I have to admit, I was giggling a bit about the recent hack at the Western Union site that resulted in the theft of credit and debit card information from 15,700 online customers. Not that it was funny, but the irony! I had just written a piece about the company''s new Western Union PayCash service that allows consumers to pay for Internet purchases with cash, not credit cards. But my amusement was quickly abated when the nice folks over at InternetCash.com shared some rather sobering figures with me - figures that help to explain why any credit card data stored in a computer is such an inviting target.
"We are awestruck by the attempted use of stolen credit card numbers at our Web site," said Ben Reddy, one of the founders and now Executive Vice President for Business Development at the InternetCash.com, an e-commerce financial service operation that offers a way to shop on the Web anonymously without using a credit card.
The company had been selling its InternetCash cards only in real-world stores, but just last week it introduced a virtual version at its Web site - virtual cash cards that can be purchased online with a credit card. Launching the company into the online gift certificate market, the new virtual cards are designed so that you can, for example, send a friend an electronic greeting card and treat them to a little shopping spree for whatever denomination you have purchased.
"We outsource our credit card verification program that initially denies or approves cards (and) for every ''approved'' purchase of a virtual card at our Web site we get two fraudulent attempted purchases," Reddy said. "Out of the ''approved'' purchases, we then run our proprietary scrubbing functions and have found that 50 percent of approved purchases are in fact fraudulent and involve a hacker using an unknowing consumer''s credit card and exact personal information."
Reddy went on to say "As an online merchant, it is not in our benefit to notify the consumer that their card has been stolen until (the credit card company) has processed a refund from us to the card. Were we to call the consumer immediately ... which is our ethical want ... the consumer will cancel their card immediately and we will be hit with a large charge back fee."
In fact, as my colleague Alexis Gutzman wrote in an article here on E-Commerce Guide last month, "the credit card networks don''t protect the merchants at all; they are required by federal law to honor the consumers requests unless the merchant can prove, based on a signed credit card receipt, that the consumer actually made the purchase."
But what really blew me away were the figures that Reddy supplied for the virtual cards offered at his site over last weekend:
Total attempted transactions -- $8,560 (144 transactions)
Total Fraudulent transactions -- $6,700 (67 transactions)
Total legitimate transactions -- $1,410 (55 transactions)
Other (unsuccessful transactions, but without fraudulent intent, i.e. bad credit, maxed-out card, etc.) -- $450 (22 transactions)
Of the 67 fraudulent transactions, 55 were stopped by the company''s outsourced payment processor and service. Twelve of the 67, or $1,200 worth of fraudulent transactions, got through the outsourced service and were then stopped by the company.
The new virtual cash cards just launched, and haven''t even been advertised yet. But the number of attempts to defraud this site on the cards is way above the average for fraud attempts at all e-commerce Web sites. This may be due to the cards being new and the bad guys are feeling out its defenses. It''s also due, in part, to a tendency for sites that deal with cash and with digital products to experience more fraud attempts. CyberSource, one of the major players in the fraud screening business, states in a white paper on its Web site: "Depending on a merchant''s order acceptance criteria, the aggregate risk of fraud as a percent of attempted revenues transacted is between 4.6 percent and 7.8 percent for physical products and between 14.4 percent and 23.5 percent for digital products."
Digital cash, it would seem, is a VERY tempting target.
Here''s an example of an attempt at fraud by one perpetrator, according to Reddy:
A gentleman in Indonesia had a credit card number that was stolen from a Colorado woman. He also had all of her personal information needed to make it work, such as her address and phone number. He bought a virtual card and sent it, cash "attached," to a Yahoo e-mail address. Then he ordered a surfboard at another site for delivery in Indonesia.
In this case, he was stopped, said Reddy, who is astounded at the number of people trying to get away with this sort of thing.
The InternetCash card itself seems to be a workable solution to the problem.
InternetCash cards require no consumer information to purchase, activate or utilize. They work this way: The cards that are purchased at retail locations are inactive until the store cashier activates them at the point of sale terminal. Newly purchased InternetCash cards come with a scratch-panel on the back, similar to the one used in phone cards and lottery tickets. This scratch-off panel hides a unique 20-digit card number. Once a card is purchased (and activated), the customer scratches off the material to reveal the card number, and visits InternetCash''s Web site to create a PIN of their choice. At that point the customer can spend their InternetCash at participating Web sites.
"We build our technology into every single partner site, avoiding the credit card network," Reddy said.
As I''ve said before, I like this sort of concept. The downside is that I have to find a real-world outlet to buy the cards, and can shop only at member Web sites. But in this day and age, it may well be worth going the extra mile to shop this way.