Free e-mail account is very easy to setup than to setup an e-mail address with a company in background together with a web site. There are lots of companies refuse to do business with free e-mails. I do not suggest to completely avoid, but what I say that you must be careful with the orders done with free e-mails. Free e-mail is another positive point to your fraud scoring system.

Also, keep in mind that, marking an order for extra check for fraud, depends on your business model. If you target end-users, or let your customers try before buying, your customer may want to try or buy with a free personal e-mail. On the other side, if you explicitly sell to companies, or your products are highly priced, you must watch free e-mails.

AVS is short for Address Verification System, which simply tries to map/match the the address given with the card holder’s address. This technology by it’s implementation is a weak one, and cannot be highly regarded due to several reasons: A recent change in address causes negative responses. Service only available in US and a few EU countries.

AVS provides following common results:

A – The address matched, but the zip code did not. This is for Mastercard, Visa, and AMEX users.
Y – Address matched, but the zip code did not for a Discover card user.
B – The street address was a match, but the postal code was in the wrong format for the international user.
C – The street addresses and postal codes were formatted incorrectly.
D – The street address and postal code match for an international user.
E – There was an error.
G – The service is not supported by a non-US user.
I – Address information was not verified by the international issuer.
M – T street address and postal code match for an international user.
N – There is no match for the zip code or the address.
O – No Response was sent.
P – While the postal codes match, the street addresses cannot be verified due to inconsistencies in the formats.
R – You should retry. The system is temporarily unavailable or has timed out.
S – The server is not supported by the user.
U – The address information is unavailable.
W – The nine digit zip code matches, but the address does not.
X – This is an exact match.
Y – Both the address and the zip code match.
Z – The five-digit zip code matches, but the address does not.
0 – There is no response.

Unless your customer base is not US only, do not use AVS. Just IP to county/city mapping will bring more information.

BIN is short for Bank Identification Number. It’s the first 6 digits of the credit card. BIN (first 6 digits) maps to a bank.

A BIN database provides the merchant with information about the issuing bank such as the country it is located in, the customer’s billing address and other helpful information. The merchant can use this information as a factor in deciding whether or not to approve a transaction. If a card’s BIN is not found in the database, the merchant can decline the transaction to avoid fraudulent activity.

Many online merchants also use BIN databases to determine what type of card is being used to pay for a transaction, such as a credit, debt, or prepaid card. The reason for this is that prepaid cards have a higher rate of fraud. Many merchants use a prepaid flag that will alert them when the card is prepaid so they can either inspect it more closely or simply reject it to be safe. Putting such practices into place can significantly reduce a merchant’s risk of loss from fraud.

Following information can be cross-checked and can add scoring :

1. Customer’s country and Bank’s country will most probably match. A mismatch may be flagged
2. Prepaid cards can be flagged.

One of the most notable database is available at: www.binbase.com

Free e-mails are easy to setup than domain names/web sites. Any order from a free e-mail service must alert you (+1 fraud score).  Fraudsters will try to hide after a free e-mail service.

As I noted previously all orders are done from well know ips. If the ip maps to a proxy address, this is 100% fraud. If it does not map to a proxy server address, you can check

1. IPlocation country to billing address country
2. IPLocation city to billing address city
3. IPLocation provides some Latitude and Longitude value. You can calculate the distance to billing address. Any distance bigger than 1000 kms must warn you (+1 fraud score)
4. You can also check phone number against valid prefixes for IPLocation city/country and billing address
5. You must check zip code against city/country of billing and IPLocation address

Customer’s do connect from an internet connected device; meaning it has got a unique ip. Customer’s ip is really important, you much check and watch:

1. If the ip you catch is a valid ip
2. If ip is proxy ip (+1 to your fraud scoring system). Some fraudster will try to use anonymous proxy servers to be anonymous and untracable.
3. All ips converts to country (%98) and city (more than 70%). The must match billing and/or shipping country and city. A mismatch must alert you (+1)

There are several companies that provide ip to location services. Two of the most noticable ones are: www.ip2location.com and www.maxmind.com.