I work at a company with a fairly large number of transactions and we don't really have a problem with fraud. I don't know anyone else who's really battled it either. Is it much more prevalent for certain industries and products?
The scammer orders the item, using the billing address of the legitimate owner of the card, but a shipping address that corresponds with a freight forwarding operation. These places offer a US address, but forward the shipments on to various places, including South America, islands in the Caribbean, etc.
Typically, the legit card owner notices the transaction way after it's shipped, and files a chargeback. As with all "card not present" transactions, the shop owner then foots the bill, including a chargeback fee.
It took about 3 times getting burned before we took the time to put some countermeasures in place. The most helpful were geo-ip location for the purchase itself, and a "flag this for review" filter for anything going to the Miami area and/or anything with a longish suite number, keywords (freight, global), etc.
Edit: Worth noting that most credit card fraud solutions I've seen don't have a way to take the shipping address (as opposed to billing address) as part of the data to check. For the type of fraud noted above, it's vital. Geo-ip doesn't work well when the buyer is using a US proxy, or US based accomplice.
The government-owned postal service in New Zealand, NZPost, run a service known as YouShop https://www.nzpost.co.nz/tools/youshop specifically to allow Kiwis to get access to products that are either only sold overseas, or would cost ridiculous amounts of money to ship via those sellers. They operate by providing a personal address in US, the EU, or China, backed by third-party freight forwarders.
Additionally, it creates issues even with legitimate customers. If the product arrives with shipping damage, there's no way to know if it was caused by our shipper, or the freight forwarder. The customer, though, is quite sure it's our issue to resolve...
That said, it can also be defeated.
For instance, fraudsters that have received a bunch of stolen credit card numbers will want to test which cards are still good. They'll do that by making a small purchase at an online retailer, and if the charge clears, then use the card to get something illegitimately. While you might not be a good target for that second step, anyone that takes credit cards and has weak fraud protection steps will be a target.
What one day looks like an unexpected spike in sales becomes a huge spike in chargebacks later, as all of those sales were fraudulent. I am pretty sure there's been stories in Hacker News about this.
Fraud is not an issue at all for our business SaaS products.
most are buying credit for online services, like online data storage, care.com, etc. and to throw a curve ball, they created yahoo account with my first name plus extra characters and created a subscription to USA today, verified with my fake yahoo account, and sent it to my home.
it happened after I went out with friends to a bar and they had my Amex and ID on a tap.
Cards stolen online typically come with the CVV2 and billing data that makes online fraud easier. At one time the Secret Service would analyze patterns in purchases to identify which merchants had been compromised. They wouod identify large databases of cards that had been compromised and would turn that information over to the card issuing bank. Given the cost of reusing the cards most banks would chose to mark the cards for additional surveillance instead of re-issuing the cards. At a conference one bank executive said that 20% of cards in the portfolio were marked this way.
The net is that if you carry five cards it's probably that one is in the hands of a fraudster already.
What sucked is that the charity would then be charged a fee when the card holder reversed the transaction.
This costs the charities a lot of money in chargebacks and man power in dealing with it. Stripe's offerings here could prove invaluable in this scenario.