Preventing Fraud: block orders by ship-to address?

[William_firefold]

We have been getting a number of orders coming in that were determined to be fraud. We have found that they are coming from places in Africa, and are being placed using real credit card numbers but with mismatched billing addresses. The system catches them and declines the orders, but should we ever have to turn off the AVS system, these orders would slip through. The orders are also taking up order #s and putting additional strain on the system.
We have found that all of these orders are shipping to the same address.

My question: Is it possible to block all orders which are placed with a particular shipping address, or even better, orders which are a close match to a shipping address?

[jmestep]

You can set the countries that you don't want to ship to, or you can set the site to block certain ip addresses.
Otherwise, you would have to make code customizations.

[AbleMods]

Logic suggests the scammers would have moved on if you were catching ALL their fraud orders. Or you have anonymous checkout turned on and they're bot-ing you.

Blocking them entirely will be difficult. Soon as they figure out you're validating ship-to, they'll just change to a different address. Blocking by IP only marginally works in this modern world of DHCP internet connections.

If the ship-to is always something in Africa, you could implement a checkedout() method that fires after checkout and looks for an Africa ship-to. Then it changes the order status to "Out-of-Country Review" order status. You'll still be left with a manual review process but at least you can get the order out of your main processing stream to prevent the shipment. This of course assumes you also have some legit orders that go to Africa.

[William_firefold]

Unfortunately in our situation, this is even more difficult. For some reason the scammers are shipping to a US address. We dont know why, or what they would have to gain by doing this.
I contacted the person at the ship to address and they said they have been receiving several boxes a day from UPS and FedEx. All of them were returned to sender! The lady seemed honest enough and actually talked to me for 10 minutes, so I don’t think she was actually placing the fraud orders.

[AbleMods]

An old rule in military intelligence was to believe 10% of what you hear and half of what you see.

She could easily be lying.

It could be a competitor trying to bog down your business processes and finances.

She could have no clue her son, husband, brother-in-law or or neighbor is part of the scheme and snags the packages left on her door while she's gone.

With the fraud orders I've gotten, they're ALWAYS shipped to a different US address than the bill-to. They're always with a fake email or general email (gmail, MSN, yahoo). Most of the time they order Overnight shipping. Doing a reverse-Geo on the ordering IP will usually show a different region of the country ex: bill-to in California but the IP reverse-geo'd back to Atlanta, Georgia and the order is shipping to Bronx, New York.

My policy, since I took the huge fraud hit back in Jan '09, has been that any order over $ XXX must ship to the bill-to address or the order is cancelled. I've probably lost some orders, but it's better than losing the entire cash amount(s) to chargebacks 45 days later.