Claimed Card Fraud with a Token?

Question

A customer, a reasonably regular one, is claiming that an order on their account was not authorised and is demanding a refund. The order was placed on their account, to their address, using a token payment system. The system sells perishable goods - returning the goods isn't a realistic option as they would be of no use before then.

My question is - what can/should be done in this scenario? Should it be reported as possible fraud to the bank/police? We have the IP address and dates from which the claimed unauthorised transactions took place from.

To explain a bit further:

The order did not go through 3D secure - 3D secure is enabled for the site but is presumably disabled for the customer's card as the payment gateway didn't request 3D Secure authorisation.

An order was placed last month for delivery this month - the system sells perishable goods for delivery on a specific date in up to 3 months time. Indeed the system allows editing an order, which effectively cancels the previous order and places another one, and the customer edited their order twice. Each order / edit would have sent the customer a confirmation email.

24 hours before the order is sent out the customer is sent a reminder in case they want to edit or delay their order. They also would have received an email on the day of dispatch to inform them of the shipment.

The customer emailed after the goods arrived claiming that they did not order them and demanding a refund.

Nothing in our logs indicates that the order is anything but the customer logging in and placing an order. It is going to their address. It could possibly have been placed by someone who was not the customer if someone else had been given their password. Who is at fault in this case?

Answer 1

It sounds like you are reasonably convinced that it was not fraud, but simply the buyer changing his mind. There is no way for us to know, of course, but the evidence you mention (past customer, same IP address, same delivery address, order edited) seems to suggest you are correct.

Some alternate possibilities:

1. Someone else at his house placed the order with his credit card. This is not usually considered fraud. If he does report it as fraud to his bank, they will ask him if he knows who made the charge.

2. An employee of yours forged the order. There is no way for us to know how likely this is.

You are not required to give a refund, of course. You have to decide if it is worth the money. By refusing the refund, you will be angering (and losing) a regular customer.

If you refuse the refund, the customer will likely initiate a chargeback, which will mean a fee for you and an investigation by the bank, which you may or may not win.