Blocking a credit card transaction.. what wording do you use?
Hello,
Authorize.net has a feature if your site declines a credit card due to fraud suspicion.
You can have it say something very general like:
"Your order has been received. Thanks for stopping by!"
Or you can have it say something more specific like:
"Your order is currently held pending a security review".
You can also type your own response the declined-customer will see.
The words aren't exactly right above (I'm doing this from memory). But the basic idea is this:
The first one doesn't tip-off that a security filter was tripped. This disguises your fraud detection settings from hackers, which is good. But the downside is this: a declined-customer might think the order went through, when it was only "received". Then they will angrily call the credit card company when they don't see their product. Then the credit card people will say there is no such order. Then the customer will call you. Then you tell them their order was declined. Then they get mad. Then you want a vacation.
The second one above lets the customer know that the order is pending and under review. This is good because the customer knows they should not expect their product yet. But the downside is that hackers can see that whatever they typed in tripped the filter. This gives the hacker information regarding the transaction behavior of your site.
I was wondering how any Warriors go about structuring this customer-declined response based on their experiences of what they found to work best.
Authorize.net has a feature if your site declines a credit card due to fraud suspicion.
You can have it say something very general like:
"Your order has been received. Thanks for stopping by!"
Or you can have it say something more specific like:
"Your order is currently held pending a security review".
You can also type your own response the declined-customer will see.
The words aren't exactly right above (I'm doing this from memory). But the basic idea is this:
The first one doesn't tip-off that a security filter was tripped. This disguises your fraud detection settings from hackers, which is good. But the downside is this: a declined-customer might think the order went through, when it was only "received". Then they will angrily call the credit card company when they don't see their product. Then the credit card people will say there is no such order. Then the customer will call you. Then you tell them their order was declined. Then they get mad. Then you want a vacation.
The second one above lets the customer know that the order is pending and under review. This is good because the customer knows they should not expect their product yet. But the downside is that hackers can see that whatever they typed in tripped the filter. This gives the hacker information regarding the transaction behavior of your site.
I was wondering how any Warriors go about structuring this customer-declined response based on their experiences of what they found to work best.
Was mich nicht umbringt, macht mich stärker