Practical Fraud Prevention

Chapter 8. BORIS and BOPIS Fraud

I went down to the sacred store…

Don McLean¹

This chapter looks at the fraud associated with Buy Online, Pick up In Store (BOPIS) and Buy Online, Return In Store (BORIS) programs. Within these definitions, we’re including the curbside options made popular due to the COVID-19 pandemic, looking specifically at the additional risks that came with pandemic practices. This is because they’re relevant at the time of publication, and because, given the convenience of the option, we suspect a lot of BOPIS/BORIS programs will become permanent features of the retail landscape.

The great advantage of BOPIS, from the fraudster perspective, is that it circumvents the shipping challenges discussed in the previous chapter. If you’re picking up an order in a store or a distribution/fulfillment center, you don’t need to provide a shipping address, which means fraudsters don’t need to work out a way to use an address that matches the billing address of the payment method they’ve stolen. They just go pick it up at the store.

Some companies will accept a credit card with any billing address without further checks, as long as it’s from the right country. They know good customers often order goods to pick up near their work, which may be far from their home address; and sometimes use BOPIS to send items to family members or friends, or alternatively, have family or friends pick up the parcel for them so that it will be there when they visit. They may do this because ...