Actinic Payment Security Settings Overridden/Bypassed

[mgm]

An overseas customer tried to place several orders on my website this week and they looked potentially fraudulent. He had had one payment card declined before using another card. When that card transaction went through, he received a low score of +13 on the 3rd Man check. When I looked at the breakdown of his score and the results of the AVS, CVVS and 3D secure, etc. I became more concerned. He had not been enrolled for 3D secure (i.e Verified by Visa/ Mastercard SecureCode) which resulted in a 'None' result. However, my payment security settings were set to 'On' for 3DS for both Visa & Mastercard and yet somehow his transaction was allowed to go through! Also, my CVV2 settings were set to 'Enforce' and my AVS settings set to 'Check'. Normally, if a private customer places an order from his work location using his personal credit card the result for the AVS check is 'Not Matched' and if I'm concerned I call the customer and make more checks. However, in this customer's case the AVS check resulted in a 'Not Checked' result! I'm using Actinic Payments as my PSP and Actinic v10 Business.

My question is how could his transaction possibly have been allowed to go through when there was no 3DS check performed despite the settings being enabled 'On' and why did the AVS check result in 'Not Checked' despite the settings be enabled for 'Check'?

I called Actinic's help desk but they were puzzled by this and said they were not aware of any similar occurrences.

I also called 3rd Man and got them to do a check on this customer's transaction too but they couldn't see any problems with it. However, when I went on to explain he had made three orders that day using three modifications of two address locations for the same card, three attempts of which had already been declined, they naturally realised it was a potential chargeback fraud attempt. Plus when I checked the customer's business website it appeard to be just a front and all his order requests were marked very, very urgent and needed to be delivered before a certain date. He also kept modifying his order, adding more and more items and eventually sent me another massive order request for various items and he seemed unworried by the high shipping costs and the fact that I had already declined his earlier order. Needless to say I declined all of this cutomer's orders and emailed him explaining why. Nonetheless, he then went on to place another order using a third payment card, using modifications of the earlier addresses and still managed to get through all the security checks, again with no enrolment for 3DS , despite my settings being 'On' and 'Not Checked' for the AVS check despite them being set to 'Check'. Again I declined his order, voided his earlier trasactions and advised him by email that this may have been an attempt at a potential fraudulent purchase. I sent the 3rd Man feedback as a potential chargeback fraud immediately.

I find this situation very worrying and I advise other users to be aware and check all the details of a low 3rd Man score transaction, despite the light being 'Green'. I also hope that Actinic will look into how their payement security settings could possibly be overridden/bypassed. I did begin to wonder if my website had been hacked to overridde these settings and I went on to refresh my website.

Have any other users experienced a similar case of Actinic payment security settings being overridden/bypassed?

[Duncan Rounding]

I think you should detail these transactions with Actinic and ask them those questions with transaction numbers etc.

As an aside...

On more than one occasion I, as a purchaser, have been redirected to 3D secure to enter my password but (as usual) couldn't remember it. On deciding not to bother to dream up yet another password I cancelled out of the request only to find that the payment had been approved and the sale completed.

It is also of course very easy (at least with Barclays) to say you have forgotten your password and then just make up another one after entering your DOB and CVV. So anyone with that info can bypass the system.

In those two instances I don't know how the processing would report back, it may say not checked even though the merchant had obviously wanted it enforced.

[mgm]

Thanks for that advice and information Duncan. 3rd Man admitted that their system is not bullet-proof and from what you said there are shortfalls in 3DS. I wonder if the fact that my customer was overseas (outside of the EU) was a possible reason why the AVS check resulted in 'Not Checked' rather than 'Not Matched'? I wouldn't want to set my AVS settings to 'Enforce' as many of my customers who are trying to order from work using a payment card that has their home address would have their transaction declined all the time. It does seem to me Actinic software should have a Cardholder Billing Address box that the customer is obliged to fill-in, seperate from the Invoice Address and Delivery Address, as this has a different meaning to many people.

3rd Man did check one of the transaction details for me and they didn't have any previous negative records for the user but I might ask Actinic Payments to do the same.

[I-CC]

AVS from what I have seen is only returned for UK issued cards and a couple of non UK (European) cards, with the majority of non UK cards coming back with not checked. The reason I would suggest is that outside of the UK not many will release this kind of information about a card holders address and the like for checking purposes, privacy being the primary reason I guess.

[cbarling]

The first point to make is please don't call The 3rd Man. The deal that Actinic has with The 3rd Man doesn't entitle customers to call them direct. Since the minimum spend they will accept for direct customers is around £1,000 A MONTH, I think you can understand why this is.

Payments requested through Actinic Payments will only ever be declined under the following circumstances:
- the banking system fails to authorise the payment
- you have set a particular parameter to "enforce", a result has been returned, and it is negative
- you have set a particular parameter to "strict" and either a result has not been returned or it is negative

The bank system saying that something is "authorised" doesn't mean much more than the card isn't currently reported as stolen and that there is sufficient credit to cover the payment.

The green/red lights from 3rd Man shouldn't be interpreted strictly as go/no go. Rather they, and the fraud score and details, provide information to help you to make the decision to accept or reject an order.

You should have your own process for deciding to ship or not to ship. It needs to be set by individual merchant as it will need to vary by the type of goods you sell, the size of the order, the geography of the order, your risk appetite and so on. The reality is that depending on how strict you make things, you will either fulfill the occasional fraudulent order or reject one that was perfectly good. In fact, if neither ever happens you are probably erring too far one way or the other.

Chris

[mgm]

Chris, thanks for your reply.

I note your advice about not calling 3rd Man directly. However, in the time that I've been using Actinic Payments, no-one at Actinic has ever advised me of any such terms & conditions, either verbally or in writing, as far as I can recall. When I called 3rd Man yesterday it was as a merchant with a query, not as an Actinic Payments customer and they answered my query without any mention of a minimum spend per month.

Regarding the payment security settings, I note the conditions you specified which can lead to a transaction being declined, but I question why an AVS 'Check' setting (as the name suggests on the tin) can allow a 'Not Checked' result to lead to a transaction being accepted? I agree if the result is 'Not Matched' then it may be permissible to accept the transaction at the merchant's discretion, but not a 'Not Checked' result as that's a direct contradiction of the setting.

I never interpret the 3rd Man Green/Red Light result as meaning a transaction is safe or not safe to ship. I appreciate it's just a guide and other factors must be taken into account. I always check the score details plus customer address details, size of order, location etc. and I call the customer if I have any concerns.

I think I-CC's comment about AVS checks not extending to cards issued outside the UK, with the exception of one or two EU locations, is important to note.

The most worrying issue is that a person who is not enrolled for 3DS (or as an earlier comment suggested) simply ignores the password request, can have their transaction accepted, when the Actinic payment security setting for 3DS is 'On'. How can that be? On two occasions the same customer used two different payment cards, did not get a 'Success' result for the 3DS check even when the security setting was 'On', and yet his transaction was accepted. How can that possibly happen? It makes a mockery of the security processes.

[cbarling]

To ensure that a "not checked" result leads to a payment being declined, use the "Strict" setting.

The issue is that a value can be "not checked" because the card issuer doesn't support this feature. AVS for instance isn't supported by many overseas cards and historically it wasn't supported by some UK card issuers as well. It is also possible that when part of the UK banking infrastructure is running slowly or is down, you can get a "not checked" on cards that would normally be checked. This case, is however pretty rare, but if it happened and you were "strict" checking, all cards would be declined.

That's why we would recommend not using strict under normal circumstances.

Chris