recent rise in crime

[Ross Anderson]

Roland:

> When did this change? When I used to sell things mail order (in a former
> life) we were obliged to call up the Credit Card company and verify that
> we were shipping to the correct address, when getting authorisation for
> the sale. Some ISP members of mine confirm they were also doing this
> very recently.

I used to believe this bank propaganda too, until one day I was
processing a credit card transaction from Finland and I gave them the
address of a different Finnish cardholder by mistake. The transaction
was approved without difficulty. I now gather (from Alan's talk) that
all they do is check that you read out an address in the correct
country and seem to be fairly confident about it.

The country name they can get from the BIN number (the first six
digits, which identify the bank). What I'd be interested to hear is
whether anybody who's used a UK-issued credit card with an address
outside the UK (e.g., while working as an expat in Saudi) has been
hassled about authorisations. If not, then maybe all they do is check
that you read any old address out confidently.

Jon Ribbens:

> The procedure as I understand it is that the merchant is only guaranteed
> their money if they sent the goods to the address that the credit card
> company has listed for that card. However, the merchant has no way of knowing
> if the address they have been given is that address.

Correct. The merchant carries the full risk of fraud in mail and
telephone order transactions. See

	http://www.fipr.org/WhoCarriesRiskOfFraud.htm

Ross