BOPIS FraudOnce Again, Criminals Turn a Consumer Convenience Into an Opportunity for Fraud

How the Convenience of “Buy Online Pickup in Store” Shopping Helps Criminals Engage in BOPIS Fraud

Online shopping was a game changer when it first debuted in the late ’90s. For the first time, customers could literally shop from the couch, then have their delivery within a week or two. Later, the introduction of express shipping meant purchases could arrive in just two days, or even less.

The “buy online pick up in store” model (sometimes abbreviated as “BOPIS” or “BOPUS”) offers something even better, though.

BOPIS gives you the ability to make a purchase online and receive your goods within minutes. All you have to do is pop over to the store and claim your items. For example, you can place an order at work, then stop and grab it on the way home, often without even going inside the store. It’s a new level of convenience for consumers… but that doesn’t always make things easier for merchants.

BOPIS has opened a whole new front in the fight against criminal activity. Now, BOPIS fraud is one more thing retailers have to deal with.

What is BOPIS Fraud?

BOPIS Fraud

[noun]/boʊ • pus • frôd/

BOPIS fraud refers to any criminal activity committed through “buy online pickup in store” channels. Here, criminals can pick up online orders at the physical store as a way of bypassing normal security protocols deployed in both eCommerce and physical retail.

Every new development in the retail world seems to introduce a new type of fraud. BOPIS is no different.

As mentioned above, “buy online pick up in store fraud” is a blanket term. Any theft that comes from ordering merchandise from a website, then picking it up at the merchant’s physical store location, can be considered BOPIS fraud.

BOPIS disrupts the traditional online purchase model, and therefore opens up loopholes that merchants and cardholders may not be aware of. BOPIS scammers can then take advantage of the unique characteristics of physical order pickup to bypass normal eCommerce security measures. 

Conventional fraud prevention tools often rely on customer verification techniques that may not factor into BOPIS purchases. For example, checking if the shipping address of a transaction varies from the billing address. With BOPUS fraud, there’s no shipping address to compare against.

The customer will normally be asked to verify their identity at the point of pickup. This might mean nothing more than showing the store employee a screen capture of the order confirmation, though.

How Does BOPIS Fraud Work?

BOPIS fraud offers cybercriminals new opportunities, as well as a way to twist existing scams in order to avoid detection. Some commonly-seen tactics include:

Warning Signs of BOPIS Fraud

There’s no “silver bullet” for catching BOPIS fraud perpetrators in the act. That said, there are a few telltale signs that may signal a problem worth investigating:

Tips & Best Practices for Preventing BOPIS Fraud 

Once a BOPIS fraudster pulls their scam, there’s little chance of tracking them down and recovering the goods. To prevent loss, merchants must either stop crooks before they come to collect their order.

Catching the fraudster before an order is placed may involve a software solution that compares the given data against user blacklists, card status, geolocation, and other indicators. Merchants should review orders that show fraud red flags, such as multiple orders using the same payment credentials but requesting BOPIS at different physical locations.

Merchants should also be on the lookout for high-risk products. Gift cards, electronics, luxury goods, or other large ticket items are all hot targets, as they have great resale value. Watch for bulk orders, as well as the rate at which orders or attempted orders are initiated within a specific time frame.

Catching fraudsters during the pickup generally requires implementing and adhering to strict protocols. This means mandating identification at time of pickup, for example, and ensuring it matches billing identity and order contents. Requesting both a valid government-issued ID and the card used to place the order offers another level of verification. 

Controlling access to the pickup area, when possible, can also encourage closer examination of orders. Make sure the area is well-lit, and possibly employ cameras. Above all, train staff to be consistent when releasing BOPIS orders, and do not leave them unattended.

BOPIS & Chargebacks

When fraudsters run a BOPIS scam, merchants lose the merchandise from the order. In cases of last-minute order cancellations, they could also lose any amount they refunded to the fraudster.

But, the consequences of BOPIS fraud get much worse.

Consumer victims of credit card BOPIS fraud will likely contact the bank to file a chargeback. That means that on top of all the other losses, the retailer will also have to refund the customer, then pay chargeback fees imposed by the bank. Over time, it will also affect the merchant’s chargeback rate, leading to higher costs and penalties.

This is still only one of the types of fraud that card-not-present merchants deal with. For example, customers sometimes file illegitimate chargebacks on merchandise they actually collected. This compounds the price that merchants are already paying. True fraud prevention and mitigation requires a more comprehensive approach. 

Want to get a better picture of fraud mitigation and chargeback management help that goes beyond BOPIS? Talk to the experts at Chargebacks911® about short- and long-range solutions.