Go to Airtable (https://www.airtable.com) → WC Pending tab under Order Summary.
Right-click the order and select Expand Record.
Copy the customer’s email address.
Open Konnektive (https://crm.konnektive.com)→ go to the Customer Service tab.
Paste the email in the Search field and press Enter.
Review the order details in Konnektive.
Analyze order details for red flags:
CVC issues
Email first seen today
Billing address not matching IP country
IP mismatch
Billing address far from IP address
If suspicion is not flagged automatically, check for recent Airtable issues that may affect detection.
The goal is to only find one account. If you find multiple, with different address profiles, cards, it can mean fraud.
Check by email
Check by name
Check by phone number
Check by postal code and address: Use filters for matches.
Check by IP address: Review for inconsistencies.
NOTE: Use this link to check on IP
Determine if the customer is new or repeat.
Review previous interactions (e.g., welcome calls, voicemails).
Note if previous orders were confirmed or if suspicious patterns exist.
Check if the orders were done with the same card or different ones
Is there a while between orders or do we see large orders happening too quickly?
Call every customer for each new order, even repeat customers.
If not reached, leave a voicemail confirming the order and shipping timeframe (24–48 hours).
If the account is safe, one call/voicemail is sufficient.
If suspicious, document red flags and decide next steps based on the call outcome.
If a customer claims not to have placed an order, tag as fraud and process a refund.
Watch for patterns in affiliate sources (e.g., repeated fraud from a specific affiliate).
If IT flags a source as suspicious, block or refund all related orders.
If not flagged by IT, call each account individually to confirm.
Use filters (e.g., source value) to find all orders from a suspicious source.
Source - Affiliates
If filters do not work, use Ctrl+F to search by source number.
Assign suspicious orders to a specific agent by adding their name.
Use dropdowns to tag orders:
“Suspected fraud”
“WC completed” (welcome call completed)
“Confirmed genuine” (customer confirmed order)
“Low risk after review”
“Hold on VM, WC” (voicemail left after welcome call)
“Confirmed fraud” (customer confirmed fraud)
Note: Tagging is essential for tracking and reporting.
If fraud is confirmed or suspected, process a refund.
If within 24 hours, void the transaction (preferred, as it does not affect refund rate).
For partial refunds (e.g., customer changes mind but keeps order), do not void—process a partial refund instead.
Go to the account, scroll to transactions and fulfillment.
If status is “hold,” click Actions > Cancel to stop shipment.
If already shipped, no further action can be taken.
Special Scenarios and Escalation
If a credit card is issued from a different country and the address is in the US, and you cannot reach the customer, refund the order.
If the card is US-issued and the address matches, do not refund—tag as “low risk after review.”
If unsure, escalate to a supervisor for review: Escalation Form
Note: Communication with IT and the team is done via Slack.
Suspected fraud: Red flags or patterns detected.
WC completed: Welcome call made and completed.
Confirmed genuine: Customer confirmed order is legitimate.
Low risk after review: No red flags, but could not reach the customer.
Hold on VM, WC: Voicemail left after a welcome call.
Confirmed fraud: Customer confirmed fraudulent activity.
Refund: Refund processed.
Void: Transaction voided within 24 hours.
Cancel: Fulfillment canceled.
Use experience and gut instinct in addition to procedural checks.
Document all actions and decisions in the system for transparency.
If a customer contacts you about a charge, tag as “confirmed fraud”, if appropriate.
Name (suspicious name/ machine generated Ex: Jkrtmn Pqzlrk)
Address (street number + ZIP code)
IP address
Phone number
Did I verify the billing address matches the cardholder address?
Did I check if the payment method is consistent with customer location (Ex: US card)?
Is the IP location consistent with the shipping address? (Check via https://whatismyipaddress.com/ or IP Address Lookup | Geolocation)
Did I review for multiple failed payment attempts before a successful one?
Did I verify the phone number/email is valid?
Did I call the customer?
If called, did the customer respond normally (not evasive, willing to confirm details)?
If a VM, and it’s a business, did I google the customer’s name and find a profile of where they are working? Is it matching?
Did I cancel the fulfillment?
Did I void/refund the charge (if applicable)?
Did I leave proper notes in KON?
Did I update in WC – Airtable?