Fraud's cost measured in (red) ink

If you had to name the unluckiest business start-up in the country, Stinky Ink (stinkyinkshop.co.uk) would be a strong contender. John Sollars, a Shropshire-based man who left a good sales job to set up the web-based ink cartridge company, lost £32,000 to fraudsters within eight weeks of launching the business.

It was money he could ill afford to lose. After leaving his sales job in April 2002, he had already spent £5,000 buying stock for Stinky Ink, which he launched in late June of that year. After registering the site with online shopping malls, Sollars saw an immediate result: "We started getting orders, and I thought: 'This is great. It's vindicated my decision. These are really good orders.'"

The company was shipping orders all over the country - to places like London, Eastbourne, Brighton and Newark. Typically a customer would put in a small order and then come back with a bigger one, sometimes for as much as £2,000.

After six weeks, Sollars was finding it difficult to pay his suppliers: as a start-up, he had been unable to get a business account with a bank, or a merchant account for handling credit cards.

So he set up an internet merchant account with payment solutions provider WorldPay, which meant that WorldPay would handle the payment transactions for him.

Under the terms of the account, WorldPay agreed to pass payment onto Sollars between four and six weeks after the transaction had been made. In the meantime, Sollars was paying for new stock from his suppliers on three individual credit cards, each up to a limit of £10,000. In mid-August, as he rapidly approached his limit, he phoned WorldPay to see if he could have his money a little earlier.

He was in for a shock: WorldPay looked at the accounts and told him the payments had been found to be fraudulent, carried out on stolen credit cards. WorldPay recommended that Sollars refund the victims: "I said, 'This is my business, this is my life, there's thousands of pounds there.' But they wouldn't give me the cash."

At this point, Sollars read the terms of his agreement with WorldPay and discovered that the company didn't accept liability in the case of fraud. In long conversations with the company, the only advice it could give was that he should pay back the money.

Sollars called in the local West Mercia police, who told him that a crime is committed at the point where an order is placed, so although he was the victim, most of the frauds committed were outside the force's remit. "They weren't interested," says Sollars. He had no option but to remortgage his house and to refund the money. "I have to say I cried," he says. "You're so alone. I just wanted someone to talk to."

Online fraud is rising steeply. According to CardWatch, a UK banking industry initiative that aims to raise awareness of card fraud prevention, losses on card-not-present (CNP) transactions in the UK have risen from £13.6m in 1998 to £150.8m in 2004. An estimated 78% of those losses occurred in internet transactions. Since the introduction of Chip and PIN has made it harder to commit fraud with a physical credit card, fraudsters have been moving to the online world. Unfortunately, it is the merchant who bears the cost.

So, is there anything Sollars could have done to prevent the crime from happening? Chris Barling, chief executive of Actinic, which makes e-commerce software for small businesses, says some merchants are more at risk than others: "People who are selling things that are easily sold on are more likely to experience fraud. If you're selling clothing then that's not so easy to shift. If you're selling digital cameras you might find yourself a target." As a seller of ink cartridges, Sollars was an obvious target for fraud.

Experienced retailers develop a nose for fraudulent orders, says Barling. An order from a Hotmail, Gmail or Yahoo! account - any email account that isn't easily traceable - should arouse suspicions, as should a mobile telephone number. Fraudsters also tend to request the high-cost shipping option and place high-value orders.

It's easy to be duped if you're not alert, says Barling: sometimes fraudsters will put in a genuine, low-value order first to establish trust and then a fraudulent, high-value one later. Always check up on orders you're suspicious about, he says, but don't reject them out of hand - about 10% of orders will look suspicious, and you can't afford to lose 10% of your orders. Above all, exercise caution: "Don't ship an order, particularly abroad, if you can't afford to lose it," he says.

Steven Philippsohn, senior partner at law firm Philippsohn Crawfords Berwald, says Sollars' experience is a common one. Another tactic, he says, is for fraudsters to place an order, and then send a fake email purporting to be from a payment provider such as WorldPay or PayPal, stating that the payment has been processed and that the merchant can send the order. The merchant then ships the order only to find that the payment has not in fact been made.

Philippsohn's advice is simple: "Never send the goods out without getting the money in your account." In Sollars' case, of course, this was hard because the terms of his agreement with WorldPay meant that it took several weeks to credit his account. The answer, says Philippsohn, is to choose a more expensive payment option that carries out more checks and makes the payment more quickly: "The cheaper the package, the more insecure the service."

Credit card companies are taking stronger action too. The Verified by Visa and MasterCard SecureCode schemes, launched in 2002, require cardholders to pre-register use of their cards on the internet, and supply a username and password as part of the registration process. Users then have to enter the username and password each time they purchase something from a participating website. For merchants, it means that the liability for chargebacks is shifted to the card issuer. Take-up is still low (one in nine internet transactions uses Verified by Visa), but Philippsohn believes it will grow.

A spokesperson for WorldPay says the banking system it connects to makes automated checks on each transaction, including verifying the address on the card and checking the card security code (CSC) - the additional digits printed on the back of the card to confirm that the card number provided is genuine. It has also enabled 5000 of its merchants to use Verified by Visa and MasterCard SecureCode. The hard truth is that it is still mainly the merchant who loses out to fraud, so it is up to the business owner to be vigilant.

Luckily, Sollars had the strength of character to bounce back. For 18 months, he worked seven days a week, and made sure the company's name was optimised in the search-engine rankings. Now, says Sollars, Stinky Ink takes 100 orders a day and this year he is predicting a turnover of £1m: "From fairly desperate times we're a proper business now."