Card fraud

• Chip & PIN cards
• Cards without Chip & PIN
• Authorisation – an important reminder

How can you protect your business when the customer and the card are present? These tips show you the correct procedure:

• Your terminal – accurately follow the prompts on the screen.
• Entering the PIN – always ask the cardholder to enter their PIN. Nobody else should do this on behalf of the customer.
• Locked cards – when a customer enters an incorrect PIN three times in a row, the card is locked. Tell the customer to contact their card issuer. It’s vital you don’t swipe the transaction instead.
• Incorrect procedure – if a Chip & PIN card is not processed correctly, you could be liable for the transaction if it is confirmed to be fraudulent later on.

Remember – not every card has Chip & PIN. When you’re presented with one of these cards, make sure you check all visual security.

• Obvious signs - check the card to ensure it looks genuine by following the steps on the Card Watch website
• Ultra violet light – use one of these lamps to spot the security mark on most cards. Some Visa Electron cards don’t have a security mark.
• Name and gender – check the title on the card with the gender of the person using it.
• Signature – check the spelling of the name on the signature strip against the spelling on the front of the card.
• Check the long number – make sure the number on the front of the card matches the card number you’ll see on the till receipt. Sometimes, when fraudsters ‘clone’ a card, the number held in the magnetic strip doesn’t match the one printed on the card.

The Streamline website has information to help you prevent card fraud.

Even if a card is authorised – if you've not carried out all the correct checks - there's a chance you may not receive the payment.

Remember, authorisation is only designed to show two things: that sufficient funds are available to cover the payment and that the card has not been reported lost, stolen or compromised in any other way.

• The customer and the card
• Security features – make sure you check them
• Suspicious? Report your concerns

Some fraudsters are careless – giving you obvious cause for concern. Others spend a lot of time and effort establishing their credibility, and can be hard to spot.

Be particularly wary of customers who:

• Use two cards for one purchase – card scheme rules don’t allow this.
• Try lots of cards – if the first, and any following, requests for authorisation have been declined.

Here are some other clues you should look for:

• Indiscriminate purchases – does it almost look as if the customer doesn’t really care what they buy? If the goods could easily be sold on, you should be even more suspicious.
• Easy sales – is the customer too good to be true? For example, are they not even interested in the price or details about the goods?
• Large sales – ask yourself if the sale is much higher than your usual sales. Is the customer buying lots of different items? Above all, does this person act like your regular types of customer?
• Name and gender – check the title on the card with the gender of the person using it.
• Numbers that match – make sure the last four digits of the card number and the signature on the card match those on the terminal receipt.
• Signature strip – are there any signs of tampering?
• Felt pen signature – if you notice this on a card, it could be a sign that fraudsters are trying to hide the real signature. The card signature should always be in ballpoint pen.

The present Visa and MasterCard designs will be around for a while. However, as new cards are issued, they’re being re-branded with updated designs and security features.

• New logo design – replacing the Visa flag on front of Visa cards.
• Ultraviolet check – Visa cards with the new icon have an ultra violet image inside the logo. You’ll also see the word ‘Visa’ repeated on the signature strip.
• Hologram or holographic magnetic stripe – you might see these on the back of new MasterCard or Visa cards.
• Embossed characters – the ‘Flying V’ and the ‘MC’ embossed letters might not be on the front of many new cards.
• Logos and more – the logos can now appear in more places that before. It’s also worth noting that cards will be able to have ‘portrait’ designs in addition to the current ‘landscape’ ones.
• Useful websites: These websites can help you become familiar with the new designs.
• Financial Fraud Action UK
• Visa
• Mastercard

Always make a ‘Code 10’ authorisation call – if you have any suspicious at all about the card or the person presenting it.

To find out more, have a look at your Merchant Operating Instructions.

• Get the right information
• Extra protection for your business
• Be wary
• More Information

When people buy with their cards over the internet, phone, fax or mail, it’s known as a ‘remote’ or ‘card not present’ transaction.

The situation is clear: these transactions present a higher risk to your business, as there’s no way of checking the card visually or meeting the cardholder.

Of course, most ‘card not present’ transactions are genuine. But it doesn’t take away from the fact that fraudsters like this type of transaction – especially with the rise of Chip & PIN security closing down other avenues.

It’s vital you get all this information for every customer. Although only some of this information is needed to process the transaction, the rest is used to verify the card and cardholder:

• Card account number.
• Cardholder’s name as it appears on the card.
• Card expiry date.
• Card issue number and start date (if it’s on card).
• Card three-digit Security Code, usually found on the back of the card within the signature strip.
• Cardholder’s billing address.
• Cardholder’s address for delivery of goods.
• Contact phone number – preferably a landline, and not a mobile number.
• Name of the card issuer.

The present Visa and MasterCard designs will be around for a while. However, as new cards are issued, they’re being re-branded with updated designs and security features.

• Get the most from your terminal – Make sure the Address Verification Service and Card Security Code functions don’t indicate any problems with the transaction. These check the cardholder’s address and the unique Security Code.
• Call your customer – using a landline number that has been independently checked. To check a phone number, call directory enquiries, or use an online directory enquiries service.
• Be firm about delivery addresses – only deliver goods to the cardholder’s registered and verified address. Never deliver to third parties, such as friends, relatives, taxis or couriers.
• Customer collections – if the customer wants to pick up the goods in person, that’s fine. However, when they turn up, ask to see their card and simply process the transaction as ‘cardholder present’.

Watch out for customers who:

• Don’t seem to care – is the customer too good to be true? For example, are they not even interested in the price or details about the goods?
• Are being prompted – listen out for third parties in the background.
• Don’t know enough – they hesitate when you ask them technical questions about the products, or about the bank that issued the card.
• Demand next-day delivery – and aren’t worried about additional costs. Be especially wary if their address is close to your premises.
• Call on delivery day – and want to know when the goods will be delivered.
• Only give a mobile number – you should always get (and check) a landline.
• Use two cards for one purchase – card scheme rules don’t allow this.
• Try lots of cards – if the first, and any following, requests for authorisation have been declined.

You should know that fraud screening services such as Verified by Visa and MasterCard Secure Code are increasingly common. So expect to have more transactions referred – helping to keep your business safe.

To find out more, have a look at your Merchant Operating Instructions

Action Fraud, the UK's national fraud reporting centre provides information for businesses to help prevent card not present fraud. Financial Fraud Action also provides advice.