LinkPoint fraud verification on "Address number"

[Stachel]

I'm implementing a shopping cart in LinkPoint via LinkPoint API. Fraud verification includes a check on what they call "Address Number"

For a billing address, I want the user to be able to simply enter:

Name
Address Line 1
Address Line 2
City, State, Zip

and *not*

Name
Address Number: Address Street:
Address Line 2
City, State, Zip

because
1) I think that is LOTS more confusing, and I'm already drowning in emails.
2) When I've used other online stores, I've never had to enter address number separately, so I don't want to do something so non-standard! But I *do* want to check for fraud verification.

However, LinkPoint fraud verification seems to want me to pass it "Address number". So, if customer's billing address is: 1234 Happy Street, this means I have to pass it just: 1234 (If I'm interpreting all this correctly)

How do other linkpoint customers who care about fraud verification do this?

Stachel

[stymiee]

You are interpreting it correctly. AVS only requires (and uses) the digits of the street address (also known as the house number).

You should be able to use a regular expression to separate the address number from the rest of the address. Or, depending on the programming language you are using, you can just pass the entire address to a built in function which will do the work for you (usually the function just turns a string into a integer and returns all numbers until it finds a string). Then passing it on will be easy and not require you to make a separate field for it.

What programming language are you using?

[Stachel]

Thanks John! Am using PHP.

Stachel

[stymiee]

Good, PHP is a language I know. :)

Try passing the street address to the function intval(). It should return the numbers only. Example:

$fulladdress = '123 main street';
$numbers = intval($fulladdress);
echo $numbers; // should be 123

The only thing to keep in mind is if $fulladdress starts of with anything but a number it will return 0 and not the house number so you'll need to check to make sure you have the right value before passing it the LinkPoint gateway.

[Stachel]

Originally Posted by stymiee

Try passing the street address to the function intval(). It should return the numbers only. Example:

Wow, thanks so much John!

Hey you have some excellent websites there!

Stachel

[stymiee]

You're very welcome and thank you for the kind words. I hope that all works out for you. If you have any problems just let me know.

[Stachel]

John do you know if there is a Linkpoint discussion group?

I didn't see one that Linkpoint sponsors.

I found this forum by googleing "Linkpoint discussion forums"

Stachel

[stymiee]

I actually don't know of one specifically geared for LinkPoint simply because LinkPoint offers support for their gateway (well, I am assuming anyway) and the sales agents who sell them usually provide support as well (well, they should). Plus sales agents would rather sell you their own gateway services then help you try to implement yours.

Your best bet is to use a community of developers or a community dedicated to merchant services and related topics for assistance.

[jestep]

Just a word of caution. I'm not very familiar with how the linkpoint gateway works in comparison to to other gateway's. But, if you are able to, you may want to validate only using the Zip code, and flag orders that have an incorrect street address.

In my experience and several large ecommerce customers we have, when you screen on both the street and the zip, you will get a large number of declines, because people don't know or often slightly mistype the street address of their credit card. A better way to do it, is to flag incorrect street orders, and pass orders that verify both the street and the zip.

Obviously if linkpoint doesn't support doing that, it wont work, but defeintely check your declines frequently to see if you are getting a large umber of incorrect street address matches.

[Stachel]

Originally Posted by jestep

In my experience and several large ecommerce customers we have, when you screen on both the street and the zip, you will get a large number of declines, because people don't know or often slightly mistype the street address of their credit card. A better way to do it, is to flag incorrect street orders, and pass orders that verify both the street and the zip.

Thanks much jestep, it is great hearing from someone with a lot of experience doing this. When the process "flags" the order, the customer does not see a decline then, right? Instead, it goes into a special queue? Then does the order taker send email to the person, or how is the flag resolved?

Stachel

[Stachel]

John:

<?
$str = "123 Hello";

echo intval($str);
?>

returns 123.

<?
$str = "Hello 123";

echo intval($str);
?>

returns 0, because it finds the string part of the variable first.

So, someone paying using "P.O. Box 5555"
might not pass...

Is there another way to use intval() so that would work ?

Stachel

[jestep]

Thanks much jestep, it is great hearing from someone with a lot of experience doing this. When the process "flags" the order, the customer does not see a decline then, right? Instead, it goes into a special queue? Then does the order taker send email to the person, or how is the flag resolved?

Yes. The idea would be to make the payment pending, until it is reviewed for legitimacy. You could email or call them. Sometimes it may have been an AVS error, and the address was fine all along. The way that most businesses see it, is that a simple review is better than a decline, because they may still have a sale and a good customer.

You could try this for removing the alpha characters from your string:

$new_address = ereg_replace('[^0-9]', '', $old_address);

You may need to play with it a bit because some people may put more numbers in the address than just the street.
EX: 2600 Via Fortuna, Ste 240

You would end up with 2600240.

[stymiee]

Originally Posted by Stachel

John:

<?
$str = "123 Hello";

echo intval($str);
?>

returns 123.

<?
$str = "Hello 123";

echo intval($str);
?>

returns 0, because it finds the string part of the variable first.

So, someone paying using "P.O. Box 5555"
might not pass...

Is there another way to use intval() so that would work ?

Stachel

Stachel,

Try this code. Basically what it does is look for cases where the result of intval() is zero and then looks for numbers at the end like for a PO Box. If it doesn't find numbers at the end it sets $number to 0 and you can then ask the customer for a proper address. I'm a little busy today so I haven't tested it to make sure it works with every scenario so if you can think of one where this fails let me know and I can code around it for you. :)

<?php
$str = "P.O. Box 12345";
$number = intval($str);
if (!$number)
{
    $number = preg_replace('/^.*\b(\d+)$/i', '$1', $str);
    if (!is_numeric($number))
    {
        $number = 0;
    }
}
echo $number;
?>

[stymiee]

I just got home and wanted to expand upon my code a bit for you to make sure it makes sense. I've added some comments and additional code to hopefully do just that.

<?php
$str = "P.O. Box 12345";

// If the address is in 123 Main Street format get the numbers and ditch the rest.
// This format is the most common by far so we'll do it first.

$number = intval($str);

// Now we'll check to see if we got a real number. If we didn't $number will be 
// zero and cause our check to fail.

if (!$number)
{

    // If we're here $number = 0
    
    // Let's try to get numbers from the end of the string in case it is a PO Box
    // or a rural address (i.e. RR 101). We'll use a regular expression for this.
    // visit the PHP PCRE page (http://us2.php.net/pcre) and 
    // preg_replace()(http://us2.php.net/preg_replace) page.
    
    $number = preg_replace('/^.*\b(\d+)$/i', '$1', $str);
    
    // Let's check to see if we got a real number. If we didn't $number will be
    // zero.
    if (!is_numeric($number))
    {
        $number = 0;
    }
}

// Let's check to see if we have a valid number yet. If not, let's assume the user
// Has entered a bad street address and tell them to correct their error. This check
// will fail if $number is set to zero. 

if ($number)
{
    // Do whatever you need to do to pass this to the gateway.
}
else
{
    // Somehow tell the user they have made an error and possibly inform them of
    // what you are expecting a good address to look like
}

?>

[stymiee]

I'm not sure if you are still needing help with this but I improved it even more and I think this is the final solution.

Change:

$number = preg_replace('/^.*\b(\d+)$/i', '$1', $str);

To:

$number = preg_replace('/^.*?(\d+).*$/i', '$1', $str);

This new one will automatically look for the first group of numbers and extract it from the address. So, now no matter where those numbers are, at the beginning, middle, or end, it will find it and extract it.

[Stachel]

John, Jestep,

Thanks so much! Will give that a try tomorrow.

I am completely amazed at the very helpful and specific replies here. Am so glad you turned up first on Google!

One piece of bad news about LinkPoint that I just learned - their fraud checking doesn't work with international credit cards!

Right now I'm using PayPal as a credit card processor, and that helps minimize fraud.

What do you people do for Intl credit cards if they use LinkPoint?

Stachel

[Sarimner]

I am not up to speed on regular expressions. How would you reverse the above code? Since the address line remains unmodified the number would be sent twice.

Thanks!

[jestep]

What do you people do for Intl credit cards if they use LinkPoint?

Do you know how many foreign orders you take right now?

For some countries I would not do business with at all. My black list would include Nigeria, Malaysia, Indonesia, The Netherlands, and I would be extremely careful with any orders from third world countries. As petty as it may seem, there is so much fraud that it wouldn't be worth the risk. Otherwise, manual reviewing is probably the only way to do it.

I wrote a blog about a year ago on tips to recognizing fraudulent transactions. It might be of interest to you: What does a fraudulent transaction look like?

[stymiee]

Originally Posted by Sarimner

I am not up to speed on regular expressions. How would you reverse the above code? Since the address line remains unmodified the number would be sent twice.

Thanks!

The address line remain unmodified because it is assumed you will want to save the full address for other reasons (like shipping). When communicating with the gateway API you can send over the variable holding the house number and then discard it when you're done.

But, if you want to completely strip the remaining part of the address out of the string just use this line of code: $str= preg_replace('/^.*?(\d+).*$/i', '$1', $str);

[Sarimner]

I am sorry for being unclear. When I say reversing, I meant to save the non-numerical part of the address. If substr() is used, you have to do it on a case by case basis for whether the number is first, middle or last.

$str = "Foxtrot 643"

$number = preg_replace('/^.*?(\d+).*$/i', '$1', $str);

$number == "643"

$str = preg_replace([...]);

$str == "Foxtrot"

[stymiee]

Originally Posted by Sarimner

I am sorry for being unclear. When I say reversing, I meant to save the non-numerical part of the address. If substr() is used, you have to do it on a case by case basis for whether the number is first, middle or last.

$str = "Foxtrot 643"

$number = preg_replace('/^.*?(\d+).*$/i', '$1', $str);

$number == "643"

$str = preg_replace([...]);

$str == "Foxtrot"

But why worry about the non-numerical part of the string when you still have the whole string stored in $str? No need to to extract the rest when by itself it is worthless. But, if you really wanted to do that, just use str_replace() to remove the number from $str:

$remaining = str_replace($number, "", $str);