Preventing online payment fraud

I don't exactly love conflating buyer's remorse with payment fraud, since buyer's remorse is a psychological phenomenon and happens independently of fraudulent intent. Then again that's a bit hairsplitting.

So, you're a digital goods business. What can you do to reduce the odds that a customer requests a transaction get reversed, given that the customer initially did authorize the transaction?

1) Do nothing. Treat this as a cost of doing business. This works astounding well for many client populations, which have naturally low refund rates. (I'll give you a refund for any reason whatsoever, and I give out substantially less than 2%. Not worth optimizing.)

But maybe you've made the decision to target poor customers, startups, infovores (they buy more books/videos/etc on X than they can consume or make effective use of, and have disproportionately high refund rates), or an audience demographically dissimilar to American housewives. OK, we still have options:

2) Add value to the one-time download by, e.g., providing a support channel gated on having an account in good standing. Note that this also lets you do fantastically lucrative things like e.g. the club model for digital goods (recurring payment for one-time downloads), which e.g. put WooThemes on the map.

3) For infovore-heavy niches, many people will suggest forcing delayed gratification on the customer. For example, let's say you have just sold someone 5 videos / ebooks / etc with expected consumption time of 2 hours each. Rather than hitting them with 10 hours of video all at once, you drip them out to the user at 2 hours per week for 5 weeks. This can be timed such that they don't get the final video until after your money-back guarantee expires. That's totally optional, though. The theory is that a) you avoid overwhelming people and b) getting in their inbox 5 times with announcements of even more value they got from you helps to prevent a common problem of "Oh, didn't actually have enough time to read/watch/act on that because I totally forgot to make that time, guess I should return it."

4) A lot of savvier folks in this space have customer communities where a) the interaction between customers adds value on top of the product, b) desire to maintain the interaction incentivizes people to not leave, and c) customers will (for their own reasons) do significant amounts of boring work for free, such that you don't have to add a not-so-lucrative "Infinite free support" sideline to a lucrative digital goods business.

5) Too late for you now, but for the benefit of everyone else, a great way to avoid getting emails by someone whining about getting a refund for the $8 they spent on your ebook is to never ever ever ever ever do business with people at the $8 price point. SearchHN [patio11 pathological customers] for more on this.

Thankyou.

Glad you liked it, we had to learn most of this stuff the hard way :)

I use Cybersource for payment processing on an e-commerce site. I've been really happy with their fraud screening service- automated rules, similar to the list in this post, flag certain orders for manual review. These automated rules have been able to catch orders that, otherwise, might have gone unnoticed and saved a lot of time in the process.

The first is 3DSecure (or VbV). They are the most secure ways to accept credit cards, though they aren't as easy for users to use. However, they do go a long way to protecting the merchant. If your handling b2b transactions that are high risk, you might consider enforcing this. Again, it's not a solution to wield lightly, but it is a solution.

Also, you can require out-of-band authentication. Generally, this is in the way of making a telephone call, and requiring the user to input a 4-digit pin. This, combined with everything else, will help hinder potential fraud. More importantly, it helps to protect against friendly fraud.

Of the two, telephone authentication is easiest to implement, but do not discount 3DS for higher priced purchases.