Merchant911 member uncovers a big scam

This afternoon, one of our Merchant911 members filed a fraud report that once again shows us that banks just don’t have a clue about fraud prevention – or maybe they just don’t care. We’re not talking about a little bank here, folks. We’re talking about Washington Mutual – WaMu – one of the largest credit card issuers in the country. It shows, once again, that AVS is just about as useless to a merchant as a bicycle is to a fish.

The scenario

It went like this:

Kudos to the member for doing the manual fraud checks recommended at Merchant911 and in the online course, Preventing E-Commerce Chargebacks. If the merchant had not done the manual checks, she would have been nailed with two large chargebacks. The transactions passed AVS but the merchant caught the fact that GeoLocation and the telephone number cross reference didn’t seem right.

Analysis

It looks like the bad guys were able to change the billing address for the WaMu credit cards undetected. This resulted in transactions passing AVS which could have meant that expensive merchandise was sent to the bad guys door. Had the bad guys changed the telephone number on the account, the fraud would have gone undetected until the cardholder disputed the charge and the merchant got the chargeback. Of course, in this case, there might be good news for the merchant – the billing address was changed so the real cardholder may never get a bill to dispute.

I have to wonder how many times this has happened. I suspect it happens a lot. It certainly explains the reports we get from merchants telling us about chargebacks on shipments to AVS approved addresses. Of course, banking officials will tell you it can’t happen and blame it all on the merchant so they can pass the loss to them and collect a chargeback fee on top of it.