Retailers cautioned to make "MOTO” transactions more secure

Credit card payments with card details taken over the phone or by mail are called MOTO transactions – Mail Order Telephone Order. 

While a convenient solution when a customer isn’t physically present, these kinds of payments carry extra risks because there’s no way to prove that whoever called or posted  the card details is actually the rightful cardholder. 

Westpac Senior Risk & Scheme Compliance Manager Meagan Arderne says there are some security risks that are unique to Mail Order Telephone Order (MOTO) transactions. 

“Understanding your responsibilities when accepting this type of payment can help ensure that you are conducting business with legitimate customers and minimise the risks,” Arderne says. 

What happens if the rightful cardholder disputes the transaction? 

If a dispute is raised for a MOTO transaction, the liability to prove the cardholder authorised the transaction shifts to the merchant. This means the merchant will need to produce evidence that the rightful cardholder made the payment. If the evidence provided is insufficient, the merchant will be liable for the chargeback and may have to refund payment received for the goods or services that may have already been delivered. 

Stolen card details used for shipping scam. 

Arderne said Westpac’s Fraud team recently encountered a case in which scammers contacted a business to place a large order that needed to be shipped overseas.  

The scammers provided card details and asked the merchant to take payment for the shipping from the card provided and forward the payment to the shipping company. The accounts given to pay the shipping company were based overseas and had individual names.  

The scammers then put the merchant under pressure saying the goods needed to be delivered before Christmas. Once payment for several thousands of dollars had been made, it turned out that the shipping company was fake, and the "shipping costs" paid to the fake company were part of the scam – leaving the merchant out of pocket with no way to recoup the costs.  

Beware of these red flags: 

• Urgent orders. Fraudsters will often want their illegally obtained items as soon as possible for quick resale.
• Requests to send goods to overseas addresses. Pay extra attention to orders that need to be shipped out of the country.
• Requests to send goods that are not part of your core business. A fraudster may ask you to add on additional items e.g. gift cards for a specific store – which may not be core items you sell to customers. 
• Changing contact details. For example, if your customer changes their email address or phone number at any point during the ordering or payment process. 
• Requests to pay another company on the customer’s behalf. Look at who the contract is between. If it’s not you and the other company, then it may not be a genuine order.  

Reduce the risks: 

• Know your customer. Be mindful who is calling and if they are regular customer of yours. 
• Do not keep credit card details. Once you have processed the payments, securely destroy the card details. 
• Make your deliveries secure. If a courier delivers the goods, ensure the courier company returns the delivery acknowledgment so the signature of the recipient can be verified. Ensure goods are not left at vacant premises or left with a third party.
• Offer alternate payment solutions. Investigate more secure payment options g. through a payment gateway on your website, instore or direct from account services like Online EFTPOS. 
• Enforce a strict refund policy. Only refund payments back to the original card the payment was made from. 

What to do if you’ve been scammed: 

• If you think the order is fraudulent but have processed the payment, you can make a refund back to the card. Ask your bank to help you with this.
• If you have refunded any other card other than the one originally used for the transaction, contact your merchant bank immediately.
• Make a police report.
• Save camera footage, email correspondence and any recorded phone calls.
• Contact your bank about any other behaviour that you think may be suspicious or just doesn’t feel right.  

We also strongly recommend that you report the incident to the appropriate authorities. They’ll be able to provide advice and use the information to help prevent future attacks.  

•  File a police report.  
• Report scams and fraud to Netsafe.  

Various types of frauds and scams are on the rise. To help New Zealanders stay safe, Westpac maintains a list of latest scams and frauds.

Things you should know. All intellectual property in this document, any trademarks or brands represented in this document or on systems, services and products described in this document are the property of Westpac. Nothing in this document will transfer or shall be deemed to transfer title to that intellectual property. The content of this document is intended for information purposes only and you should use your own judgment regarding how such information should be applied in your own business. We make no warranty or representation, express or implied, regarding the accuracy of any information, statement or advice contained in this document. We recommend you seek independent legal, financial and/or tax advice before acting or relying on any of the information in this document. All opinions, statements and analysis expressed are based on information current at the time of writing from sources which Westpac believes to be authentic and reliable. Westpac issues no invitation to anyone to rely on this material.