This weekend I placed an order for a part from an online retailer ($300-400). Shortly thereafter I received an email from their sales team saying something similar to the following:

Hi, we have received your order #12345 and it has been triggered by our fraud alert system. Please send us a copy of your drivers license and credit card used in the transaction. You my black out any personal details like the DL# but please leave the last 4 digits of the credit card, name, and address.

This is no different than presenting your ID in a brick and mortar store. Thank you for your cooperation, blah blah blah.

My response to them was basically:

Hi, I would be happy to perform any verification through the bank issuing the card but unfortunately do not feel comfortable sending copies of my DL and credit card via email to an online retailer.

Their response basically reiterated their first email, but insisting that they already had all this information anyways and just needed to verify it. So I ended up cancelling the order and buying the same part from a different retailer. They are indeed legitimate retailers. Their name bounces around the forums without any issues and I found them, they didn't find me.

My question is, did I make an issue out of something that was reasonable for me to comply with?

A few points that crossed my mind:

1) I've had "fraud alerts" on my credit card before when making a larger than usual purchase. They come in the form of an email from my bank asking me to confirm whether I made a given purchase or not. Sometimes they even require that I call in to verify. This "fraud alert" was only from the retailer. My bank did not raise this issue.

2) As far as I'm concerned, I should never take a picture of my credit card. Even if I block out the important details, the original photo probably got synced to the cloud which means I have to go make sure it was deleted everywhere and trust the our google/apple/amazon overlords did indeed delete it. I'm sure there's ways to mitigate this, but it every hoop I jump through is an opportunity for mistakes.

3) If I was a fraudster, I'm pretty sure I could fake a credit card and corresponding ID via Photoshop that I could take a crappy photo of with my phone and satisfy them. I don't think there's much security in their process.


Yeah this sounds really sketchy to me. Good call on trusting your gut here. Fraud detection like that would obviously usually happen on the bank side. If for some reason the retailer were doing heavy fraud detection (which, for a store selling items of presumably smaller value, would surprise me), then asking for a copy of your identification without telling you what triggered the fraud alert smells weird. It may have been legit - after all, they did instruct you to obfuscate the valuable parts of the image - but not giving details is weird.

  • Why do you think that the fraud detection was done by the retailer and not by the payment provider used by the retailer and thus implicitly by the bank=? – Steffen Ullrich Nov 27 '18 at 17:53
  • It seems there are 3rd party fraud detection companies that do the heavy spying for retailers and produce a risk level for the retailer to decide whether or not to process the transaction. – YetAnotherRandomUser Jan 9 at 21:05

This is rational response. Better be safe than sorry.

Any goods purchase that contains the delivery address (software purchase may not have the info) that similar to your credit card is verifiable by the issuer.

Point 1 is not always true because it depends on the level of escalation, i.e. the middleman like Visa/Master/AMEX may have a delayed clearance issues with the bank. So the logical way to deal with this is calling the bank support.

Point 2 is valid, you should never send a copy of your credit card/ID to through email. At minimum, the merchant should at least provide an encrypted web interface to let you upload it. If they cannot do it due to cost and commission issue (some payment gateways are pretty expensive), then they should ask you to contact your bank than performing such shady process, even it is legitimate request.

  • I'm not clear on which response you are saying is rational. – YetAnotherRandomUser Jan 9 at 21:07
  • OP say : My response to them was basically..... – mootmoot Jan 11 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.