Kount LogoBLog Against FraudKount Logo

A Monster Named “TC-40”

posted on: Mon Aug 21 2017

Online businesses with small average ticket totals may be unaware of a monstrous—but mostly unknown—fraud problem until it is too late. Potential victims include:

    • Online game or gaming sites
    • Quick-service restaurants (QSR’s)
    • Music and entertainment sellers
    • Digital goods merchants
    • Nonprofits

Worst of all, this issue could lead to significant fines or even customers being unable to purchase on your website. Imagine this real-life scenario as reported by CardNotPresent.com:

“An online gaming company began to experience a spike in declines. This caused unhappy and confused customers to call their issuing banks. They had more than enough credit to cover the purchases, so why couldn’t they complete the transactions? The banks told these customers this merchant was associated with fraud and the charges were declined for their protection. These customers wanted to pay, had funds to pay, but their bank was not letting them, frustrating both the customer and the merchant.”

Invisible MonsterThis “invisible” monster goes by the name “TC-40,” which refer to claims that get filed against an eCommerce operation every time a cardholder reports that his card has been used fraudulently in a card-not-present transaction. When issuers file TC-40 claims, they get reported to the card brands and all other issuers.

Why is the problem invisible?

A TC-40 claim may not result in a chargeback to the merchant, because there is a cost for issuers to process a chargeback. Thus, many issuers won’t process chargebacks for transaction values under a certain threshold (e.g., $20).

Here’s an example of how the TC-40 monster can strike: a quick-service restaurant targeted by card testers might rack up dozens or even hundreds of TC-40 claims. These small, but repeated, fraudulent transactions are included in a merchant’s Risk Identification Service (RIS) report (issued by VISA) or System to Avoid Fraud Effectively (SAFE) report (issued by MasterCard).  

TC-40 Monster

However, with no chargebacks to alert them what is going on, these merchants may be completely unaware that all these sub-$20 TC-40 claims are piling up.

Suddenly, the online business receives notice from their processor that they are being fined. Or that the processor will stop processing transactions. Or worse, customers start complaining that their credit cards are being declined for no apparent reason.

The merchant is completely blindsided. Fraud? What fraud? My chargebacks are below 1%!

Early warning signs

One way to find out if you are getting hit with “invisible” TC-40 claims is to check your decline log. Filter the declines by issuer and see if any issuers are declining almost all transactions. Some issuers will provide a clue in their decline reason codes (though most just state “general decline”).  

Another way is to contact your processor to see if they track TC-40 claims. Even if they don’t, they may be able to contact the card networks on your behalf and inform you if this “invisible” fraud is taking place.

NOTE: processors provide access to TC-40 data at their discretion, and some may not share this information. More on this below.

One final way is to monitor customer complaints. If you suddenly start hearing from potential customers that their cards are being declined for unknown reasons, this is a telltale sign that TC-40 claims are piling up against you. However, this is the least attractive option as it means that issuers are already flagging your website as high risk. Plus, damage to your brand is already beginning to occur.

Making the “invisible” visible

Larger processors may not be willing to provide TC-40 reports due to costs and/or the fact that the data files can be exceptionally large.Monster Crushed

One sure way to get this information is via chargeback alert services. For example, Kount Complete integrates Ethoca Chargeback Alerts into an enterprise-class fraud prevention solution. With Ethoca Alerts, online businesses are notified as soon as a cardholder reports fraud (i.e., a TC-40 claim). This provides two important benefits:

      1. TC-40 claims are no longer invisible. Online businesses with small average ticket totals can respond quickly to prevent damage to their reputation. Often, the best solution is to issue an immediate refund. By quickly clearing up TC-40 claims, you avoid fines and/or having issuers decline charges.
      2. Stop future fraud. Fraud prevention systems like Kount “remember” the data points associated with these identified fraudulent transactions, and through a combination of Artificial Intelligence (AI), Machine Learning, and rules setting, decline fraudulent transactions associated with the original fraud. This prevents TC-40 claims from entering RIS or SAFE reports in the first place.

If you’re an online business processing transactions with small ticket totals, don’t get penalized for things you don’t even know about. Avoid the TC-40 monster by using fraud prevention solutions like Kount Complete that make the “invisible” monster…completely visible.