Lots of people do it: take credit card orders over the Internet, by mail and by phone. A few years ago, Ruth Erb, owner of the 22-year-old Book People in Richmond, Va., a general bookstore carrying new and used books, began doing mail order, never suspecting how prone the process was to fraud, or how hard it would be to detect. Although the 2,100-sq.-ft. neighborhood store doesn't have a Web site of its own, it receives orders through Abebooks.com.
Most of Book People's Internet orders are small. So last summer when Erb received four orders totaling nearly $10,000 for 270 Bibles and 31 electronic handheld Bibles to be shipped to Nigeria, she told PW, her first thought was "a nice piece of business."
At the time, business was so slow that Erb stopped drawing a salary. By year's end, the store finished 8% down. Unfortunately, the overseas purchases that Erb counted on to help pull up sales had the opposite effect. And she learned a lesson in credit card transactions—and the fine print on her contract with First Data Corp.'s merchants services division, which processes them—that she won't soon forget.
It's not necessarily true, that once a credit card purchase is approved, it's approved," Erb said, emphasizing her most important concern for other booksellers. Pointing out the insecurity of the system, she continued, "When the order is authorized via electronic gizmo, or terminal, all the credit card company knows is, it's a valid card. When you get an e-mail order or phone order, you cannot check I.D."
In October, two months after receiving the initial order for 80 Bibles, air shipping the first three orders at a cost of more than $900 and wiring a partial refund of $800 to the customer who placed the fourth order when he complained that it was taking too long, Erb was notified by First Data that both Visa cards used for the purchases—drawn on a London bank—were stolen. Not only was Book People responsible for all the charges, but First Data withheld several thousand dollars above and beyond the cost of the fake orders for four months. "In case, they told me, the store should go under," she said. "That was quite a surprise."
Since then, Erb has been avoiding large orders on the advice of her insurance company: "Don't accept an order for more than you can afford to lose." Now, when she receives a credit card order by phone or e-mail, she calls to get the name of the bank that issued the card. "It doesn't work as smoothly as it sounds," she explained. "English banks won't work with dealers directly and tell us to have someone from the credit card company call."
One practice Erb recommends for phone orders is to ask the customer to turn over the card and give the numbers on the back. People who have stolen the card number from a receipt don't know those numbers. For in-store purchases, she advises, "Check I.D.s if there's the slightest doubt. Approved by your machine is not the final word."
Although orders that are too good to be true usually are, there can still be happy endings. When Erb's local newspaper, the Richmond Times-Dispatch, wrote about the store's losses from credit card fraud, local librarians, authors and customers got involved. "It's a dusty, crowded, little old-fashioned bookstore," said Erb, who was touched by the outpouring of support. "I thought I was just doing something to please myself. Then something happens, and people say they need you and want you. That you're important to the community."
The day after the news story appeared, Erb found a $20 bill that had been left by a customer deliberately next to the register. Soon afterward the Richmond Friends of the Library called to ask if they could throw a fund-raising party for Book People at the store. That was in mid-December, and at the beginning of February donations were still coming in. True, the contributions have not made up the full amount the store lost. But they've come close enough that in January Erb could afford to pay herself a salary again.
