Published: January 26, 2017
Reading time: 5 minute read
Written by: Forter Team

Click and collect is increasingly popular. What was notable only a year or two ago as a development in the way people shop has become a standard option many consumers expect to see at checkout. According to Cisco, 44% of consumers want to take advantage of this option.

You can see why. If you buy online and pick up in store, you’re leveraging both the convenience of online shopping (choosing from a range of items, not having to queue, taking care of the purchase right from your phone) and the convenience of flexible pick-up. You don’t have to worry about waiting in for the package, or whether it will arrive while you’re at work, because you’re in control. You can set a time that suits you and pick it up on the way home.

Retailers love it too, because these click and collect customers often buy more items in the store. With Amazon rolling out brick and mortar stores which ditch checkout in favor of smoother shopping experiences, not being up to the omnichannel challenge increasingly means not being competitive.

Omnichannel Convenience for Omnichannel Fraudsters

Unfortunately, there’s another group who find it equally convenient, but for rather different reasons: omnichannel fraudsters. The convenience of online shopping, for the fraudster, is that it makes it so much easier to hide. He can use stolen account or payment details, a different IP address, a different name, and who’s to know?

Similarly, the convenience of pick up in store, for the fraudster, is that he doesn’t need to worry about a shipping address. This can be a real challenge for a fraudster, since they need to worry about matching the billing address to the shipping address… but they don’t have ready access to the shipping address. There are a number of workarounds for this, of course (fraudsters are nothing if not creative) but omnichannel shopping has given them a new and easy solution. No shipping address required; just click and collect.

Is Omnichannel Fraud Scalable?

The short answer to this question is “Yes, and no.” Unpacked a little – it’s not infinitely scalable, and certainly not as much as some other methods where more automation is possible. But on the other hand, it is more repeatable than you’d think, and can have significant ROI for the fraudster involved.

Naturally this only works for fraudsters who can physically collect their goods. But there are plenty of homegrown US online criminals, and plenty of non-US criminals who can hire people in the US to pick things up for them. One way and another, many of those are starting to leverage omnichannel fraud. Let’s look at an example.

The Boozer Fraudster

I came across this example only last week, when I was researching the omnichannel trend across the transactions our machine processes. This was an interesting topic because many of the characteristics that are often “fraud flags” for the machine aren’t present.

The fraudster doesn’t need to do much hiding because he’s not shipping and is often in a believable location by default. Some criminals even choose stolen payment data by billing address; they’ll want victims who live nearby so that their story hangs together well. The online underground is sophisticated, and when you’re buying you can choose stolen data by a variety of metrics, including billing address.

There was one case that struck me particularly. This was a fraudster who knew what he wanted, evidently had a specific market in mind to resell to, and was apparently very organized. He was even actually based in New York, so he didn’t have the extra hassle of managing mules for the pickup or juggling IP addresses.

He wanted alcohol – not the 6-packs of beer or the cheap liquor that teenage fraudsters try to score, but the good stuff. Dom Perignon champagne, Lagavulin 21 Scotch, d’Usse Cognac, Grey Goose Magnum. Not the most expensive items in the store, which might invite suspicion, but pricey bottles that he could resell for almost as much.

The thing that made him really memorable was his timetable. He hit a number of different stores, using various personal and payment details, and wanted to pick up in store each time. He set his delivery times carefully; you could tell he’d worked out his route around the area and when he’d be able to get from one to another.

Altogether, he was targeting thousands of dollars worth of alcohol, but in a way that made it unlikely any individual merchant would pick up on it. And he was doing it from multiple devices, on the go, to collect soon after placing the order – meaning there probably wouldn’t be time for manual review.

Did He Succeed?

Well, no. The merchants were all protected by Forter. Our system is attuned to omnichannel fraud and gives instant, automated approve/decline responses. There is no manual review, so fraudsters can’t benefit from a rush order. Merchants with Forter never have to compromise their customer experience for fraud checks, or vice versa.

The truth is that in this case a manual review might not have caught it anyway. All the individual data points for the individual orders looked convincing. Forter’s system caught it because our sophisticated velocity technology made the connection between this round of visits and previous ones on different devices when the fraudster was ‘scoping it out’ and because the behavioral analytics threw up red flags.

Every Attempt is More Grist for Our Mill

Forter has a large analysis team, but performs no manual reviews. So what do we do all day? Research. The findings and insights which that research generates are then incorporated into the machine, which itself learns from each transaction and the patterns it finds.

So each attempt at omnichannel fraud gives the system more knowledge of what it looks like and how to catch it. A team of manual reviewers who might each have seen one of these orders wouldn’t see the pattern holding them together fast enough, and a machine alone wouldn’t see and adapt to the pattern as quickly (machines rely on larger data sets), a team of researchers working together with the machine’s own abilities can not only see it almost at once but work out how to use the knowledge to become even more accurate in future.

Want to find out what Forter’s investment in research can do for your business? Get in touch, we’d love to talk.

5 minute read