Fraudulent Transactions, and who pays?

It can be very upsetting for a merchant to discover a transaction is fraudulent. They may have already sent the goods, and paid for the freight fees, and then the payment provider forces a refund of the full payment. The merchant is left very much out of pocket. 

Even worse than that, if you look at the transaction closely, the merchant may or may not be required to pay the transaction fees of around 50c plus 3%.

So why does the merchant lose out? 

Lets consider the process more closely:

1. The credit card owner had their card stolen (or card details), and was unaware in the short term
2. The thief uses the stolen card to make a purchase on your website
3. You process the transaction as normal
4. The card holder reports their card was stolen
5. The bank cancels all the transactions that occured on the card, for the benefit of the card owner. The bank has the power to do that.
6. The payment gateway will need to reconcile the account, so if they have already paid the merchant, then the merchant will need to pay it back, or be deducted from future receipts.

A theft has occured, so where does the risk fall? 

Consider if you were the card holder. Do you expect to pay for the full cost of the fraudulant transactions on your card? Ideally not. 

Banks never lose! Bank make the rules. Banks have an agreement between each other, to reverse fraudulant transactions. They then maintain good relations with their card holder customers. 

Payment Gateways are just processing companies. They are not insurance companies. They provide a mechanism for initiating a funds transfer. Their terms and conditions ensure that they do not wear the cost. 

So this leaves the merchant as the last person standing. If a little time has gone by, the merchant feels the full cost of the purchase when it is refunded. 

How Much Is The Loss?

Fraudulant sales should never have occurred. Any refund of a transaction is just a reversal of the income.

The merchant will have lost the value of their goods, freight costs, plus time and energy. 

The merchant will also have lost a transaction fee. The normal fee charged by payment companies is not usually reversed. 

The real loss to the merchant is not as much as the total value of the transaction. 

Who will cover the Merchants Loss?

Hopefully the merchant has insurance to cover large thefts. This may be to cover the theft of stock, damage of stock, or the issue of fraudulent transactions. The merchant will need to consider the scope of their insurance cover, and any excess they need to cover. In most cases, the merchant will discover that each individual transaction is less than the excess. So the merchant will need to cover their own losses. Merchants should ensure they have enough margin on sales to cover fraudulant transactions and stock shrinkage from theft or damage.

Why Won't Anyone Else Cover the Loss?

Banks and payment gateways won't cover the loss. Their T&C will cover them. The reason they won't cover the loss, is that their margin on the transaction is small, and they do not have much information to go on. They do not know what products you are selling, and they don't know to which address you are sending them. They only know that a valid credit card was used at the time of the transaction. The value these organisations receive from a sale is under 3%. 

The ecommerce platform providers won't cover the loss. The platform provider creates a mechanism to manage product prices, and initate a sale. The platform provider does not have any visibility of the validity of the card details. Payment providers are used to handle payment processing, and the decision to proceed with a sale is based on the status of the payment transaction. The value of a sale to an ecommerce platform is even less than the bank/gateways earn.

The merchant is assumed to have a reasonable margin to cover the risk. Most small item retail stores will have a 100% markup on the goods. Even if the items are on sale, and the freight fees are considered, then the merchants margin is usually 20% or more. The business with the most margin, and the most understanding of the transaction, is the one who needs to cover the risk. 

What can merchants do? 

Merchants know the address to where they are sending the goods. If the name and address of the recipient of the goods, does not match the address of the card holder, then that should raise some red flags. It can be harder for businesses who sell gifts. 

Merchants should ensure they opt in to use any security verification services availalble to them. Services such as 3DS route the transaction through the customers card network, so that the real card holder can apply some sort of 2 factor authentication to transactions, like a PIN or txt message verify code. It's unlikely that a card holder also loses their phone, but remains possible. 

Some payment providers use risk scores, that might give the merchant some reason to distrust the transaction. If the risk score is too high, the merchant might call the customer back, and double check on the information. The merchant might decide to cancel the transaction, and refund the purchase price. Is it better to take a risk on the purchase to make a sale, or risk losing the lot. 

Merchants might choose not to sell goods overseas. It is harder to deal with fraudulant transactions overseas.

Merchants should lodge any theft with the police, providing all the details of the transaction.