Web Verification

This section will discuss how manual reviewers search for customers’ details on the internet and use these to differentiate between genuine or fraudulent transactions. Web verification is a powerful tool used by manual reviewers, particularly when mobilising platforms like Google Search and Google Maps as well as social media websites as actors. While Google Search provides access to many websites and platforms, where customers’ order details can be compared to their original data, Google Maps provides images of the housing and location of customers. As Dupont (2008) points out, Google Earth provides good quality images which can be used to examine the housing or the neighbourhood of a customer and then to categorise them as genuine or fraudulent. Fraud then results from the outcome of how this practice is performed and which other actors are mobilised, what data are accessed and how these relate to personal perspectives and understandings of fraud.

The following quotes illustrate how often Google is utilised by manual reviewers for fraud assessments and as a support for individual or collective decision-making:

I use Google every time, and of course it helps me with my work (Agent, 23 Female).

I use Google very much (Agent, 35 Male).

141

Probably every time, when I work on an order (Agent, 25 Female). Rather every 10th _{or 15}th _{[order], I try to avoid it, just to come to a quick}

decision (Team Leader, 33 Male).

As the quotes indicate, Google Search and Maps are used by all members of the team, albeit with varying frequency. As discussed previously, not being able to know factually whether a transaction is fraudulent creates a major challenge for manual reviewers. Google is used to overcome this challenge in the hope of finding an external actor who can validate and confirm that the customer has indeed provided their own data and they are indeed who they say they are. This is a particularly important point because of the uncertainties created in the digital environment whereby fraudsters easily impersonate others.

From the fraud management perspective, a customer verified through the websites and platforms accessed in Google is a good and reliable customer. These customers are then classified as trustworthy and considered genuine, which not only affects their current transactions, but also other online orders in the future. The following quote shows that this practice is used to verify the data provided in the order details:

You have the possibility to verify them, and then it is even easier for us (Senior Agent, 46 Male).

In this case, Google also becomes a means of comparison between the personal and transactional data of customers on online retailers’ databases and additional sources accessed through Google. The verification is performed by searching customer’s details on Google, such as names in relation to the city, while looking for consistencies or inconsistencies between the datasets generated through the ordering process and other websites accessed through Google.

I try to verify the customer via the Web, which means looking up the name, surname and the city (Agent, 22 Female).

First, I look for the name and if I can relate it to the place (Agent, 55 Female).

142

As shown above, this is a relational process whereby some parts of the data are looked up in relation to other parts while searching for matches. Customers are then categorised as genuine or fraudulent based also on whether Google can “confirm” that the person is who they claim to be, for example when Google search results also indicate that the customer is resident in the city shown in the order details. Another key part of the data used for Google Search is the email address. Customer email addresses as provided in the order details are usually Googled to search for similarities. Customers are considered genuine when Google Search results lead to specific websites where there are the same data, or combinations of the same datasets can be related back to the customer.

Similarly, manual reviewers also look up customers’ phone numbers to verify them through digitally available phone books or other sources. When the customer’s phone number is listed, for example in a phone book, they then examine whether there is a match between the phone number provided in the order details and the phone book. The quote below exemplifies how customers’ data are looked up and related to other datasets and how fraud emerges from the combination of the data and personal preferences:

There are rarely cases where we do not search for anything. I would

cancel something because I don’t like the email address, but then I find

the name, or I find the customer in a directory, well, in a phone book in

France, and then I say okay, the email address is a bit weird, but hadn’t

I search for it [the email], I would get a ticket [cancel the order] (Agent, 25 Female).

In addition to Google Search, manual reviewers also frequently access popular social media platforms such as LinkedIn or Facebook to verify customers. Some fraud management tools have a direct link to some of these social media websites, thereby creating a more convenient search option for fraud agents. Social media platforms are usually accessed to find matches between internal and external datasets and also to gain access to additional private and work-related data. For example, while LinkedIn provides insights into the current and past occupations of the customer, Facebook enables manual reviewers to investigate the private aspects of customers,

143

such as the name of their current partner, and use them to categorise genuine or fraudulent customers.

As an example, one of manual reviewers suspected a customer of fraud because the order details included two different names. As discussed in the previous section, any inconsistencies in the data are labelled as suspicious. However, the order was accepted after viewing the customer’s Facebook account, as it displayed the two names emerging in the order details as two people who were in a relationship. In this case, Facebook was considered as the validator. This case also shows that inconsistency in data is not labelled as fraudulent as long as Facebook or any other source can confirm that these two people are related or well-known to each other.

The following quotes show how social media is mobilised by manual reviewers as an external source to verify customers and how reliability and trust are generated through external validators:

I mostly find customers on LinkedIn or Xing. These are reliable sources (Agent, 22 Female).

I generally search for the customer. It is very helpful when I find the customer on LinkedIn or Facebook and when I am sure that it is really this person (Agent, 26 Female).

However, verifying the customer can still be challenging despite the results offered by Google Search or access to social media platforms, because there can be on the one hand many people with the same names and overlapping details, so the order may be related to a person with similar data, and on the other hand customers might not be clearly identified because social media accounts do not always display the real names and identities of users.

Furthermore, a clear verification does not always lead to a positive label:

He had different prices, for example five cards for 40 Euros and 15 cards for 100 Euros [The price for stolen credit cards on a fraudulent website] (Agent, 27 Male).

144

This quote represents a rather unexceptional case whereby the email address provided in the order details was linked to fraudulent activity on a different website. In this case, the order was labelled as clear fraud and the person was blacklisted so that he could not place any other orders in the future, at least not using the same order details. Nevertheless, “verified” customers are usually considered to be reliable and trustworthy, given that the verification through Google Search or social media accounts often serves as proof that the customer must be who they claim to be.

Furthermore, manual reviewers also frequently use Google Maps as an external resource for accessing additional data. As discussed extensively in Chapter Four, customers living in wealthier areas and in good housing are much more likely to be identified as genuine as opposed to people who live in less wealthy areas, blocks of apartments or areas with a high percentage of ethnic minorities.

If I have doubts and such pictures come up, then no chance. Then I cancel and ask customer service to send us tickets to verify him before we lose money. Then he can replace the order and we will release it (Senior Agent, 46 Male).

As the quote indicates, Google Maps is used to view customers’ housing and the areas in which they live, to reinforce the initial categorisation of the customer or to challenge it. In this case, pictures displayed on Google Maps were considered as a support for the initial assessment.

Furthermore, manual reviewers use Google Maps to gather additional data on customers’ billing and shipping addresses and use these to categorise them accordingly. Particularly, they examine the distance between the billing and shipping addresses while assigning more trust to customers with a short distance between both addresses. While there is no definition of how small the distance needs to be to be considered genuine, the greater the distance between the two addresses, the more likely customers will be labelled as fraudulent.

Overall, address assessment contributes significantly to customer assessment. Manual reviewers ground their views of good or bad housing and area on the assumption that people living in “good” areas are more likely to have sufficient funds

145

to make legitimate purchases. While Google images of the housing or area are particularly important, as also previously argued, housing needs to be considered in relation to other datasets and the variations they construct. The following quotes illustrate why Web verification is so important for manual reviewers:

We have problems when we can't find customers, which makes it difficult to work. That's reason enough (Agent, 23 Female).

Without it, this process is not possible (Agent, 26 Female).

Both quotes display the importance of external sources of data with which manual reviewers aim to access more information to make fraud decisions. This means that data that are not generated in the ordering process and do not relate to online transactions are additionally collected and used for fraud examinations. As Kitchin (2014a) previously noted, in these cases the data are repurposed, as fraud agents utilise additional private information for a different purpose.

This practice, however, raises serious ethical concerns, because on the one hand customers are unaware that companies Google them, access their social media accounts, look in phone books and so on and use this information to categorise them as genuine or fraudulent, and on the other hand such methods have discriminatory consequences. However, as Collmann and Matei (2016) point out, ethical concerns are often ignored when performing data-driven practices, which is also reflected in the views of fraud management team members:

In this time of global information, you cannot hide anything (Senior Agent, 46 Male).

If somebody cares about data protection, he must keep himself off the internet, or think about what he publishes there (Agent, 55 Female). No, it is their own information which they themselves put on the

internet. It’s their own Facebook accounts. They want to be public. I

146

Everything that I don’t want others to see, I do not put on the internet, and everything on the internet is for the public. […] We only use the

information which everyone can see (Team Leader, 33 Male).

I think they also accept being on the internet, because on LinkedIn, they decide themselves to open a LinkedIn account, or a Xing or a Facebook account. They decide themselves to appear in the phone book or not. When you open an account on the internet, you also have to know that that information is accessible to everyone – and really to everyone – for any reason and any purpose (Agent, 22 Female).

Here it is written in the terms and conditions. Your personal data will be checked by a specific bunch of people. If you have problems, do not order with us (Agent, 26 Female).

If we pointed it out at the time of ordering, some customers of course would be scared away (Supervisor, 41 Male).

We enquired about the whole thing. We don’t access non-public

sources. We also don’t summarise the data and capture them in a new database. This means that we only access public sources, to get an image (Client Manager, 38 Male).

There seems to be some consensus amongst the team members that people create accounts on the internet and these can be legitimately accessed for different purposes. Although companies might “inform” customers of their terms and conditions, in that some orders may be declined, customers are not openly informed about the process, and so it seems that questions on data protection and issues of privacy become irrelevant to address. As Friedewald and Pohoryles (2016) point out, an individual’s understanding of privacy is shaped and influenced by technology. Google is so essential for fraud management that there is no room for concerns about customer consent or implications of a digital “background check”. In fact, the right to privacy could simply mean for the customer that they cannot be verified on the internet, albeit the decision will more than likely result in cancellation. Customers

147

simply need to provide access to their data and be transparent about who they are, in order to be considered genuine. The next section will examine similarly how phone validation is performed by manual reviewers as the second major external approach of verifying customers through a phone call and then categorising them as either genuine or fraudulent.