ClearSale
Let's hear from one of our fraud experts, Kristian Bracho, about one of the recent fraud schemes we faced:
The Multiple Order Misfits
When it comes to detecting fraudulent activity on an order, some of the most important evidence we consider is whether it is an isolated case or part of an ongoing fraud pattern. Identifying complex fraud trends requires looking past what is displayed on a single order and focusing on establishing threads of similarities that would otherwise go unnoticed. Fraudsters will attempt to place a series of orders, taking special attention to avoid ordering the same item in bulk or using the same delivery point. This minimizes the risk of detection and raises the possibility of at least some of the fraudulent orders being processed and delivered. A cunning fraudster will not put “all their eggs in one basket.”
The Fraud
Using different names, emails, phone numbers and addresses are fairly common practices in this kind of elaborate scheme. Fraudsters who attempt this are usually experienced, with the understanding of how most fraud software works and the ability to stay under the radar. However, they also know that they are playing against time, which is to our benefit.
As soon as a fraudster attempts to use the personal information of a customer, specifically the credit card/debit info, the clock has started for them. Placing multiple orders quickly across different merchants is likely because the longer an order is under review, the greater the likelihood that the cardholder will be made aware of the unauthorized charge. This activity is crucial to our analysis because as we are working to identify similarities between otherwise benign orders, the more orders that the fraudsters place will raise more flags and allow us to catch the fraud and stop the misfits in their tracks.
The Evidence
One such case, taking place mid-April 2016, had the fraudster attempting to buy various toy car parts & accessories from one of our clients. Average transaction value was $190-$250. The fraudster tried to ship the orders to 3 different locations:
- A freight forwarding service in Doral, FL
- A USPS office in Sumas, WA
- An apartment complex in Bronx, NY
There were a total of eight orders spread under three fraudulent accounts. Different emails and phone numbers were used for each, but a common thread was found under the billing addresses and phone number origins. Although one of the phone numbers was US-based, there was a second phone number attached to the order that was from the United Kingdom. To top it off, some of the orders had billing addresses that were from the UK as well.
Case Closed!
Using that common thread, we were able to identify that two of the US orders (Doral, FL and Sumas, WA) were made by the same person(s). Further analysis revealed that the Bronx, NY order was also part of the same fraud pattern. The order attempts were immediately suspended for fraudulent activity. This forced the misfits to turn around and attempt orders out of desperation between $7,600 and $13,500. Those orders were also suspended, saving our client slightly over $20,000 in losses in a single day.
Just another day at the ClearSale fraud investigative offices. Multiple Order Misfits are no match for our seasoned in-house team of fraud analysts. To find out more about our integrated solutions, contact us today at info@clear.sale.
