Actinic Payments Passing Fraud Failures

[PJ ENG]

The KB at http://community.actinic.com/showthread.php?t=44732 may help with a little further information about the 3rd Man detail that is available within EC.

That raises more questions than it answers!

But this bit sums it all up

This data is provided by The 3rd Man, and Actinic is unable to provide any further information

[cbarling]

You are free to enroll for the full 3rd man service if you want. However, the minimum that they charge is £500 per month + VAT. You can then call The 3rd Man and they will talk you through any particular transaction. It's very labour intensive hence the price.

I agree that the documentation on The Third Man results could be a bit more informative. I will see if is possible to improve this.

However, the point is really the one that I made earlier. Each business needs to have its own procedure for dealing with fraud. Depending on your target market, and the type and value of products that you sell, the procedures will be very different across different businesses. It's unlikely that the process can be totally automated.

The best thing is to start by taking The 3rd Man results and decide what to do under different circumstances. For instance, you can contact the client and ask for additional proof of identity if the Third Man flags them as risky (red), but if it's a very high score red you may reject the order without any further investigation. Certainly I've spoken to merchants who have found the 3rd Man service excellent at flagging potential fraud, and hence avoiding it.

Chris

[software4ed]

All this talk of 3rd man is irrelevant to the original post. Once again I find Actinic have been made aware of a problem and will do nothing about it. Actinic Payments promises one thing but the actual implementation of the promise leaves much to be desired. Offering to refuse transactions that are reported as 'not checked' should cover every variation of the response used by the card companies, which it doesn't.

[Mike Hughes]

In terms of the original post Chris Barling has posted a response from Actinic:

Actinic are currently looking into adding a fraud check status of "Strict" which would reject payments if something wasn't checked, as well as if it failed.

So it is being looked at.

All this talk of 3rd man is irrelevant to the original post.

But this thread is about the general topic of fraud so discussions about 3rd man and other aspects are relevant and appropriate. Even if they're not the particular aspect that you'd like to focus on.

This is just the world of forums. It's not unusual for threads and topic to grow and evolve as people contribute and other aspects of the topic are explored. Sometimes it helps the original poster, sometimes it doesn't.

If you just want a linear discussion with Actinic on a fixed subject then I'd suggest contacting them by email or letter. A forum probably isn't the best way to accomplish this.

Mike

[software4ed]

'Looking into' is far from working as promised.

The 3rd Man was raised as an alternative because Actinic software is not working as it should, drop down menus in the admin site do not function as described.

I have no problems with the general discussion, just wanted to remind everyone that this topic was raised to make everyone aware of the poor implementation this 'feature' of Actinic payments. Introducing the 3rd Man into the discussion has again let Actinic off the hook as the original topic has been forgotten.

[Sean Williams]

If we rejected every order that had 'data not checked' status, we'd reduce our turnover by 40%!
Bear in mind that neither entering 'Mickey Mouse' into the customer's name field nor providing an address with no house number will cause a card to be declined, the only valuable checks are the post code and the CV2 number, neither of which are checked for a card issued by a non-UK Bank.
There is no substitute for checking a sale manually - we've found it doesn't take long to get a feel for potentially fraudulent transactions.

[cbarling]

Looking at the built in fraud checking in Actinic Payments, I would like to make the following points:

- the banking system has designed how AVS, CV2 and postcode checks work. In many cases, the results of these checks are not available.

- Up to 40% of all cards do not get a successful AVS check, for a whole range of reasons.

For virtually all merchants, automatically rejecting nearly 40% of all payments would be tantamount to commercial suicide.

Having said that, we do plan to add the additional status of "strict" to AVS, CV2 and postcode checks to Actinic Payments in the next few months. We couldn't do this at the time of the original AP development because this wasn't available from Creditcall. There's certainly a much stronger argument for applying "strict" criteria to CV2 as you're not supposed to take MOTO or ecommerce payments without a valid CV2.

The new developments will come out either in v10.0.2 or v10.0.3 along with some other improvements. However, I would suggest that any merchant using the new capability, when it arrives, does so with extreme caution.

Chris

[Darren B]

There is no substitute for checking a sale manually - we've found it doesn't take long to get a feel for potentially fraudulent transactions.

Could not agree more, asking an automated system to do it all for you is madness IMHO

one hicup in any part of the system would result in orders being rejected if you set everything to fail without a valid answer. So when the card issuing bank fails to respond with the cross check of postcode (which happens more times than you might think) you order is rejected, fraud nope just another bug in the fragile world of computers, internet and all things electronic.

As mentioned, most countries do not allow or supply data to cross check with your customers card details so its a no go right from the outset.

Sorry i dont think your ever going to find a system to meet your needs, this does not just apply to actinic

[software4ed]

We don't want sales from non-UK cards or non-UK buyers. Rejecting sales due to non-matching AVS, CV2, postcode and 3Dsecure works well for us. We don't have many failures, nothing like 40%, not even 4% and we manually resolve those that do. Every site and customer base is different so just because it doesn't work for you doesn't make it 'madness'. Don't slag me off just because I want the facility to work the way it's supposed to.

[Darren B]

Have we any news on the info on what all the 3rd man checks mean?

i had another today from denmark
AC12 Telephone number format analysis
AC15 Card & Telephone analysis
AC8 Anonymous email address
CD21 CV2 Response analysis
CD22 AVS Address Response analysis
CD23 AVS Postcode analysis
CD4 Card issued outside the UK or unrecognised
CS20 Email & Value analysis
CS66 Telephone & Email & Spend
TC15 Sales channel
TC34 Transaction value
TC91 Email format rule 1

nothing here tells me what the score for each of these is. How can i make a decision based on a result i cant see?

a bit of assistance from Actinic in this area is long over due IMHO

[cbarling]

There are some hints about what is regarded as positive and negative in The 3rd Man scores at http://community.actinic.com/showthread.php?t=44732 .

We are also actively looking into improving the information displayed and documenting it better. And by actively I mean that we had a meeting last week with The 3rd Man to discuss the issue.

Chris

[cbarling]

Also, the ability to completely enforce CV2, AVS and postcode checks will be available in v10.0.2 as a new option of "Strict". In other words, if the banking system cannot or does not conduct the check, the payment will be rejected as well as if it fails the check.

It should be noted, however, that as well as the issues discussed above, the banking system for particular issuers IN THE UK has very occasionally been known to stop conducting checks simply because it is over-loaded.

Chris

[Darren B]

There are some hints about what is regarded as positive and negative in The 3rd Man scores at http://community.actinic.com/showthread.php?t=44732 .

We are also actively looking into improving the information displayed and documenting it better. And by actively I mean that we had a meeting last week with The 3rd Man to discuss the issue.

Chris

Thanks for the link but i already have the info, it's actually showing the value which is key IMHO. A positive score could be anything from 1 but if a code is scored 1 to 10 and an actual result is 2 then i would probably accept this but if it was actually a 10 then i would be concerned. This is key to making an informed decision.

Darren

[cbarling]

Agreed. We will see what we can do.

Chris