Business Owner - Our rights in relation to a fradulant transaction made to our company

TerryC10

Hello,


I am a business owner. We received a phone call from RBS Fraud Dept this morning informing us that a credit card payment that we had taken back in July was fraudulent, as the correct cardholder had been in touch to report suspicious activity. The payment was for just over £2500, and the goods were sent to the customer, which we now know used a stolen card details.


We use Card Save (World Pay) which is a virtual, online terminal for card payments. When we take card payments, World Pay/CardSave check that the card number, expiry CV2 match and the card billing address. When we took the payment, everything came back as 'pass', meaning that we had authorisation that the payment was successful and all details were correct. When I queried this with RBS Fraud Dept I was told that when these checks are made, the card payment merchant (world pay) will only check the DIGITS from the billing address, and not the road name, town, letters from the post code etc and because the person who committed fraud provided us with the correct digits for the door number and post code, this is why it passed. There was nothing we could do to prevent this.


RBS Fraud Dept will be processing a charge back so that their customer can receive the money that had been fraudulently paid to us, however would World Pay/CardSave not be liable in any way for this? Had the full address been checked and require verification, the payment would not have been processed, and we would not be substantially out of pocket.


Has anyone experienced this before or dealt with World Pay in relation to an issue as this previously?


Any help is greatly appreciated.


Thank you

eskbanker

TerryC10 wrote: »

because the person who committed fraud provided us with the correct digits for the door number and post code, this is why it passed.

[...]

Had the full address been checked and require verification, the payment would not have been processed, and we would not be substantially out of pocket.

Surely if the fraudster was able to pass the digit-based check, chances are that they'd have had access to the full postal address and therefore would have passed a more extended validation too?

What does your agreement with WorldPay say about your and their responsibilities and obligations regarding fraudulent transactions?

Nasqueron

Send the police to the address that got the goods?

Ben8282

If your merchant agreement is with Card Save/World Pay it is very strange that RBS fraud department contacted you directly and even more strange that they provided you with all this information. Are you sure that it really was RBS fraud department?

eco_warrior

Hi Terry

Sorry to hear of your situation. If RBS did call you in advance of a chargeback then to me this could mean they doubt the customers claim, possibly due to the amount, hence doing some digging beforehand.

In terms of a fraud chargeback, it usually boils down to liability. If your merchant bank agreement insisted on the payment being authorised via Verified by Visa or MasterCard SecureCode then you would be protected against the chargeback. If not then the liability lies with you and the merchant bank.

Have they given you any clarity on what’s likely to happen?

I recently dealt with a fairly similar situation and we liaised with the merchant to try and sort things out (we had no chargeback rights due to what I said above). In the end we (the issuing bank) took the hit, collected the goods and auctioned them to negate the loss. The customer was refunded and the merchant kept the money from the sale. Quite a complicated scenario.

Terry_Towelling

Ben8282 wrote: »

If your merchant agreement is with Card Save/World Pay it is very strange that RBS fraud department contacted you directly and even more strange that they provided you with all this information. Are you sure that it really was RBS fraud department?

This could be 1st party fraud and the cardholder/fraudster (one and the same person) is posing as RBS. They will be disputing the transaction with RBS and have decided to call you up to give you the impression that you will have no alternative but to accept the incoming Chargeback that they have asked RBS to make.

Whether you have to accept a Chargeback is down to the T&Cs of your Merchant Agreement. Normally any fraudulent Card-Not-Present (CNP) transaction will be the liability of the Merchant, irrespective of any CVV2 and Address Verification (AVS) - unless the liability rules have changed since I left cards - which is probable. AVS only ever takes the numerical data from an address but as Eskbanker says it is simple to get the street name from any postcode checker anyway.

What you need to do is talk to your processing bank to let them know about the supposed RBS call. You also need to get as much evidence as you can to support your case. For such a high-value transaction I imagine you will have had delivery signed for and delivered to the same address that you checked out at the time of the purchase. If that is true, then it casts doubt on the story that the card details were stolen. If they were stolen, then isn't it a bit odd that they were registered to the correct cardholder's address. The fraudster would have to have been loitering outside the address at the time of delivery to intercept and take possession - unless they had actually altered the registered address of the cardholder.

Whether you should attempt to contact the Cardholder yourself is uncertain but you need to prepare for battle. If primary liability for a CNP transaction is still seen as resting with the retailer despite CVV2 and AVS checking, then your Merchant Agreement will certainly have this built in and you may ultimately have to absorb the loss.

That doesn't mean it is over because you can still involve the police (as Nasqueron says) as a crime has been committed. A police visit to the house may help - especially if the police know what you sold because it may be on view in the house. Who knows?

Good luck.

eco_warrior

Terry_Towelling wrote: »

This could be 1st party fraud and the cardholder/fraudster (one and the same person) is posing as RBS. They will be disputing the transaction with RBS and have decided to call you up to give you the impression that you will have no alternative but to accept the incoming Chargeback that they have asked RBS to make.

Whether you have to accept a Chargeback is down to the T&Cs of your Merchant Agreement. Normally any fraudulent Card-Not-Present (CNP) transaction will be the liability of the Merchant, irrespective of any CVV2 and Address Verification (AVS) - unless the liability rules have changed since I left cards - which is probable. AVS only ever takes the numerical data from an address but as Eskbanker says it is simple to get the street name from any postcode checker anyway.

What you need to do is talk to your processing bank to let them know about the supposed RBS call. You also need to get as much evidence as you can to support your case. For such a high-value transaction I imagine you will have had delivery signed for and delivered to the same address that you checked out at the time of the purchase. If that is true, then it casts doubt on the story that the card details were stolen. If they were stolen, then isn't it a bit odd that they were registered to the correct cardholder's address. The fraudster would have to have been loitering outside the address at the time of delivery to intercept and take possession - unless they had actually altered the registered address of the cardholder.

Whether you should attempt to contact the Cardholder yourself is uncertain but you need to prepare for battle. If primary liability for a CNP transaction is still seen as resting with the retailer despite CVV2 and AVS checking, then your Merchant Agreement will certainly have this built in and you may ultimately have to absorb the loss.

That doesn't mean it is over because you can still involve the police (as Nasqueron says) as a crime has been committed. A police visit to the house may help - especially if the police know what you sold because it may be on view in the house. Who knows?

Good luck.

Fraudsters waiting outside the home of the cardholder to intercept isn't unheard of to be honest, it happened with the case I mentioned above as the goods were delivered to the billing address.

However, the OP hasn't mentioned if the billing and delivery address were the same. Many merchants allow an order to have a separate delivery address so it would make sense for a fraudster to use one.


I do think its quite a leap to suspect it a hoax call from RBS as fraud depts. will often liaise with merchants during an investigation, but I suppose you couldn't rule it out. I've not come across this before myself.

agrinnall

I'd be fairly confident that it is RBS calling (there's a current thread elsewhere that has a personal customer praising their bank for making a call to a business in relation to a chargeback), but the obvious answer is for the OP to ring RBS himself and speak to the fraud department to confirm it.