Screening Suspicious Orders

What screening is for

Order screening means looking at an order before fulfillment to decide whether it is likely to be legitimate. The aim is to catch stolen-card purchases and similar fraud before goods leave the building, since after shipping the seller typically has little chance of recovering the items and may face a chargeback on top.

No screening is perfect. It is a judgment about probabilities made with limited information. Done well, it stops some bad orders at modest cost. Done badly, it delays or cancels honest orders and sends good customers away.

Signals that deserve a closer look

A single signal is rarely enough. A cluster of them is more telling.

• Mismatched details. The billing and shipping addresses are in different cities or countries, the name on the card differs from the name on the order, or the email looks unrelated to the name.
• Address check failures. The payment provider reports that the billing address or postal code does not match what the card issuer has on file, or the security code check failed. How reliable these checks are depends on the country and card type.
• Unusual shipping choices. Expedited delivery on a heavy or expensive order, a forwarding service, a hotel or a freight address for a product that would normally go to a home.
• High value or unusual quantities. A first-time customer ordering many of the most resalable items, or a basket of high-priced goods with no visible interest in sizes, options or price.
• Repeated attempts. Several cards tried before one works, or several orders in rapid succession with small variations.
• Odd contact details. Randomly generated email addresses, disposable email services, phone numbers that look invalid or are shared across unrelated orders.
• Behavior in the store. Going directly to checkout with little browsing, ignoring shipping costs, or arriving through an unusual path. Store analytics can show some of this.
• A link to previous trouble. The same address, device or name tied to earlier chargebacks.
• Pressure. Messages demanding that the order ship at once, or asking you to change the delivery address after payment.

Many payment providers offer a risk score or flag orders automatically. Treat these as a prompt for review, not a verdict, and check what each flag actually means in your setup.

Why false alarms matter

Every one of these signals has an innocent explanation:

• Gifts go to other people, often in other places, with different names.
• Travelers, students and people with two homes ship to unusual addresses.
• People type an address slightly differently from the one on file with their bank, or use a new address that the bank has not yet recorded.
• Families share cards, and an order may carry a spouse’s or parent’s name.
• Last-minute buyers genuinely need fast shipping.
• Privacy-minded customers use alias or throwaway email addresses.
• Customers living abroad may use a forwarding service by necessity. That connects to the matters in the article on international shipping.

Overly strict rules turn these into canceled orders and angry emails. A rejected honest customer is a lost sale, and may never return. Some will leave a review that mentions it. Weigh that against the cost of fraud: for a low-value, easily replaced item, lenient rules are often right, while a high-value, easily resold item justifies more care.

A sensible review process

For orders that trip a few flags:

1. Hold the order, not cancel it. A short pause before fulfillment keeps options open.
2. Check the basics. Compare names, addresses, email and phone for consistency. Look the address up on a map to see whether it is a residence, a business or something unusual.
3. Look at the payment data. Review the address and security code check results and any risk score from the payment provider.
4. Look at the history. Is this a repeat customer who has ordered before without trouble? That tends to lower the risk.
5. Contact the customer. A polite message asking to confirm the order details is often enough. Real customers usually reply quickly and without annoyance. Do not ask them to send card numbers or photos of the card by email, which creates its own risk. Ask only for information you can compare with what you already have.
6. Decide. If the customer confirms and the details fit, ship. If they do not respond, or the replies are evasive or inconsistent, canceling and refunding is reasonable. If the payment may be fraudulent, ask your provider how to handle it, because the correct steps for refunds can vary.
7. Record the outcome. Note which signals led to genuine fraud and which turned out to be harmless. After a few months, the notes show which rules are worth keeping.

For high-value orders, consider extra steps such as requiring a signature on delivery, shipping only to the verified billing address, or splitting shipments. These also strengthen evidence if a dispute arises, a point covered under chargeback disputes.

Tuning the rules

• Start with a few clear rules and review them regularly, rather than building a long list of complicated ones.
• Treat a rule as useful only if it catches bad orders at a reasonable cost in good ones. Track both numbers.
• Use different thresholds for different products. A digital item delivered instantly, a made-to-order product and a high-end gadget carry different risks.
• Avoid rules that are likely to discriminate against whole groups of people or regions without evidence. Blocking a whole country, for instance, may be sensible for a particular store but should be a deliberate choice, and you should check that it does not conflict with consumer rights or other rules where you sell.
• Automate the obvious and keep humans for the gray areas, as long as the volume is manageable.

Limits of screening

Some fraud will get through, including by criminals who copy honest-looking patterns, and some honest orders will be delayed. Screening works best with other measures: card testing defenses, secure accounts, clear policies and a payment setup with good built-in tools. Practices and available tools differ by provider and region, so use this as general information and check your provider’s guidance for specifics.