Steering Clear of Triangulation Fraud
In some ways, online fraud is like any other sector in the tech industry—in order to stay profitable, they have to keep innovating. It’s not always easy to extract actual cash money out of a stolen credit card number, and most fraudsters are interested in cash and not whatever random goods they can purchase before the card gets reported and blocked.
One scheme that fraudsters have come up with to maximize their ill-gotten revenue is triangulation fraud, which effectively launders stolen credit through a legitimate merchant. What can merchants do to keep from getting unwittingly entangled in triangulation fraud?
Organized, professional fraudsters don’t amass thousands and thousands of stolen credit card numbers so they can use them for online shopping sprees. They’re trying to convert a plentiful resource—compromised data—into a more valuable one: cash.
One way to do this is to purchase items with a high resale value and resell them on secondary markets, but this isn’t the most efficient approach and merchants who sell goods with a high resale value tend to be extra-careful about screening for fraudulent orders.
Smaller merchants who sell things like electronics, toys, and cosmetics don’t always have the same safeguards as merchants who sell things like event tickets, jewelry, and luxury goods, but their products aren’t as easy to flip for cash, either.
Triangulation fraud provides cybercriminals with a way to take advantage of smaller merchants more efficiently and convert a wider range of products into quick cash.
What is Triangulation Fraud?
Triangulation fraud works by placing the fraudster as a middleman between a legitimate customer and an unsuspecting merchant. The customer places the order through the fraudster, the fraudster purchases the customer’s goods from a merchant, using a stolen credit card.
The merchant ships the order, the customer receives their goods, and the fraudster keeps the money. Eventually, however, the owner of the stolen card will report the fraudulent activity on their account, and the merchant will get hit with a chargeback.
Rather than go to the trouble of setting up fake storefronts to lure in customers for triangulation fraud, many fraudsters simply recruit online sellers who may have no way of knowing that they’re getting enlisted in an illegal scheme.
The fraudster may look for people with an established presence on sites like eBay or Amazon, provide them with a list of goods to sell (from merchants that the fraudster has already scoped out with test purchases), and promise a generous percentage of each sale.
With these recruits working on their behalf, the fraudster can make a significant amount of “sales” with various merchants in relatively short order.
What are the Consequences of Triangulation Fraud?
Triangulation fraud is extremely damaging to consumer confidence in small ecommerce stores and marketplace sellers. “Normal” ecommerce fraud victimizes both the cardholder and the merchant, but triangulation fraud adds two more parties to the list of victims: the customer who thought they were making a legitimate purchase, and the seller who was recruited to list merchandise for the fraudster.
The customers may be asked to return fraudulently-purchased goods, the sellers may suffer harm to their reviews and online reputation, and the fraudster, more often than not, disappears before any consequences can fall to them.
Ultimately, the gravest danger for merchants is that every triangulation fraud sale is a chargeback waiting to happen. These would be considered true fraud chargebacks, and as such, merchants carry the financial liability and have no way to fight them the way they can with “friendly fraud” chargebacks.
Each chargeback carries costly fees, and each chargeback is counted against the merchant’s chargeback ratio. Once that ratio exceeds a certain threshold—usually as low as 1%—they may incur penalties from their bank or card network. Merchants who carry a high chargeback ratio for too long may even lose their merchant accounts and get placed on an industry watchlist.
What makes triangulation fraud especially nasty is that it tends to involve lots of small, individual purchases, rather than one big high-value purchase. That means that a merchant selected as a target for triangulation fraud can end up with a high number of chargebacks, each of which—no matter how small—carries fees and counts the same against a rising chargeback ratio.
How Can Merchants Avoid Triangulation Fraud?
The nuts and bolts of triangulation fraud transactions are no different than any other attempt at a fraudulent card purchase. Tools like AVS, CVV, and 3-D Secure can screen out fraudsters who don’t have a complete set of payment credentials, and tools that use risk scoring to identify potential fraud indicators can be very helpful at flagging suspicious orders and reducing fraud.
In terms of data analytics, however, triangulation fraud often presents a unique and identifiable profile. Triangulation fraudsters will usually try to make their transactions look “clean” and legitimate, but some signs can’t be hidden.
If you suspect that your business is being used in a triangulation fraud scheme, keep an eye out for customers who are placing frequent, repeat orders for the same few products, especially if they’re using different shipping addresses for each order.
It may also help to look up your products on marketplace sites like eBay, Amazon, or Facebook. If you see your unique products being resold there for prices that are too good to make sense, that may indicate that the seller has been recruited by a fraudster.
Triangulation fraud is just some sophisticated packaging around a common problem: fraudsters using stolen credit cards to make purchases. While there are aspects of triangulation fraud that make it especially pernicious, the good news is that the tools, practices, and methodologies that prevent ordinary credit card fraud will protect merchants from triangulation fraud as well.
Preventing fraud is an essential part of any chargeback defense plan. True fraud almost always results in chargebacks, and the only time you can fight those chargebacks is before they happen. By including robust anti-fraud defenses in your chargeback prevention strategy, you can cut down on unwinnable true fraud disputes and focus more of your resources on fighting illegitimate and fraudulent chargebacks instead.