How to Prevent “Click and Collect” Fraud

For retailers, omnichannel sales is the new business imperative. Brands are now required to be anywhere and everywhere just to keep up with the competition and the line between digital and physical shopping is becoming increasingly blurred. From leading global luxury retailers such as Burberry and FarFetch, to large American retail chains such as Macy’s and Kohl’s – everyone is turning to new business flows to meet the demands of consumers.

One of the most popular omnichannel flow is allowing shoppers to buy online and pick up items in the store, commonly known as Buy Online, Pick Up In-Store (BOPIS) or Click and Collect. This flow holds a lot of potential for brick & mortar retailers. For starters, it’s in high demand. A recent study showed that nearly half of US consumers (44%) want the option to collect their purchase at a physical store immediately after purchasing online. But this shopping flow is also advantageous for retailers; it gets customers into physical store locations where they are likely to make additional purchases.

However, making customers happy requires not only offering the shopping flows they expect, but also great execution, and there are a couple of major challenges retailers need to overcome in order to successfully pull off in-store pickup. The first challenge is risk – this shopping flow exposes retailers to a myriad of fraud-related vulnerabilities. The second challenge is operational – retailers need to make sure the merchandise is ready to be picked up when the customer arrives in the store.

In this post, we will discuss the fraud-related challenges associated with in-store pickup, and explain how retailers can overcome them.

The Fraud Challenges of Click and Collect

Risk Challenges

Retailers struggle with fraud review of Click and Collect orders because customers choosing this option do not provide a shipping address. The shipping address is a data point many businesses rely on for fraud review purposes. Some common fraud review methods requiring a shipping address include checking for a billing/shipping address mismatch, using third party data sources to verify the homeowner at an address, and measuring the distance between the shipping and IP addresses. These validations cannot be conducted when there is no shipping address associated with the order.

Faced with this challenge, retailers try devising workarounds to ensure that the purchase was made by the legitimate cardholder. For example, some retailers may substitute store location for the shipping address, and will then check the geographic proximity of the billing address to the store location. But this workaround has a critical flaw – it doesn’t take into account how online fraud actually works. The reality is that when fraudsters buy stolen credit card details online, they don’t receive just the credit card number – they also receive the billing address associated with the card. At a minimum, this includes the house number and ZIP code – information that allows fraudsters to trick AVS filters as well select a store in the same area for pickup.

Operational challenges

The fraud review process can also entail operational challenges. To compensate for the lack of shipping address, many retailers rely heavily on manual review. A manual process can be inefficient and hard to scale even during the best of times, but can be especially problematic when sales volumes spike.

During certain days of last year’s holiday season, there was a reported 47% increase in fraud attempts specifically in BOPIS orders. Taking that information into account, retailers might be tempted to route even more in-store pickup orders than usual to manual review during sales and holiday seasons, adding to the workload of an already busy team. This has the potential to cause a backlog of orders waiting to be reviewed, making it very difficult to have the items ready for pick-up when customers arrive at the store.

How To Safely Offer In-Store Pickup

But fraud operations should never hold a retailer back from achieving business goals. While in-store pickup poses real challenges, there is a way to both meet consumer demands and avoid fraud. Since Riskified supports Click and Collect for a variety of global retailers, we listed some of our tips and best practices to help retailers do the same:

1. Collect & analyze as much data as you can:
   There are many data points besides the shipping address that retailers can – and should – use to screen orders for fraud. For example, Riskified’s Beacon – a small snippet of code embedded on a retailer’s site – can collect data about the type of device, the device location, and the customer’s activity on the retailer’s website or mobile app. This data can be used for device fingerprinting, proxy detection, and behavioral analytics.
2. Never decide based on a single data point:
   We strongly recommend against making a decision to reject or approve an order based on a single data point. For example, an order with a billing address located near the pickup store alone is insufficient to prove legitimacy. Riskified looks at the relationship between thousands of data points before making an approve/decline decision, and we recommend that retailers base their own decisions on as many relevant data points as possible.
3. Review manually only if SLA is not compromised:
   Retailers need to take the interplay between in-store pickup and manual review into account. Manual review is a great way to approve extremely tricky transactions that automated systems fail to approve. However, heavy reliance on manual fraud review also for “rush” orders, especially during volume spikes, can lead to a poor customer experience. Riskified avoids this problem by creating machine learning models to handle in-store pickup order, and by ensuring the system is set up so that retailers always meet SLA requirements.

Click and Collect Can Be a Win-Win

Retailers don’t have to accept a trade-off between providing the shopping flows that customers want and protecting against fraud. With Riskified, retailers can both offer the omnichannel options customers expect and avoid fraud with a 100% chargeback guarantee on all approved orders.

To learn more about assessing fraud based on shipping or collection methods, read our shipping eBook. To see the impact Riskified can have for retailers across markets and verticals, see our success stories. If you have any questions, reach out to sales@riskified.com.