Yesterday was a busy day for anti-fraud newsflow plus some good old fashioned web fear mongering.  Don’t get me wrong – web fraud happens and needs to be combated but there is often something shrill and hysterical about the reporting of online fraud, especially in the UK.  “Everyone PANIC!” would seem to summarise the editorial style of quite a few media channels.  Before people lock up their PCs or throw them in the river, they should remember that they are significantly more likely to be a victim of crime and fraud when venturing into the real world than they are when venturing online.

There’s no doubt that education is key in battling web spam and other forms of online fraud and Get Safe Online in particular does a fantastic job of putting out clear, moderate and easy to understand information on how to take care of oneself online.  Common sense recommendations include running regular updates for your browser and operating system, having up to date antivirus, antispyware and firewall software and not responding to unsolicited emails or giving away key personal and account information online.  Often, sites like Get Safe Online recommend third party software vendors, such as AVG or McAffee.

Understandably, reputable online businesses recognise the challenge of building trust and at Arena we work very hard to address potential trust concerns of visitors, such as payment methods and checkout integrity, site security, quality / value / freshness of product, and data protection and privacy policies.  After all, if we’re asking customers to hand over their money without ever having met us face to face, then they will need to be convinced that we are who we say we are and that we’ll deliver on our promises.  We try as much as we can to be clear and transparent about what we do (posting to our blog regularly is part of that…I hope it’s clear that this post isn’t being written by a scammer in Eastern Europe!).  The key is not to slip up as, as they say, “trust is hard to win and very easy to lose”.  Once you have it, do your very best to hold on to it.

It’s therefore incredibly frustrating when a lot of hard work is potentially undone by a company that really should know better – MessageLabs (who were, incidentally, purchased for a whopping $700m by Symantec yesterday).  To explain, last week we sent out one of our regular marketing emails to our subscriber base.  So far so good.  But soon after the send, we started receiving emails from concerned customers.  They had received the following email from their mail client, Message Labs:

Subject: WARNING. Someone tried to send you a potential virus or unauthorised code

Body of email included the following: The MessageLabs Email Security System discovered a possible virus or unauthorised code (such as a Trojan) in an email sent to you.

Possible MalWare ‘Exploit/Phishing-paypal-1054′ found in ’7782603_2X_PM3_EMQ_MH__message.htm’. Heuristics score: 202

Now, I don’t know what you think, but if I received an email like that from my firewall supplier, I’d look very hard at any future communications from Arena and quite possibly unsubscribe immediately. After all, MessageLabs are a $700m company so they must be right, yeah?  Surely, they wouldn’t send out an email that slams a genuine business’s legitimate, opt-in marketing activity so thunderously by mistake?  Big boys like MessageLabs are bound to have complicated checks and balances in place to avoid accidentally torpedoing the legitimate marketing efforts of other organisations.  A web security firm in particular would understand the importance of online reputation and the hard work that goes into building trust.  And in any case, Arena has been sending regular marketing emails every other week for over two years, so no doubt MessageLabs would be able to use characteristics of our mail sends, such as previous send frequency, an unchanged IP address, subject lines etc etc to double check the validity of the send.

Nope.  It was a complete, 100% misdiagnosis by MessageLabs, as they subsequently confirmed.  We learnt that the reason that our email got hammered is that we put the word “PayPal” into the subject line yet we are not PayPal.  Blimey.  Sophisticated stuff.  We had PayPal in our subject line to let our customers know that they could win £10k cash if they paid for any order with PayPal during PayPal’s very generous 10th birthday promotion.

Obviously, customers of large online companies and banks, such as PayPal, can be targeted by spoof emails. However, our marketing email prior to this email also had PayPal in the subject line and email body and there was no backlash.  Also, I find it hard to understand how the word PayPal appearing in our mail can lead someone to imply we’re sending “viruses or unauthorised code”.  A virus would typically be an attachment of some kind, not a word in a subject line. I feel bad for PayPal too – we get way way more fraud from people who pay with credit cards than we do from people who pay with PayPal.  Fraud on orders paid with PayPal is virtually nil.  We much prefer people to pay with PayPal.

One of the first emails we received was in fact from a MessageLabs sales rep (who’d previously bought from Arena and who’d therefore received the MessageLabs warning email direct). His mail:

Please remove me from all your mailing list right away as you are sending viruses.
I can assist you with possible solutions however I was unable to reach your IT department.
MessageLabs Anti-virus solution has a SLA of 100% protection from all known and unknown viruses, phishing, trojans and other forms of malware.

http://www.messagelabs.co.uk/products/

Thank you

10/10 for being a pushy sales rep but frankly this mail was not terribly well received as you can imagine.  You wouldn’t want this guy consoling you if you broke up with your partner. “I’m afraid you’ve been dumped but I’m a pimp – have you considered paying for sex?”.  You’d then be even more upset when you found out that it was this guy that had caused the break up with your partner in the first place.

We also noted that, unlike the careful wording of the automated email sent by MessageLabs’ system, his email did not talk about “possible” viruses but came straight out and said “you are sending viruses” which was patently untrue. A rather terse email exchange followed, as you might expect, though not litigation as might have been the case with our American cousins (we’re too British for that).

In any case, I eventually spoke to the UK’s head of corporate sales who unsurprisingly was more reasonable and sort of / nearly / just about apologetic (although he too did suggest we bought their software, admittedly more tongue in cheek that his sales chasing colleague).  He gave me some spiel about how great MessageLabs is and how they use  complicated predictive algorithms to filter mail which all sounded good but didn’t stand up very well to “very nice, but it was just the word PayPal in the subject line that triggered this mess and you misdiagnosed it as a virus anyway”.

The frustrating thing about this is that MessageLabs has several million installed users in the UK, particularly in big, wealthy organisations, such as the government and banks etc.  These are obviously valuable potential customers and exactly the kind of people we’d love to retain.  Unfortunately we have no way of knowing how many such customers have now had their hard won trust in Arena dented or destroyed by MessageLabs’ misdiagnosis and there is no real way for us to fix this (bar writing this cathartic blog post!).  The chap at MessageLabs said “Sorry” but it’s not going to make any difference.  It’s clearly no coincidence that this email performed far worse than any other we’ve ever sent; it can realistically only be down to our MessageLabs mishap.

Maybe to add insult to injury MessageLabs will read this post and then use some of their freshly coined $700m to blast us right off the face of the earth and have done with it.  Ah well, you live and learn.  They didn’t do it on purpose but it certainly hurt.  I guess no matter how careful you are, there will always factors beyond your control, coming from any and all directions, that might disrupt your business.  The best laid plans of mice and men and all that…

Update: Following the post, we were featured on Mail on Sunday and other popular news channels. Read Mail on Sunday’s article on Arena Flowers here. The Register, one of the UK’s leading technology publishers picked up on our concerns and featured an article about Arena Flowers here. The article also featured on Softpedia, a leading technology related online publisher. Read the article on Arena Flowers here.

Post from: Arena Flowers - Flower Delivery London & UK

Share This Post:

Something we learnt quite quickly after setting up Arena is that, if you run a business then it seems you’re fair game and people will make up outrageous claims to try and get money out of you.  It may be down to the idea that “Well, they’re a company so they won’t bother wasting time refuting anything and they’ll just let their insurance pay up.”  Or there’s the very real fact that insurance companies tend to want to “settle” in favour of the member of the public, all other things being equal.  At Arena, we totally disagree with the “just pay out” attitude and will do what we can to make sure that spurious personal injury claims don’t get paid out as, at the end of the day, it’s a form of theft and it drives up costs for everyone, which eventually means customers.  And no one wants that!

The reason I chose to write this post up is because a good example came up where a bit of driver training saved us £10k on a claim that was about to be paid out by the insurance company.  A while back one of our drivers, “Little Mariusz”, had a small knock on the left wing of his van from a car that pulled into his lane.  There was no damage to our van and only very minor damage to the other car (see below).  The police came and said there was nothing to report and, as our van wasn’t damaged, we had no issue.  The lady driving the other car was fine and walking about for the 20 mins it took to resolve.  So far so good.

We then received a letter from our insurance agent a few weeks later saying that there was a new claim for £10k and could we please respond to it.  When we realised that it was this same incident we were scratching our heads.  What was the personal injury?  Apparently whiplash.  Impressive, given it was a sideways knock at about about 5mph.  We said that this was clearly absurd, it was not our fault and pointed out that this had been agreed, orally, at the time.  Ah, but the other driver has a witness statement, was the response.  Furthermore, on the basis of this witness statement, your insurance company wants to settle in the other driver’s favour (despite the facts at the time saying something totally different). Erm, can we at least see the witness statement first please, was our reply.

When the witness statement came through, it was from an individual who was not present at the scene (he certainly didn’t speak or make himself known to the police or Mariusz during the 20 mins Mariusz was there).  And then when we read the statement, a brilliant moment – the diagram and description above form the main part of the witness statement.  The statement suggests that the witness was standing right next to our van, which he said was in the left hand lane, and that our van pulled out and hit the car, which he said was in the right hand lane.  However, the photos taken at the scene clearly show that our van was actually on the right hand side of the car, not the left hand side, because the damage is on the right hand side of the car, not the left hand side.  So effectively, the “witness”, who claimed to be standing right next to the incident, actually managed to get his story completely the wrong way round.  One would think that if you’re going to invent a witness statement to try and get a personal injury payout, you could at least get the facts in the hokey statement correct!  Mixing up left and right is pretty basic stuff.

Clearly, in most circumstances, you won’t be so lucky to have a fake claim against you be so clearly falsified.  What to do in these circumstances?  Well, given, as mentioned above, that insurance companies will typically just “settle” unless you can prove that a claim is fake, it pays to follow a few basic steps to in the event of an accident.  Here are the simple things that we ask our drivers to do in the event of any collision (on the basis of advice from our insurers and our own additions) – every driver has a sheet with these instructions in their van at all times:

• Obtain contact, vehicle and insurance details of other driver(s).
• Obtain contact details of any witnesses.  It is important to get witnesses as otherwise fake witnesses can appear at a later date.
• Take lots of photos, of vehicles, witnesses, registrations etc. Lots! Photos don’t cost money and the one you thought might suffice might be blurry.  Take lots!
• Take the name and badge number of any police officer that attends the scene.  Even the suggestion of police involvement can cause chancers to melt away, as we’ve seen before.
• Do not admit responsibility (even if it’s your fault), especially not in writing, as you could then be liable for any subsequent damage to the vehicle in totally unrelated incidents.  Admitting responsibility can be a bit like writing a blank cheque. Just stick to the facts without expressing an opinion. Insurers will determine liability and this can vary depending on circumstances.
• Do not proceed with non-urgent repairs until permission has been granted by insurers.  An inspection of damage may be needed.

Another key is not to be British and say “no harm done, off we go” and neglect to take the above simple steps as your politeness could cost you a lot afterwards.  The above is hardly rocket science but it can save a huge amount of money, for both businesses and individuals.  A small ding on someone else’s car (their fault) could have cost us £10k and very nearly did.  This is not small beer and would undoubtedly have pushed up the insurance premium for every one of our 9 vans when our policy was up for renewal. It would have cost us thousands.  Hopefully, in the unfortunate event that you’re involved in an incident, following the same steps could save you money (and hassle) too.

PS as ever, the disclaimer is that we’re not a legal firm so don’t take the above as watertight legal advice.  They’re just our internal guidelines which we thought might be of interest. :)

Similar Posts: If you liked this post you may find our other post How to Beat Illegal Car Clamping Scammers – And Save £300 and our other posts on fraud and ne’er do wells interesting.

Post from: Arena Flowers - Flower Delivery London & UK

Share This Post:

Recently we were on the receiving end of an attempted hustle by some fake wheel clampers. They’d immobilised one of our vans and were refusing to take the clamp off unless we paid £300 cash there and then. No credit cards allowed because of “possible fraud”. That set our own fraud alarm bells ringing and, after some investigation, we called the police who agreed to come down. When our hustlers heard the police were coming, they rapidly removed the clamp from our wheel, jumped in their car and sped off.

And what kind of car did our scammers jump into to make good their escape? Only a Jaguar X-type like this one! Clearly the scam pays well, or perhaps they often need to leave the scene of the crime in a hurry! Unfortunately for them, their getaway wasn’t quick enough to prevent us taking down their vehicle registration number and passing it on to the police.

So, if any of you ever have a similar situation, here are our top tips to avoiding being scammed by fake clampers:

• The code of practice relating to clamping says:
  • Maximum standard charge: £75 (maximum charge if unpaid £150). Parking company’s name, address and phone number must be displayed in car park and on ticket. So our £300 is way over this £75 figure.
  • Unfortunately, if your car is parked on private property, like ours was, clampers can still charge you whatever they like to remove the clamp. If you believe you have been overcharged, you have to make claim in a civil court as breaking this part of the code of practice is not a criminal offence. Obviously, if the clampers are not legitimate and working for a real company, then you’ll have no one to take a claim out against!
  • Parking rules must be clearly displayed. Here is the very poor effort on the wall of the car park where we parked – it looks as though it had been stuck up that same day. Note it’s missing the company’s address, which the code requires to be shown.

  

  • The phone number must connect with a person, not an automated payments system. The number given on the rules went through to a voicemail, with no indication of company.
  • Staff to wear uniform and carry ID. They must not escort drivers to cash machines.
  • TOP TIP: All clampers must be licensed by the Security Industry Authority (SIA). Any unlicensed clamper is committing a criminal offence and the police would arrest any such individual.

Having gone through the above list getting increasingly suspicious but with our con artists sticking resolutely to their guns and demanding £300, we finally rumbled them on the ID point. Only one of our clampers had any ID (pictured above) but when we checked it (by calling the SIA on 0844 892 1025 and on the SIA’s website) we found this was not a genuine SIA number and therefore that this was definitely a scam.

At this stage we called the police for the second time and they were happy to come down now that we’d established that the clampers were acting illegally. By this time our rogues had started to lose their nerve and said they would accept £150 instead of £300 (which then dropped 5 minutes later to £100), as “the tow truck has broken down so we can’t tow you”. We declined their kind offer saying we’d prefer to discuss it with the police officers who were on their way down from the local station.

Funnily enough, 2 minutes later our “clampers” decided they didn’t want a nice chat with a police officer and made good their escape!

With thanks to www.penaltycharges.co.uk, which was where we found the code and which helped save us £300!

Post from: Arena Flowers - Flower Delivery London & UK

Share This Post:

We are constantly surprised by the number of people who attempt to make fraudulent orders on our site. Fortunately for us, we have a series of sophisticated security checks which bring most of these to light before we send them out – it is a constant battle and one that we are determined to win, not only for ourselves but also to try to minimise the distress to people who have had their cards used for these transactions.

There are two types of fraudsters that we seem to encounter – the people who place huge orders for cases of vodka or gin and no flowers – after all we are a flower company! – and those more professional fraudsters who operate on a much larger scale and who place orders for women they have met on the internet dating sites.

We in Customer Service have the job of contacting the intended recipients and find it very worrying how many women have met apparently perfectly charming men on internet dating sites; they are very often ‘American business men’ who travel frequently overseas. They ply these women with flowers and wine and chocolates and send messages declaring undying love. Then business starts to take them to Africa on business. Once there, they seem to have the worst possible luck which involves asking these women for money to help them out of hostage situations or to pay large cheques into the UK bank accounts for them to pay hospital bills for their grievously ill family members. These women are not in the slightest bit stupid but these men are really sophisticated fraudsters and for them it is a big and very profitable scam.

Mind you, some of these men are rather less sophisticated and perhaps not that intelligent; our star so far is a gentleman who went under the pseudonym of ‘kingfatsmith’ – really a soubriquet of which to be proud – who, using a stolen credit card, was trying to send international flowers to a friend in a Police station in Ghana. We’re not entirely sure if the intended recipient was a member of staff or a resident of one of the Police cells. Sometimes, we find it hard to be sure if an order should be processed or not, but on this occasion we had no doubts!

Post from: Arena Flowers - Flower Delivery London & UK

Share This Post:

Hot on the heels of Jackie’s post last week about a customer suing his regular florist for the princely sum of £750k (for revealing his infidelities), today we read this headline: “Interflora website ‘rips off’ customers“. For an industry that brings happiness and joy, love and best wishes, it’s certainly been a grim seven days for certain players in the world of flower delivery. On the other hand, if true, it sounds like Interflora may have been pretty idiotic in their (alleged!) behaviour and the way they’ve (allegedly!) treated their customers so we shouldn’t have too much sympathy for them. The customer is king and should be treated like royalty. Businesses only have themselves to blame if they forget that.

We’re currently rebuilding our checkout, to allow returning customers to pass through the site more quickly and efficiently. How? Well, the key thing is not having to re-enter the same information each time you visit. Eg all your previous addresses and delivery instructions will soon be available with a single click in check out. I’ve seen it working on our development server and it’s very cool. More importantly, it’s intuitive, easy and quick.

Another idea relates to taking regular payments from customers. This is potentially a gigantic can of worms (as Interflora has found out) and something we are approaching with extreme caution. We’re taking lots of advice from the payments experts at PayPal on this front so we work out exactly how to do things before we even think about building something. A customer’s trust is hugely valuable – it’s hard to win, very easy to lose and almost impossible to win back. Trust is one area that we hope we never, ever mess up and we go to great lengths to avoid even the possibility of any problems.

We’ve got some other cool ideas but if we told you what they were, we’d have to kill you! While Interflora might be busy beating off the unwelcome attentions of the Financial Services Authority and the Office of Fair Trade, we still don’t want to give them, or anyone else, a head start on our new ideas. You’ll just have to come back to the site over the next few weeks, try the checkout and see if it’s changed. If it hasn’t, well just buy your partner that dozen red roses bouquet anyway! :)

Post from: Arena Flowers - Flower Delivery London & UK

Share This Post:

Whilst a little retiring compared to the other girls in the customer service team, Meriem is good on the phones and always makes it known when she is on to a good call (she sits behind me). Recently, in her own unique way (jumping up and down and waving as if to guide a Boeing 747 in to land) she indicated that she’d hooked a good’un.

She casually said “oh, the one hundred red roses bouquet, yes, we can deliver that for you today” in the manner of someone who routinely arranges for one hundred grand-prix roses to be arranged into the largest bouquet we make.

To put this into perspective, the bouquet is half the size of her and literally weighs a ton! Don’t believe me – take a look: 100 red roses.

The call continued and the other girls began to take interest as Meriem expertly coached the young man on the phone through the process. Having established the details of the recipient she then proceeded to take the card details. The first card attempt failed and so the young man put his friend on the phone who was apparently happy to foot the bill for him. By this point my suspicions were raised and I expected the second card attempt to also fail. 100 red roses don’t walk out of our door without the appropriate fraud-checking scrutiny from Will. However, the card details did go through…

Stunned, we wrote to our Irish friend, Barry, over at PayPal who is kind enough to double check that big payments look OK. He checked the account in question and came back with – there is no history of fraudulent activity on this card – which was music to Meriem’s ears (more jumping).

The flowers were made and I was enlisted to take this picture of the flowers just before they were delivered.

An “unauthorised use of card” charge back was issued a month later…

Post from: Arena Flowers - Flower Delivery London & UK

Share This Post: