• Obtain real time authorization from a credit card company. This ensures that the credit card has not been lost or stolen and is a valid credit card number. However, this process does not tell a merchant if the person is authorized to use the card. Therefore, other tools may be needed to help verify that the transaction is a good one.

• Employ address verification systems, but understand the limits. Address verification systems match the billing address provided by the customer with the billing address on file with the card company. If these do not match, this may be a red flag that the person making the transaction is not authorized to use the card. However, these systems are not foolproof. A merchant may receive a large number of unmatched addresses and only a very small percent of these transactions may actually be fraudulent. And, fraud still occurs in cases where addresses are matched.

• Use credit card verifications codes. Merchants should ask for the non- embossed code that American Express and other credit card companies put on their cards. These codes do not get printed on any receipts and are therefore harder for fraudsters to accurately reproduce.

• Purchase rule-based detection. Using detection software, merchants can screen each transaction to see whether it meets certain pre-defined criteria. If it does, the merchant might decide to manually review the transaction or to deny it. Criteria might include billing addresses that don’t match, very high dollar transactions, an order for an unusually high number of one item or names and credit card numbers that have been linked to fraud in the past.

• Purchase predictive statistical models. This software culls data from large, historical databases to create a profile of what typical fraudulent transactions look like. Based on this knowledge, mathematical formulas are developed that can be used to predict the likelihood that an incoming transaction is fraudulent. Again, these models concentrate on patterns such as high volume orders of certain merchandise and addresses that don’t match.