I have never given my credit card companies a list of approved addresses or have they ever contacted me about a different address.
I routinely have items shipped to work instead of home. I don't believe that this will work the way you expect. I would be suspicious of addresses not in the same country.

just to clarify the procedure I was told to follow was this: for addresses where shipping address is different from billing address you (the merchant) can call the card's issueing bank (800 numnber on back of card) and they can verify the shipping address is 'authorized'. The bank never calls the card holder in this scenario, its the merchant that calls the credit card's issuing bank. (Yes, in order for different addresses to be listed as authorized the card holder at some point would have had to add that address either via a phone call or maybe web depending on cc company.)

I'm wondering how often this procedure is used? (merchant calling bank to verify) often? never really? other options?

I'm wondering how often this procedure is used? (merchant calling bank to verify) often? never really? other options?

Pretty much never because the vast majority of customers do not register multiple addresses on their cards.

You are going to get a lot of orders where the billing and shipping addresses are different. Whether or not that in and of itself raises a red flag is highly dependent on what you are selling, to who, and into what geographic area.

Selling B2C goods to, say, knitting enthusiasts in the United States is a far different fraud profile than selling, say, iPods and computers in Nigeria.

One of our sites requires the issuing bank number. While this may turn a lot of orders away, it is for the customer's security we do this. If the shipping address is different than the billing address, or the order is inordinately large with express/overnight shipping, or any of the other red flags go up, we make the call.

Here's the problem: even with a valid merchant account and employer ID, many of these banks won't even talk to you to verify the account. The one who's anachronism is a large snake (how fitting) is the worst. We're not asking sensitive info, we call and just ask to verify the information we have. Some of them say no, we can't reveal anything at all.

thanks for the reply CernyM and good point. My scenario does need to be treated as a high risk profile as we have already had a large number of issues. We currently looking into how to address this. I learned from another post there are specific central phone numbers to call for each card to verify ship-to addresses so you don't actually need the card issuing bank phone number. I wonder if those numbers require the full CC number in order to verify ship-to addresses? I already store just the last 4 digits and of course I have their full name and the address they are trying to ship to..? .. I'll check that out... if anyone aready knows please reply anyway as they could happen before I find my answer elseware.. thanks.

You will need to have the full CC number to be able to do an address check. The automated central number for Visa just does the equivilant of an AVS check though so it really isn't a full address verification.

I will call the banks directly if it is an order that I have a funny feeling about just because AVS can be tricked since all you need to fool it is the same number on a different street in that zip code. Easy enough for a local thief to do with a stolen card number from an in person transaction. If the address doesn't match when I call, I will check and see if the phone number matches and if it does give the person a call. Usually it is someone shipping to a work address.

oh, so the central phone numbers are only for AVS? I thought he meant you could verify ship-to addresses, not billing. I need to verify ship-to address. Well, needing full cc number puts me back to square one anyway. I have another thread going about whether or not I should store the cc number. Both my posts are to help me get to the bottom line question which is whether or not we should start storing cc numbers on our site so that we can do this manual ship-to address check with issuing bank or just change our site to only ship to the billing address.

Requiring shipping address to match billing address OR to be a "registered alternate" is NOT AT ALL standard practice.

My credit card bills go to my office, but I get deliveries of web orders daily at home where I work. I do business with at least two hundred merchant websites per year. These include large web merchants and department or chain stores, but also industrial suppliers and many tiny specialty dealers. I almost NEVER run across a merchant site who either requires shipping=billing or babbles about "registering an authorized alternate address with your credit card issuer".

If I do see either of those, I immediately abandon my cart and go to do business with a better supplier. Any merchant who thought either policy reasonable would be just too hard for me to do business with. As a customer, I don't want to negotiate about what is an ordinary situation.

"Requiring shipping address to match billing address OR to be a "registered alternate" is NOT AT ALL standard practice."

thanks j_h_maccann. Your input is greatly appreciated, especially the large sampling of data you provided (the hundreds of merchant sites you do business with each year), that is very helpful to me and is definetly the kind of info I need. I am wondering however if this is changing as we speak? in other words, I don't doubt at all what you say is true, and I agree completely as a customer that I would abandon and shop elsewhere as well. Plenty of other shops to choose from... now.. what if that is changing though. I'm not saying it is, but that is exactly what I'm trying to find out. For example we just had PayPal integrated into our site as a payment option and they have a credit card option where you don't need a paypal account and they *do* only allow shipping to the billing address for this option. I realize thats only one example but since PayPal is so big I thought it was noteworthy. The problem of fraud (several forms) is growing rapidly now. We have already had a big issue with fraudulent orders from stolen cards.. they all had bill/ship address differences. The only 2 ways I am aware of for handling this is to A) only allow shipping to the billing address (boo, don't like) or B) some kind of manual shipping address verification which requires me to have the shoppers full cc number which I currently don't store (opens up whole other issue and liability, FACTA I think is called.. not sure). I started another post specific to this issue.

We have to have some way to verify the shipping address because we have already been burned. Significantly.

I do expect that most existing sites don't require a bill/ship match (I was suprised to see Paypal does) and I really don't know how many are doing a manual ship address check (I want to find out). But I'm wondering if, moving forward, this is changing?

How do you get burned from fraud with a billing/ship to address difference?

The only way to get burned from fraud in a card not present transaction is to first of all not have an exact match on the billing address (use AVS and keep you records).

The second way is to ship without getting someone there (does not matter what address it is as long as it is listed on your initial credit card record with the billing address) to sign for it. This can be solved by shipping everything signature required.

If you don't do these two things you will be quite safe from any chargeback. If you do these things and the bank is taking your money you should get out fast and find another merchant account.

If you are worried about the possibility of fraud even though you may not have to pay. It's the cardholders responsibility to report lost or stolen cards. The credit card company takes up the slack for a certain period of time on fraudulent charges from stolen cards. They contact customers about suspicious charges when they deem fit to minimize their losses. However, they don't pass this along to unsuspecting merchants who have followed regulations.

ipsy, I think you are being very naive about that. The one time I got burned <knock on wood> was when I shipped to a work address and not the billing address which I had. That was for a $250 ring four years ago when gold was cheap. I learned quickly to be very careful about shipping to alternate addresses. It is a gamble any time you don't ship to an address that is on file with the credit card company. I am extra careful in those cases and verify as much as I can, but in the end, it comes down to a gut call if I should accept the order or not. The card processors only take responsability in extreme cases.

well, in our case the AVS on the site was not functioning and we were not aware of it until several fraudulent orders went through (its fixed now). However even with AVS working these orders would not be stopped because they were legit billing addresses. The shipping address on the other hand was different and not an authorized address. Several orders were shipped out to these addresses and of course the real owner of the card filed chargebacks. Now that AVS is fixed I'm thinking half the issue is resolved, the other half is the shipping address issue.

whoops.. I was slow to post my last message.. just FYI, my last post was a response to ispy.

RED WOLF ...100% ..a gut call is what we always do as a large chunk of our bus. wants to ship to a work address..

DAVIDJC If you can verify the tel. number associated with the billing address, just call and say your verifying the " alternate delivery " address... at least you'll know if the card owner is the one actually placing the order...

Even with AVs or any other system...

thanks all,

fiu88, calling actual customer to verify is something we thought about but we thought the fraudulent user could just give any number that he/she would answer and just say yes, ship it. how do we know the number given is actually tied to billing address? Well, I guess in many cases that would be public info that could be looked up but what about shoppers ordering online while at work? or other situations where they would not be at the billing address to receive the call, even if we verified the phone number was tied to the billing address.... just thinking aloud (well, 'atyping'). Thanks though.

DavidJC, in most cases the credit card companies have the customers home and sometimes work phones in their database and you can get them to verify the information at the same time you call to verify the address. In most of the cases where I have needed to follow up, the order has the a phone number that is on registerd with the credit card company.

>>>do we know the number given is actually tied to billing address?

If you are in the US, type the phone number into google. Most of the time the name and address will show up.

Forget about getting any help from the banks. They are useless and really do not seem very concerned. There are many threads here that will illustrate what I am talking about. We used to call with compromised credit card numbers as a "heads up" for them. They could care less.

Do a site search for "detecting fraud" and that sort of thing and you will find all kinds discussions about "red flags" for fraud.

The best way to handle fraud is - to let fraud experts handle it. Smart and simple :)