Taking card payments on your website without the scares: 3D Secure, fraud and chargebacks

Selling online means taking card payments, and taking card payments brings two risks many businesses discover too late: orders placed with stolen cards, and chargebacks, when the cardholder complains to the bank and the money is taken back from you. Neither can be eliminated completely, but both can be greatly reduced with simple decisions.

Don't store cards: let the payment gateway do it

The first rule is that card details shouldn't pass through your server. Well-known payment gateways (your bank's, Stripe, Redsys, PayPal and the like) offer their own forms or payment pages where the customer enters the card directly into their systems. Your website only receives a confirmation.

That way, if someone ever breaks into your website, they won't find any card numbers to steal. And you avoid having to meet payment security requirements designed for much larger companies. If your website stores cards in its own database "so the customer doesn't have to type it in again", now is the time to review that.

3D Secure: the confirmation the bank asks for

You've surely seen it as a shopper: you pay and the bank asks you to confirm in its app or with a code. It's the strong authentication required by European payment regulations (known as PSD2) for most online purchases, and in practice it's done with the 3D Secure system.

For the merchant it has an important advantage: when a payment has been authenticated this way, in many fraud cases liability shifts from the merchant to the issuing bank. That's why you should make sure it's enabled on your payment gateway and not turn it off to "remove friction".

Signs of a suspicious order

No system is perfect, so it's worth manually reviewing orders that are out of the ordinary, especially in peak season:

• Amounts far above your average order, or several units of the same expensive product.
• A shipping address that has nothing to do with the billing address, or express deliveries to pickup points.
• Several failed payment attempts in a row with different cards.
• Nonsensical or newly created email addresses, and phone numbers nobody answers.

When in doubt, a call to the customer before shipping settles many cases. A genuine buyer understands; a fraudster usually disappears.

How to avoid chargebacks that aren't fraud

Many chargebacks don't come from fraudsters, but from customers who don't recognise the charge or can't manage to get hold of you. To reduce them:

• Make sure the name that appears on the bank statement is recognisable and similar to your website's.
• Send order and shipping confirmations with a tracking number.
• Have a visible contact and reply quickly: a refund is better than a chargeback.
• Keep proof of delivery and of your communication with the customer, in case you need to defend yourself.

Check the logins too

Your payment gateway account is as important as your bank account. Turn on two-step verification, don't share the main user with anyone and give each person only the permissions they need. A stolen login to the gateway makes it possible, for example, to issue refunds to other people's cards.

If you'd like your shop to take payments securely and without hassle, you can tell me about your case at pablopedrosa.com, no strings attached.