Buyer Paid , Download , then claim money back through Paypal

[jeffe]

1. I offer a Risk-Free Money back guarantee if they don't like it. I would say I have less than 5% of people wanting their money back and these are $40 e-books.
   
   
   
2. I used to make it so that they were print-protected so the scammers couldn't get free stuff, but then sending a "live" file to my legit customers was a hassle, so I took print-protect off.
   
   
   
3. In the end - if people are scammers - let them have the book and move on with life. Ban their IP from viewing your site and focus on money-making, not administrative crap that wastes your time and effort.

[socialseo]

I know this thread is 5-6 months old but I have a similar issue and would love some advise.



First, we sell Drupal themes via download from one of our websites. Themes range from $39 to $99 depending on the theme. Over the past couple of months we have had 3 to 4 transactions where I believe someone gains access to a Paypal account, orders one or more products from us, and then downloads our products from another IP address versus the Billing Info. IP address.



My concern is that we have seen the same "Download" IP address several times with these fraudulent transactions. Looking up the IP address of the downloaded files shows this IP:



IP: 76.12.48.68

NetRange: 76.12.0.0 - 76.12.255.255

CIDR: 76.12.0.0/16

OriginAS: AS20021

NetName: HOSTMYSITE

NetHandle: NET-76-12-0-0-1

Parent: NET-76-0-0-0-0

NetType: Direct Allocation

NameServer: NS3.LNHI.NET

NameServer: NS1.LNHI.NET

NameServer: NS2.LNHI.NET

RegDate: 2007-05-01

Updated: 2008-02-01

Ref: http://whois.arin.net/rest/net/NET-76-12-0-0-1



OrgName: HostMySite

OrgId: LNH

Address: 650 Pencader Drive

City: Newark

StateProv: DE

PostalCode: 19702

Country: US

RegDate: 2001-02-19

Updated: 2008-05-28

Comment: Abuse Contact:

Ref: http://whois.arin.net/rest/org/LNH



So, 76.12.48.68 is seen multiple times in the download IP address info within our sales logs.



I don't understand why we cannot just block any downloads from 76.12.48.68 in the future because this is the IP address used each time to download the files.



I hate scammers...



Any advise or help?

[E-junkie_Guru]

You may want to bring this to the attention of abuse@hostmysite.com and abuse@hosting.com (since the former domain just redirects to the latter), with details of the exact date and time that IP was used for any fraudulent transactions, so they can look up who was using that IP at that time and take whatever action they deem appropriate. In order to get any info from them about the user to take action yourself, you may need to lawyer-up and make formal legal demands or even obtain a court order.



The problem with blocking IPs is that an IP cannot reliably identify any particular user or computer across time. Most end-users' routers typically get assigned a new IP at random from a common pool of IPs maintained by their ISP every time they start using their connection, so blocking one of those IPs would only block whatever random user of that ISP happened to be assigned that IP at that moment (which could become a problem if it happens to be a large ISP). Moreover, even if the IP is static or at least used constantly enough by a given router that it never gets assigned a new IP, that could just be the router for a public WiFi hotspot (commonly used by crooks wanting to hide their trail) or a large organization such as a university campus.

[wing]

Recently signed on with e-junkie and caught this thread, so headed over to PayPal's policy/legal page. Section 13.3 is of interest:



"""

13.3 Ineligible Items. PayPal Purchase Protection only applies to PayPal payments for certain tangible, physical goods. Payments for the following are not eligible for reimbursement under PayPal Purchase Protection:



Intangible items, including Digital Goods

"""



Looks like intangible goods are ineligible for PayPal Purchase Protection.

[socialseo]

95%+ of my buyers download the file(s) with the same IP address used in the "Buyer IP" column of our transaction logs. The only fraudulent ones seem to occur when the Buyer IP address is different from the Download IP address.



Could we have a check box option that says:



"Only allow download(s) from the same IP address as the buyer IP address"



I know that the download links are kicked out to the scammers fake email address and then the download is prompted when they click on the download link itself. But, if the auth. key in the download URL could do a quick authentication against the Buyer IP address used for that purchase it would stop this type of fraud for us, or at least the scammer would have to use the same IP address both both instances.



Can you advise on this?



I just had 3 more transactions today for a total of $600+ from scamming ________ (fill in the blank with what you'd like.

[E-junkie_Guru]

Thanks for the suggestion; we'll add that to the wishlist for consideration as a possible new feature. It occurs to me that might work better along the lines of, "Instantly expire download links accessed from a different IP than the original Buyer IP", but then allow you to override that selectively if you use your "Re-activate expired link" function in Admin.



Meanwhile, one thing you might do is set "PayPal Account Optional: OFF" in the Website Payment Preferences of your PayPal profile settings. That way, buyers would be unable to check out using any credit card numbers and email address they wish to provide; they must use an existing PayPal account or register for one.



That still would not block cases where the fraudulent buyer steals or hacks into someone else's PayPal login, but if you also set up a Common Thank-you Page URL, then buyers would be unable to claim their digital purchase immediately following checkout, and would need to wait to receive the thank-you email message we send with the link to reach their thank-you/download page. Since we only send that message to the buyer's registered PayPal Email address for orders paid via a PayPal account, this means fraudsters would also need to have access to the separate inbox account for the PayPal Email address registered to the PayPal account they'd stolen/hacked to make their payment, so this puts an extra obstacle in their way of obtaining the actual product.

[tce]

If a particular email or IP address keeps doing this to capture free information, can we block that person here on e-junkie. I just had my first "hustle" and believe if this fellow pays, downloads and reverses, he will do this for everything...and tell his criminal friends.

[E-junkie_Guru]

You can block a particular buyer email or name by entering that in your Seller Admin > Block Buyers / Transactions.



IP address assignments are not perpetual; they are typically assigned to the user at random for each connection session, from a pool of IPs their ISP holds. Moreover, everyone using a given public WiFi hotspot would appear to be using the same public IP, assigned to the WiFi router at that location.



Fraudulent buyers rarely use an ISP connection that can be traced back to them (such as a connection at their home or work), preferring to use public hotspots that make their activity effectively anonymous. By blocking the IP used for a fraudulent transaction, you would block everyone who ever uses that public hotspot, without blocking the fraudulent buyer, who will have skipped along to the next cyber cafe by then anyway.

[sgt_bilko]

I know this thread is quite old but I've had a rather strange experience lately that I wanted to ask about. During the last three years I think I had just one claim made for an unauthorised purchase, then during the last week I've had a handful and I think there is something fishy going on.



A few days ago I received a couple emails from PayPal saying transactions had been reversed because it was suspected they were unauthorised and asking me to offer feedback on delivery. Very weirdly the e-junkie system still thinks I should pay the affiliate 71 cents for some reason.



I've just looked at my download logs now and there are a whole bunch of purchases recently through the same new affiliate(s), who I believe may actually be the same person where no download attempt has taken place and I'm finding this remarkably suspicious. I use a common thank you page and the link is only sent out to PayPal address, so I really think something very odd is going on and I never hear anything from these people who have apparently made the purchase.



Does anybody have any suggestions here? I'm just trying to work out what is happening before I reply to PayPal but my antenna is saying somebody is playing games.

[E-junkie_Guru]

It could well be that affiliate joined your program, clicked through their own hop link, and then used stolen/hacked PayPal or credit card accounts to make some fraudulent purchases, hoping they would get paid a commission instantly or at least before you and PayPal noticed anything fishy.



We'd recommend removing that affiliate (in Seller Admin > View/Edit Affiliates), which will ban them from rejoining your program. This will not automatically rescind any previous commissions already earned by that affiliate, so when you generate your next monthly masspay file, take care to delete the line for that affiliate's commission amount before you use that file to pay out commissions.



Normally, when PayPal reverses a transaction, they should notify our system of that, so we would amend your Transaction Log accordingly and remove any affiliate commissions earned; however, due to inconsistencies in PayPal's reporting of refunds/reversals, sometimes we can't amend your log to fully zero-out the price(s) paid in that transaction, so there could still be a commission calculated on the remainder:

http://www.e-junkie.com/ej/trouble.paypal.log-refund.htm

[sgt_bilko]

Thanks I am pretty sure this is one affiliate who has signed up under three separate email addresses and pushing three to four sales per day this way but it's clear that none of them ever make downloads and there is a pattern here. I am surprised actually that more people haven't contacted PayPal. I also wonder if other sellers here have been targeted.



Do you have any advice on what I should say to PayPal here? Surely this will be of interest to them as well. I am wondering about contacting the "affiliate" in this instance, since I am doing this in good faith because it looks like their activity is fraudulent but somehow I suspect I won't hear from them and if I do I can point them to this thread.

[E-junkie_Guru]

You may wish to contact PayPal support to describe the suspicious pattern you've noticed, and inform them of the relevant Transaction IDs and the buyer and affiliate PayPal Emails involved.



For any transactions they haven't reversed already, they may take a closer look at those buyer accounts to see if there's any evidence of unauthorized access to those accounts, and they may decide to suspend the relevant affiliate's PayPal account(s) if they conclude most/all of the transactions referred by that affiliate were fraudulent.



I'd suggest presenting this information as an affiliate's PayPal email followed by a list of all Transaction IDs referred by that affiliate along with the buyer's PayPal Email for each transaction, then make another list for the next suspicious affiliate, etc. To gather this information, it might be easiest to view your E-junkie Transaction Log for a suspicious affiliate's sales (you can select specific affiliates as a search parameter there) and download that log view to a spreadsheet file, then do likewise for the next fishy affiliate, etc.



As for contacting the affiliate(s), that's up to you, but I think a pattern of payment reversals and non-downloads related to any specific affiliate paints a pretty clear picture, especially if the rest of your orders for the same products are getting downloaded and not reversed (indicating there's no general problem with your settings related to download delivery).

[sgt_bilko]

Thanks I'll do as you suggest. My other sales all look normal with regular downloads and no mentions of unauthorised purchases or requests for refunds. Hopefully PayPal can sort this out without penalising me in some way with additional costs and hassle.



I had a strange one a month or so ago when a purchase was made and the buyer contacted me immediately afterwards asking me to send the download link to another email address. They then quoted a completely fictitious transaction ID. I queried this and never heard back from them.



I very much suspect other sellers will have been targeted in this way and I wonder if there is a way of alerting e-junkie users to this situation, so they can check for strange activity.

[sgt_bilko]

I've been going through all of this just now and I am about to contact PayPal. Looking at my affiliates I can see there was a sudden burst in signups within a few days around the middle of November and certainly much higher than usual but many of these have not yet made any sales and it's impossible for me to tell which ones are legitimate and which ones are fishy at this stage.



I would strongly encourage other sellers to check for any suspicious activity. I just wonder if there is anything more that could be done here to stop this activity.

[E-junkie_Guru]

ashleykarylI had a strange one a month or so ago when a purchase was made and the buyer contacted me immediately afterwards asking me to send the download link to another email address. They then quoted a completely fictitious transaction ID. I queried this and never heard back from them.

PayPal apparently issues different Transaction IDs to the buyer and seller for the same transaction, so if a buyer quotes a Txn ID they found in their PayPal account or payment receipt email, you won't be able to find that ID anywhere. The buyer's Txn ID is also never disclosed to us, so the only Txn IDs we reference in our logs and the emails we send would be the seller's Txn ID. The buyer should at least be able to find an Invoice ID in their PayPal history/emails, which should match the Invoice IDs you can find.



Bear in mind the Registration Date shown for affiliates in your View/Edit Affiliates screen is the date the affiliate registered for their E-junkie account, which could be long before they joined your program. Quite a lot of affiliates are unfortunately just idlers dreaming of effortless income who consequently never produce any referral leads or actual sales, so don't bother trying to identify whether any of those might be suspect.



Instead, start by looking in your Transaction Log for fishy-looking transactions (those which were reversed and/or which had no download attempts even a day or more after the sale), and see which affiliate(s) referred those sales. One or two such sales for an affiliate might not be unusual if they referred other sales that concluded normally, but if certain affiliates seem to keep appearing in relation to those sales, or if most/all of a particular affiliate's sales were reversed/never-downloaded, that suggests probable misconduct by that affiliate.

[sgt_bilko]

I occasionally get somebody who comes back to me after a few days or a week and says they didn't download the book in time, so they ask for me to reactivate the link, which is easy to do and they always supply some kind of proof of purchase automatically.



In the last three years I think there was only one instance where a buyer claimed a purchase had been made without their authorisation and I just don't get requests for refunds. Then suddenly this last week I had four separate cases opened but unfortunately it happened at a time when I was changing internet provider to get fibre broadband installed and found myself with no internet for a week thanks to the wonders of modern telecom providers.



Today I was able to view the download logs and sure enough there was a whole string of cases with no downloads that were all linked to the same group of affiliates and these were the same ones suddenly producing chargebacks. They all registered with e-junkie within a couple of days around the middle of November.



They were fairly clever and just let the sales trickle in over the last month, so it didn't raise any immediate suspicions and unless you checked the download logs regularly there was no way of guessing that something might be wrong.