Fraudulent activity might be underway when multiple factors are true during a card-not-present transaction.
First-time shopper: Criminals are always looking for new victims.
Larger-than-normal orders: Because stolen cards or account numbers have a limited life span, fraudsters need to maximize the size of their purchase.
Orders that include several of the same item: Ordering multiples of the same item increases a criminal's profits.
Orders made up of “big-ticket” items: These items have maximum resale value and, therefore, maximum profit potential.
“Rush” or “overnight” shipping: Crooks want these items as soon as possible for the quickest possible resale and aren’t concerned about extra delivery charges.
Shipping to an international address: Most goods from fraudulent transactions are shipped to fraudulent cardholders outside of the U.S. Visa AVS can't validate non-U.S., except in Canada and the United Kingdom.
Transactions with similar account numbers: Particularly useful if the account numbers used have been generated using software available online (e.g., CreditMaster).
Shipping to a single address, but transactions placed on multiple cards: Could involve an account number generated using special software, or even a batch of stolen cards.
Multiple transactions on one card over a very short period of time: Could be an attempt to "run a card" until the account is closed.
Multiple transactions on one card or a similar card with a single billing address, but multiple shipping addresses: Could represent organized activity, rather than an individual at work.
In online transactions, multiple cards used from a single IP (Internet Protocol) address: More than one or two cards could definitely indicate a fraud scheme.
Orders from internet addresses that make use of free e-mail services: These e-mail services involve no billing relationships, and often neither an audit trail nor verification that a legitimate cardholder has opened the account.