Fraud prevention

[autoblogged]

I was wondering if there is any way to get the IP address a customer users when they make a purchase. Because I am doing digital delivery I get no protection from the payment processors so I have to watch for suspicious transactions. I have been getting quite a few chargebacks and most of the time just seeing the IP address would be enough to realize that the transaction is suspicious.



For example I recently had a chargeback from someone in Minnesota. Nothing in the e-junkie notification e-mail was suspicious, but in the transactions log I see they downloaded my product at 3am from an IP address in Vietnam. It would have been extremely helpful to have that information beforehand.



Also, does anyone else have any tips on preventing fraud?

[robin]

The delivery is automated, so even when we provide you the IP .. how is that going to "prevent" the fraud? You want a feature to put IPs in a block list?

[sales]

Many reasons why the ip is useful.



I helps with submitting information to the FBI, local police, etc.



http://www.fbi.gov/majcases/fraud/internetschemes.htm



Allows us to see who is possibly targeting us and from where.



Allows us to track problems over time.



Allows us to possibly block them from our sites.



Allows us to negotiate with general scamer customers that say they never ordered.



Allows us to track sales locations as well using 3rd party software, maps, etc.



IP collection is standard for internet sales.

[autoblogged]

Then give us an option to hold digital delivery until we approve the order.

[E-junkie_Chef]

DVRPOWER-DIRECTV-TIVOMany reasons why the ip is useful.



I helps with submitting information to the FBI, local police, etc.



http://www.fbi.gov/majcases/fraud/internetschemes.htm



Allows us to see who is possibly targeting us and from where.



Allows us to track problems over time.



Allows us to possibly block them from our sites.



Allows us to negotiate with general scamer customers that say they never ordered.



Allows us to track sales locations as well using 3rd party software, maps, etc.



IP collection is standard for internet sales.

Earlier you had mentioned "It would have been extremely helpful to have that information beforehand." .. I am not sure what you mean by "beforehand" .. payment and delivery happen at the same time.

[E-junkie_Chef]

ep2Then give us an option to hold digital delivery until we approve the order.

Maybe you should look into PayPal's fraud management filters. For what it's worth, you won't find them useful against payment reversals.



Most of the payment reversals, especially in case of digital delivery don't happen as the buyer's payment account was compromised, they happen as the buyer lies to PayPal and PayPal does not take adequate measure to catch their lies .. like comparing the IP from which they contact paypal against the IP from which they made the purchase.

[securenot]

my account has been hacked and I've been locked out. what should I do?

[E-junkie_Guru]

secureNOTmy account has been hacked and I've been locked out. what should I do?

I gather we are working with you on that issue in another thread here and via email support, so we'll just continue the matter there.

[newphx]

I'm not sure if this is related, but it seems fishy...



a person who tried to download some of my product (wasn't finished uploading it when they attempted it) paid for it, but no product ready.



I tried to email the person to let them know I would send them a link, but the email to them kept bouncing back to me...I checked the Yahoo address at Yahoo, which said " there is no such address" . When I tried to find their IP address to contact them that way, both Google and Yahoo say it can't be found.



This seems really suspicious...or am I just being paranoid?

[E-junkie_Guru]

Well, you already have their money, so I can't imagine what they'd be trying to pull on you! :^)



Are you using the email address provided as the buyer's PayPal email? The PayPal email of a payment sender should always be valid, so try contacting them there if you haven't yet. Otherwise, failing any successful contact, you might be best off just quietly issuing a refund and be done with it.

[marcapitman]

Fraudulent affiliates.



Is there a way to protect from fraud being conducted by affiliates?



In April and early May, I had around $1200 of fraudulent purchases. They all got through Google Checkout. Google isn't being very helpful with getting people their money back.



I've deleted the affilates. But is there a way to prevent them from joining again?



Marc

[lazyhammock]

This is a genuine problem that is obviously that keeps reoccuring

I keep getting fake fraudulent purchase through an "Affiliate" who is using stolen information and purchasing through Paypal

This has now happened to me three separate times - the first time I paid the fraud Affiliate their cut of the money - then ALL of the purchase I paid them half for - all of the customers said they never authorized the Payments - I am trying to work with Paypal to get my money back



IF there are any E-junkie Product Mangers - here are features you need to include



Make Affiliates so something to prove they are real (email confirmation perhaps

Give Sellers the option to block IPs

Allow Sellers to report if an Affiliate partner is a fraud and automatically add them to a black list - and remove them from all other Sellers lists

Give Sellers the ability to only allow US Affiliates to sign up

Make Affiliates submit a request (and provide provable information about themselves) to be added as an Affiliate and have the Seller approve the request

Work with Paypal to ask them not to finalize the sale until they receive confirmation from you in a feed that the user downloaded the item



Honestly - if you can't get this addressed - I will find another cart and Affiliate solution



You can contact me directly (you can find the info in my contact info in my account details) if you want to know about the specifics



Please help!

Holly

[E-junkie_Guru]

What sometimes happens is that a crook may join an affiliate program and then use a stolen/hacked PayPal account or credit card to make a purchase through their own affiliate link, under the mistaken impression they they would instantly get paid a commission on that sale. However, we do not pay out commissions instantly nor automatically, and any calculated commission would be revoked when the legitimate account holder discovers the unauthorized payment and gets it reversed. If you see a lot of reversed payments referred by the same affiliate, you can remove that affiliate from your program, which bans them from rejoining.



This subsection of our affiliate system help page explains how merchants actually pay out commissions to their affiliates:

http://www.e-junkie.com/ej/help.affiliates.htm#pay



You can minimize bogus commissions by waiting until near the end of the month to generate your commission report (masspay.txt file) for the previous calendar month -- e.g., wait until near the end of March to generate your file for commissions earned in February. This should allow ample time for reversals to be processed for any payments in that month, revoking any commissions earned on those payments; once you generate the file, you could even hold onto it for another month before using it to pay out commissions, in case you wanted to watch for any late-breaking payment reversals and manually adjust commissions for that month accordingly before paying them out.



Regarding your suggestions, some of those we'll have to add to the wishlist for consideration as a possible new feature, others are already possible:



All account registrations in our system require the user to provide a valid email address; we send an activation code to that address which they must enter in our system to activate their account.



You don't have to make your affiliate program open for anyone to join. In your Seller Admin > Affiliate Program Settings, you can disable "List affiliate program in E-junkie Marketplace", so product listings you've posted to an E-junkie Shop (which also appear in the general E-junkie Marketplace that existing affiliates can search) would not show any affiliate program details or sign-up links. Your Affiliate Program Settings also provide affiliate sign-up link code to paste on your site; however, if you don't paste that sign-up link code anywhere, nobody could join your program unless you personally provide them with the link URL from that code, which would look like this (the X and Y parts would be unique to your own sign-up link):

https://www.e-junkie.com/affiliates/?cl=XXXXXX&ev=YYYYYYYYYY