This weekend I placed an order for a part from an online retailer ($300-400). Shortly thereafter I received an email from their sales team saying something similar to the following:

Hi, we have received your order #12345 and it has been triggered by our fraud alert system. Please send us a copy of your drivers license and credit card used in the transaction. You my black out any personal details like the DL# but please leave the last 4 digits of the credit card, name, and address.

This is no different than presenting your ID in a brick and mortar store. Thank you for your cooperation, blah blah blah.

My response to them was basically:

Hi, I would be happy to perform any verification through the bank issuing the card but unfortunately do not feel comfortable sending copies of my DL and credit card via email to an online retailer.

Their response basically reiterated their first email, but insisting that they already had all this information anyways and just needed to verify it. So I ended up cancelling the order and buying the same part from a different retailer. They are indeed legitimate retailers. Their name bounces around the forums without any issues and I found them, they didn't find me.

My question is, did I make an issue out of something that was reasonable for me to comply with?

A few points that crossed my mind:

1) I've had "fraud alerts" on my credit card before when making a larger than usual purchase. They come in the form of an email from my bank asking me to confirm whether I made a given purchase or not. Sometimes they even require that I call in to verify. This "fraud alert" was only from the retailer. My bank did not raise this issue.

2) As far as I'm concerned, I should never take a picture of my credit card. Even if I block out the important details, the original photo probably got synced to the cloud which means I have to go make sure it was deleted everywhere and trust the our google/apple/amazon overlords did indeed delete it. I'm sure there's ways to mitigate this, but it every hoop I jump through is an opportunity for mistakes.

3) If I was a fraudster, I'm pretty sure I could fake a credit card and corresponding ID via Photoshop that I could take a crappy photo of with my phone and satisfy them. I don't think there's much security in their process.

  • If a fraudster can photoshop their ID and Credit card, I'd be happy to get fooled by them. Most of fraudster don't know anything and they just place large orders with stolen credit card, they don't even type well when responding to emails (looks like copy paste) and it will make you much sadder to know you a fraud scheme has gotten you from someone who probably a kid trying to score some free stuff. – Mohammed Joraid Feb 1 at 21:34

Yeah this sounds really sketchy to me. Good call on trusting your gut here. Fraud detection like that would obviously usually happen on the bank side. If for some reason the retailer were doing heavy fraud detection (which, for a store selling items of presumably smaller value, would surprise me), then asking for a copy of your identification without telling you what triggered the fraud alert smells weird. It may have been legit - after all, they did instruct you to obfuscate the valuable parts of the image - but not giving details is weird.

  • Why do you think that the fraud detection was done by the retailer and not by the payment provider used by the retailer and thus implicitly by the bank=? – Steffen Ullrich Nov 27 '18 at 17:53
  • It seems there are 3rd party fraud detection companies that do the heavy spying for retailers and produce a risk level for the retailer to decide whether or not to process the transaction. – YetAnotherRandomUser Jan 9 '19 at 21:05
  • @YetAnotherRandomUser how do you know that the fraud detection was done by the retailer? Maybe the alert came from the payment gateway or a 3rd party fraud detection. E.g. Stripe will put a score of fraud likeability. The merchant then can do whatever they fell like doing. – Mohammed Joraid Feb 1 at 21:38

This is rational response. Better be safe than sorry.

Any goods purchase that contains the delivery address (software purchase may not have the info) that similar to your credit card is verifiable by the issuer.

Point 1 is not always true because it depends on the level of escalation, i.e. the middleman like Visa/Master/AMEX may have a delayed clearance issues with the bank. So the logical way to deal with this is calling the bank support.

Point 2 is valid, you should never send a copy of your credit card/ID to through email. At minimum, the merchant should at least provide an encrypted web interface to let you upload it. If they cannot do it due to cost and commission issue (some payment gateways are pretty expensive), then they should ask you to contact your bank than performing such shady process, even it is legitimate request.

  • I'm not clear on which response you are saying is rational. – YetAnotherRandomUser Jan 9 '19 at 21:07
  • OP say : My response to them was basically..... – mootmoot Jan 11 '19 at 8:08

Those responding here, probably haven't sold anything online and have no idea of the amount of credit card fraud retailers have to deal with.

It is very common to have some fraudster use someone else's credit card to make purchases. Merchants have zero protection in these cases and not only pay for the charge processed as well as a dispute fee. Also, their credit card processor will blacklist them and basically throw them out of business if the dispute rate increases.

So, almost any retailer that processes $1M+ in volume a month will use some kind fraud early warning software. There are plenty in market and they are making a killing as SaaS companies. Once a transaction is triggered as potential fraud, the merchant will attempt to verify via multiple methods.

One of the most common methods employed, is asking for Driving Licence/ID and a copy of credit card with numbers hidden. There is almost nothing anyone can do with this piece of info. You are giving away, nothing confidential. It just proves that you are in possession of the card and your name is on the card. If the charge is disputed, these images can be used to prove that the merchant took an effort to verify the transaction and shift liability. This method is employed by many famous companies: AirBnB, Agoda/Priceline, Lyft used it at one point.

It is not foolproof e.g. someone stealing your wallet with the ID can also complete this verification. Many merchants are willing to take that risk. Wish there was a better way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.