stolen credit card numbers to order high dollar product and have it shipped to a third-party post office so that they can prevent being identified.

[faheem]

@cactuspcaz Thanks for the feedback. I hear your concern about the potential for a fraudster to circumvent Risk Manager rules. It is important to note that 3D Secure is an extremely powerful layer of fraud protection above standard Risk Manager rules. 3DS is not just about screening payments better - it is about shifting the liability for fraud chargebacks away from you.

If you have a 3D Secure rule enabled and a payment goes through because the issuing bank verified it, you are not responsible for covering a fraud chargeback. If the payment does not go through because the issuing bank blocks it due to fraud, you will not be charged processing fees. Please review the help article below to understand more about how liability for fraud chargebacks shifts once you set up a 3DS rule:

https://squareup.com/help/us/en/article/7623-risk-manager-3d-secure-3ds