Buy Online, Pick Up In Store: What Is It and How to Prevent BOPIS Fraud

The global Buy Online, Pick Up In Store (BOPIS) market, including the closely related Buy Online, Pick Up at Curbside (BOPAC), is experiencing substantial growth, with projections indicating a staggering reach of over $700 billion by 2027. In 2022, U.S. shoppers notably contributed to this trend by spending over $95 billion through BOPIS transactions, accounting for 9% of total eCommerce sales. The United States stands out as the leader in the pickup economy, boasting the largest market share globally. The significance of this shift is underscored by the 2023 Global Digital Shopping Index, revealing that nearly one-third of U.S. consumers, approximately 16 million people, opted for in-store or curbside pickups for their recent online purchases — a remarkable 37% year-over-year increase. This evolution in consumer behavior signals a dynamic and accelerating reliance on BOPIS services, shaping the landscape of contemporary retail.

Buy Online, Pickup In Store (BOPIS) is a retail strategy that allows customers to purchase products online and then pick up their orders at a physical store location. This approach combines the convenience of online shopping with the immediacy of in-store pickup, providing customers with flexibility and faster access to their desired items.

Here’s how the BOPIS process typically works:

1. Online Ordering: Customers browse products on the retailer’s website and make their selections. They then proceed to the checkout and choose the “Pickup In Store” option.
2. Store Selection: Customers can often select the specific store where they want to pick up their items. This is particularly useful for retailers with multiple physical locations.
3. Order Confirmation: After completing the online purchase, customers receive an order confirmation, often via email or text message. This confirmation includes details such as the order number, pickup location, and instructions.
4. Store Notification: The store is notified of the order, and staff members prepare the items for pickup. Some retailers use dedicated BOPIS counters or designated pickup areas within the store.
5. Customer Pickup: Customers visit the selected store and go to the designated pickup area. They may need to provide identification or the order number to verify their identity.

BOPIS offers several advantages for both customers and retailers:

• Convenience: Customers can save time by avoiding shipping delays and the need to wait at home for deliveries.
• Shopper Safety: This also helps alleviate any concerns around package theft — which is especially common during holiday seasons.
• Immediate Gratification: Shoppers can get their hands on the purchased items more quickly, especially if they need them urgently.
• Cost Savings: Retailers may save on shipping costs, and customers can avoid shipping fees or minimum purchase requirements.

In order for BOPIS to be successfully implemented, merchants need to ensure they have an efficient order fulfillment system, accurate inventory management, and clear communication with customers regarding pickup procedures. It’s important for retailers to have a seamless online-to-in-store experience to enhance customer satisfaction.

Buy Online, Pickup In Store fraud, also known as click-and-collect fraud or curbside pickup fraud, occurs through traditional fraud tactics. BOPIS transactions have a 7% attempted fraud rate, compared to 4.6% for other purchasing methods. One of the biggest risks is that somebody other than the purchaser will walk into the store and pick up their order. While retailers implement security measures to prevent fraud, it’s essential to be aware of potential vulnerabilities. 

Here’s how fraudsters commit BOPIS fraud:

• Stolen Credentials (Payments Fraud): Fraudsters may gain unauthorized access to a customer’s payment information by stealing login credentials through phishing, hacking, or using previously breached username and password combinations. This can also include fraudsters using stolen gift cards. They’ll use the legitimate customer’s credentials (credit card information) to place BOPIS orders and, without the customer knowing, go pick up the item themselves. 
• Account Takeover: Once fraudsters have access to a customer’s account, they may change the pickup location to divert the order to a location where they can pick it up themselves.
• Fake Accounts: Fraudsters create fake accounts using false information to place orders for in-store pickup. This can include using fictitious names, addresses, and contact details.
• Social Engineering: Fraudsters may attempt to manipulate or deceive customer service representatives into changing pickup details or releasing orders without proper verification. This can involve impersonating the legitimate account owner.
• Order Interception: Criminals may attempt to intercept order confirmation emails or text messages to gain control of the pickup information or modify the order details.
• Stolen Devices: If a customer’s device is lost or stolen, someone else might access their account and place fraudulent BOPIS orders.
• Collusion with Employees: Internal fraud can occur when employees collude with external actors to manipulate the BOPIS process. This may involve employees releasing orders without proper verification..
• Geolocation Spoofing: Sophisticated fraudsters may attempt to spoof their geolocation to make it appear as if they are near the designated store for pickup, even if they are not. They can then work with a fellow fraudster to coordinate the pickup.

To mitigate BOPIS fraud risks, retailers must continuously update and enhance their fraud prevention measures. This includes implementing multi-factor authentication, monitoring for unusual patterns or behaviors, educating customers about account security, and providing thorough training for employees involved in the BOPIS process. Regularly reviewing and adapting security protocols is essential to staying ahead of evolving fraud tactics.

Here are some strategies to help prevent fraud in BOPIS transactions:

• Identity Verification: Implement a robust identity verification process for customers picking up orders in-store. This could include requiring customers to provide identification (e.g., driver’s license, ID card) that matches the name on the order.
• Order Confirmation: Send detailed order confirmation emails or text messages that include essential information such as the order number, pickup location, and items purchased. This helps customers verify the legitimacy of the communication and their order details. Leveraging multiple channels (i.e., both email and text) to verify BOPIS orders can help minimize the chance of a fraudster intercepting all of a shopper’s communication.
• Limit Changes to Pickup Information: Restrict the ability to change pickup details, such as the store location, after the order has been placed. This can help prevent unauthorized individuals from redirecting orders.
• Secure Online Transactions: Implement strong authentication measures during the online ordering process, with a solution like NoFraud, to ensure that the person placing the order is authorized. A strong fraud prevention solution will make it easy for legitimate shoppers to make purchases while blocking fraudsters. It should include mechanisms that allow for all of the below in a way that is seamless to the shopper:
  •  Payment Verification: Use advanced payment verification tools to detect and prevent fraudulent transactions. This could include, though should not be limited to, address verification systems (AVS) and card verification value (CVV) checks.
  • Monitor Unusual Behavior: Implement systems to monitor for unusual or suspicious behavior, such as multiple orders from the same account in a short period or orders with different billing and shipping addresses. NoFraud’s robust AI models learn from your business and continue to improve its fraud prevention mechanisms that are continuously tailored to each individual merchant’s needs.
  • Geolocation Verification: Use geolocation services to verify that the customer picking up the order is in the vicinity of the selected store. Unusual location patterns could be an indicator of potential fraud.
• Employee Training: Train store staff to be vigilant and follow established protocols for verifying customer identities during pickup. Provide clear guidelines on what to do with orders where there’s suspicious activity.
• Review and Analysis: Regularly review and analyze transaction data to identify patterns or anomalies that may indicate fraudulent activity. A lot of fraudsters operate large-scale schemes that can go undetected when just looking at individual transactions. This proactive approach can help in the early detection and prevention before bigger schemes get out of hand.
• Feedback Mechanism: Encourage customers to provide feedback on their BOPIS experiences, including the pickup process. This feedback can help identify any irregularities or concerns that need attention.

Preventing fraud in the ‘Buy Online, Pickup In Store’ model is crucial to maintaining the integrity of the process and ensuring a positive experience for both customers and retailers. By implementing a combination of these strategies, retailers can strengthen their BOPIS fraud prevention measures and create a more secure and trustworthy experience for customers. Regularly updating and adapting these measures based on emerging threats is also crucial in maintaining the effectiveness of the fraud prevention system.