By Joan Goodchild, Card Not Present
Suggestions for Combatting BOPIS Fraud
Indy Guha, senior vice president of marketing and alliances at Signifyd, has the following suggestions for merchants looking for ideas on stopping BOPIS fraud.
Analyze your risk management strategy and tools: Is what you have in place capable of keeping up with the speed needed to process in-store and curbside orders? Will your system be able to handle what is likely to be an increasing number of online orders that will be picked up in-store or curbside? Consider solutions that will automate your review and order management processes to ensure you can meet customer expectations and protect the business without lengthy manual reviews.
Identify signals you can use to verify identity in the absence of a delivery address: Consider a customer’s order history. Have you seen this customer before? Has he or she previously ordered online? Has he or she used BOPIS or curbside before? Have orders from the same customer come in unusually quickly or in unusually high numbers—even at other stores under your brand? Turn to data points such as the device used for the order, the proximity of the IP address to the store, corroborating information on social media.
Identify and train associates to work on BOPIS and curbside pickup: Depending on your business’s size and order volume, you might consider having dedicated employees work only on BOPIS and curbside orders. Have clear procedures regarding identifying customers picking up orders. Be sure associates know how to spot the warning signs that something is not right. They need to be especially careful with orders picked up by someone other than the customer who placed the order. They need to be cautious with high-value orders — all without slowing down the process.
Be nimble: BOPIS and curbside pickup represent a new channel for many retailers. Observe, learn and iterate. Things will go wrong. Customers, however, appear ready to accept some hiccups. When things do go wrong, make things right for the customer involved. Consider gift cards, discounts or some other thoughtful gesture.
When many retailers were forced to close their doors in the spring due to the Covid-19 lockdown, many began to offer Buy Online, Pick Up In Store (BOPIS) options. In the early days, it was more common to hear about Buy Online, Pick Up Curbside (BOPUC) – an offering that most still have in place today, even though bricks-and-mortar locations are largely open again.
In fact, FitForCommerce’s Omnichannel Retail Index finds BOPIS is now offered by 66 percent of the retailers they tracked, compared to just 33 percent in 2016, the first year of the study.
“The ability to buy something online and return it in a local store quickly transitioned from a 'nice-to-have' to 'must-have' capability,” noted the report summary.
But, while BOPIS offered some relief for pinched merchants desperate to keep selling during a pandemic, it also opened up new avenues for fraud.
“It’s undeniable that fraud attempts utilizing BOPIS have increased since March,” said Ian Ferow, head of fraud with Shoprunner and also a client intelligence manager with Precognitive, a fraud prevention firm. “We particularly saw within our client base that April and early May had a correlation of fraud attempts utilizing store pickup. Early on, it seemed like many retailers had a very elastic policy of how pickups would take place and what might be required of the customer.”
Indeed, criminals noted the popularity of BOPIS and leveraged it for profit. Using stolen credit cards or stolen account credentials, these fraudsters often place an order online, pick up the items at the store, and then sell the items for profit, or keep them for their own personal use.
“BOPIS and curbside orders have always presented heightened fraud challenges,” said Indy Guha, senior vice president of marketing and alliances at Signifyd. “First, the orders need to be filled quickly, or the channel’s promise of quick convenience is lost. Second, curbside and in-store pickup orders come without a delivery address, which means orders have to be assessed without a key piece of information that provides a number of identity signals. Third, identity verification at the pick-up location is inconsistent at best. Store employees with a back-logged pickup queue will be inclined to let drivers through with a cursory check. Combine those three issues and you have major fraud exposure.”
Guha said while Signifyd has seen an increase in fraud pressure on BOPIS orders since the outset of the pandemic, the channel still represents a relatively small percentage of all e-commerce orders. But criminals are paying close attention to BOPIS growth.
“We’ve seen fraud pressure, which we define as the percentage of very risky orders placed on our Commerce Network, increase by as much as 200 percent during the pandemic. Again, it can be a fairly volatile indicator, but we do know that fraud rings are paying attention to the rise in curbside pickup and that they are working to take advantage of the opportunity.”
Guha also noted that Signifyd had recently worked with a national enterprise retailer that was confronting a fraud attack that put a new twist on traditional account takeover fraud. The fraudsters took over customer accounts—not to buy items with an innocent victim’s credit account, but rather to monitor accounts for curbside pickup orders. Once the orders were placed, the fraud rings would send mules to the local store ahead of the legitimate customer. The mule’s job was to wait in the parking lot while an associate put the stolen goods into their trunks.
The takeaway? Criminals, always industrious, are also finding new angles to take advantage of BOPIS and commit fraud.
Getting Ahead of Criminal BOPIS Tactics
Both Ferow and Guha stress there are ways to combat BOPIS fraud. Enhanced security and identification checks at pickup, and tools that can help flag unusual behavior, are two great strategies.
“We are putting a higher emphasis on better data, specifically behavioral data to help improve your decision process,” said Ferow.
“Behavioral analytics has proven an effective tool to distinguish your customer’s shopping behavior from fraudsters who have significantly different user journeys.”
Like any distinct channel, in-store and curbside pickup require new ways of thinking, said Guha.
“It requires flawless inventory management and vision,” he said. “It requires training for associates and others who will literally carry out the program. It requires quick, clear and consistent communication with customers. It might require redesigning stores to accommodate shoppers and what amounts to warehouse workers. And it requires a more sophisticated way of protecting the enterprise from fraud, for the reasons I mentioned earlier, while still providing a fast and frictionless experience for the shopper (Note: also see Guha’s suggestions for combatting BOPIS fraud in the sidebar).
But, despite the challenges, Guha also encourages retailers not to look at consumers’ embrace of BOPIS, and particularly curbside pickup, as a problem.
“Curbside is going to be a lifeline during the upcoming holiday season. First, it’s a way for consumers who are skittish about shopping in stores to ensure they receive their purchases same-day. No small thing when it comes to buying gifts during the holiday season. As importantly, it’s a way retailers can avoid or mitigate high-volume shipping surcharges that UPS, FedEx and the U.S. Postal Service have announced for the holidays. With some of those extra charges reaching $4 or $5 a package, encouraging shoppers to pick up their orders will go a long way to preserving margins.”