Online Insecurity

The Royal Mail has recently been advertising a new service, Decide & Deliver. You can download, for free, a piece of software that will automatically fill out the shipping address when you buy online. The adverts claim that this software "works with all online retailers" although this another page changes this to just "all your favourite e-tailers". Personally, I hope that my favourite sites will have nothing to do with the Royal Mail's loopy idea.

My hope does not stem from a belief that anyone using the word "e-tailer" should be hung, drawn and quartered, although I can see the merits in that argument, but from the following quote.

You can simply select from any of the following:

Your home address, your office, a family member, friend or neighbour.

The Post Office branch near where you live or work - there's 16,000 to choose from.

All this sounds wonderfully convenient, doesn't it? A few mouse clicks, and you can have goods delivered anywhere you want. The problem is that providing such a service is not the post office's decision to make. By advertising their product this way, the Royal Mail is raising the public's expectations, leading them to believe that retailers should deliver goods to any address they, the customer, desires. It is, however, in everyone's interests that retailers do no such thing, for one very good reason. Fraud.

Online fraud is a growing problem, but getting accurate figures on the true scale is almost impossible. Fraud is an embarrassing problem that both retailers and banks would like to keep hidden from the public. My own experience as a web developer, and that of friends in similar positions, suggests that levels of fraud vary widely, accounting for anything from less than 1% to well over 10% of a retailer's online transactions. There does, however, seem to be one factor that significantly increases the risk. All the retailers I am aware of who suffer very low levels of fraud do not deliver except to the cardholder's billing address. Put another way, giving in to the pressure from the Royal Mail (and others) to deliver to any address desired will expose the average retailer to ten times the level of fraud.

Why should you, as a customer, care? Well, most obviously there are the purely selfish reasons. Having someone else's shopping on your card may prevent you from using it, and sorting the problem will defiantly take some time and effort on your part. In theory, you may also be held liable for the first £50 of the fraud, or for the whole amount if you can't prove your own innocence. You may feel that your card will never be stolen, so this doesn't affect you. In reality, theft of credit card details is now so common that if you haven't been targeted yet it is more likely to be due to good luck than judgement. Most credit card thefts are committed by people with legitimate access to your card details. Even if your card never leaves your sight, you are still vulnerable.

In practice, the banks are sufficiently keen to promote credit card use that, unless they are reasonably certain you are an active part of the fraud, they will quickly refund the money, with little argument. Which brings us to the point that should worry everyone interested in shopping online. The banks will normally tell the customer that they refund the money. In the case of a sale in a shop, where a proper signature was obtained, this is true. Online the story is different. Because the cardholder is not present when the sale is made, the bank automatically blames the retailer, who has to pay the whole amount. A 10% level of fraud is paid for entirely by the retailer.

Fair enough, you might say, but retailers make a profit, surely they can afford this? Yes and no. The retailer will make a profit or go out of business. Fraud cuts into the profit margin, so more profit is needed to pay for the fraud. Prices go up. Ultimately, the customer is the only person putting money into this system, so only the customer can pay the costs involved. Competition cannot drive prices below costs. When you shop at any site that allows delivery to an address other than your billing address, 10% of your money is paying for that privilege alone. That may manifest itself as higher overall prices, or as fewer special offers and bargains. However you pay, it is clear that ultimately it is in the interests of the consumer to drive down fraud levels.

Perhaps, however, you feel that the extra cost is worth the convenience of having goods delivered wherever you wish. Perhaps, but the extra cost is unnecessary. The reason that delivering to the billing address is so much safer is that the billing address is the one location that can be verified. The bank can confirm the connection between the cardholder and the address. Other delivery addresses should be verified in the same way. If banks allowed customers to specify alternative delivery addresses they might use with their credit card, and allowed retailers to confirm whether an address was on that list, online fraud levels would drop considerably. To the customer, the resulting system might well look like the Royal Mail's Decide & Deliver, but focused as much on fraud prevention as customer convenience.

So, why haven't we seen such a system? Quite simply, apathy. The Royal Mail does not care about online fraud levels. Anything that makes online shopping appear more convenient will result in higher postal revenue, even if some packages are going to criminals. Equally, the banks care little about online fraud - they pass the costs on to the retailer. Retailers, meanwhile, can do little about it. They can either accept the banks rules, or they can not accept credit cards. The public doesn't care because if they are the victim of fraud, someone else appears to foot the bill. Matters will only change if the government forces the banks to act - which is unlikely - or the public does. If you want cheaper online shopping, ask your bank why you can't register a delivery address with them.

Graham Robinson. 18th December 2002.

archives :: links :: faq :: feedback

Find out how you can support Online Opinion

Online Opinion is a trademark owned by Graham Robinson. All rights reserved. The copyright on all articles, columns, and letters on this site is owned by the original author. The copyright on all other material is owned by Graham Robinson. Permission is granted to download and store these pages for personal or research purposes only, and only as is consistent with normal viewing of web pages. All other rights reserved. Permission is granted to freely link to any page within this site, as long as ownership of the material linked to is clear. No advertisements may be associated with this site, whether explicitly or implicitly, without prior written permission.