Online fraud detection: ‘In the moment’ digital accountability in a data-sensitive setting

Abstract

Recent years have seen significant increases in online fraud. The fact that online fraud represents a major challenge to law enforcement due to its complexities and global impact has led to the emergence of other organisations – such as Customer Service Centres – taking a key role in ‘policing’ fraudulent activities. However, the responses made by these specialist organisations remain opaque and outside the scope of regimes that regulate law enforcement agencies. In this article we address this opacity through our study of a Customer Service Centre that makes decisions on what constitutes online fraud in cases of card-not-present payments. We carefully work through these decision-making processes to explore the immediate pressures made manifest in decisions on fraud around, for example, cost and timeliness. These pressures become apparent in the particular arrangements of accountability and responsibility in decisions on online fraud and cut what might otherwise be lengthy procedures following these decisions. As a result we suggest that accountability in these fraud cases is managed and held ‘in the moment’ within the Centre. The article contributes to our understanding of online fraud and to the growing debate on digital accountability. The article provides avenues for further exploration of the challenges of moving from internal to external accountability in relation to largely opaque and data-sensitive settings where accountability relations are held ‘in the moment.’

Introduction

Online fraud has increased significantly in recent years (UK National Cyber-Security Centre, 2022). In the USA, the Federal Trade Commission has reported a 53% increase in cases of credit card fraud (from 2020 to 2023). ¹ In the European Union, the European Central Bank states that card fraud within its geographical remit now amounts to €1.53 billion, of which 84% is card not present fraud (the most frequent kind of online fraud). ² The UK proportionately has one of the highest levels of fraudulent online activity, including cases of identity theft, data theft and the unauthorised use of others’ credit or debit cards (Office for National Statistics, 2022). According to industry reports, across 10 years (2011 to 2020) card payment fraud in the UK rose by 68% and e-commerce fraud by 170% (UK Finance, 2021). In 2022 alone, it was estimated that around 4.5 million offences were committed regarding fraud and computer misuse in England and Wales (Office for National Statistics, 2022). And over £1.2 billion was estimated to be stolen through fraud from victims in the UK (UK Finance, 2023).

In this article we provide a detailed analysis of a Customer Service Centre focused on detecting fraud in online purchases. Despite a growing literature on the victims of online fraud (see Button and Cross, 2017; Levi, 2017), the responses to fraud made by specialist organisations such as the Centre, remain opaque. This is because the Centre is a data-sensitive setting: personal financial details, possible criminal activity and reputational issues for online retailers are all handled within the Centre. Opacity is thus part of the Centre's core business.

Through agreement with a Customer Service Centre (see Methods section), we address this opacity to open up unique insights into how online fraud decisions are made: what purchases are flagged as suspicious by the Centre's computer system, how orders are cancelled and the actions that do and do not follow; the work done by Centre operatives to build accounts drawing together data within the short timeframes available that enable decisions on fraud to be made; and how these decisions are made in such a way that they can be defended if later called to account. This building of accounts that can be later called to account is, we suggest, the central characteristic of the internal accountability processes of the Centre. However, despite the increasing levels of online fraud and the number of victims involved, we also illustrate the difficulties involved in introducing external accountability to the Centre whereby its decision making processes might be made subject to scrutiny on behalf of victims of fraud. Opacity and data-sensitivity challenge the possibility of external accountability. Instead, a decision-making system that insists the data held within the Centre's computer system is good enough, pressures of cost and timeliness to make swift decisions and a frequent curtailment of further possible actions (e.g. handing cases over to the police), mean that accountability is held ‘in the moment’.

Alongside providing insights into an otherwise opaque, data-sensitive setting, the article also contributes to growing interest in digital accountability: the ways in which digital systems are increasingly called upon to play a part in the distribution and take up of relations of accountability at the same time as these systems face calls to be made accountable. We begin by engaging with the literature on digital accountability, its internal and external orientation, before providing an important note on methodological sensitivity. Our analysis explores how pressures are made visible and tangible in the Customer Service Centre (around time and cost, for example) and how this leads to a focus on ‘in the moment’ accountability in fraud detection. The Discussion and Conclusion sections provide avenues for further exploration of the challenges of moving from internal to external accountability in relation to largely opaque and data-sensitive settings.

Literature

In broad terms, online fraud is defined as fraud with a cyber dimension (Levi et al., 2017). Within the scope of this research, we focus on what is termed card-not-present fraud (Montague, 2010; Wall, 2007) or order fraud (Bamfield, 2012). The current literature on online fraud provides a range of insights on the experience of victims (Button and Cross, 2017; Cross, 2015). We learn from these studies that victims of fraud are frequently portrayed as greedy and gullible and that victims often feel shame after incidents have taken place. This appears to feed into an under-reporting of incidents of online fraud (Cross, 2020) which have also been given a low priority by many police forces and has only become subject to statistical scrutiny in the last few years (Levi, 2017). The fact that online fraud represents a major challenge to law enforcement due to its complexities and global impact (Button and Cross, 2017) has led to the emergence of other organisations – such as Customer Service Centres – taking a key role in ‘policing’ fraudulent activities.

We know from existing studies of similar workplaces that these Centres often involve relatively low pay for employees and high stress levels in making frequent, repetitive and consequential decisions (Boles and Babin, 1996; Witt et al., 2004). Given these pressures, coupled with increasing levels of online fraud, increasing numbers of victims and the growing role of Centres for dealing with fraud that are not operated by the police or subject to the same legislative demands as a police force, it would seem imperative to introduce accountability to this area. But we have few insights on the practices of these Centres or the challenges involved in rendering such Centres accountable.

Turning attention to the growing field of work on accountability can help us to understand the complexities of introducing accountability to a data-sensitive setting like the Customer Service Centre. Accountability broadly conceived involves the distribution of responsibilities for action and mechanisms to ensure that there is some answerability with regard to the adequacy of the take-up of those responsibilities (Neyland, 2016). Bovens and Wille (2021) in their work on ‘external accountability’ (p. 856) and Schedler (1999) in his work on ‘public accountability’ (p. 13), incorporate concerns for transparency, participation, evaluation, compliance, the curbing of abuses, sanctions, answerability and enforcement as aspects of accountability. In both authors’ work a separation between the producer of the account and the body holding that producer to account is noted as vital to the proper functioning of accountability as a mechanism to ensure responsibilities have been adequately taken on by the producer of accounts without ill effects for others.

In recent years scholars interested in technology, have further introduced questions of digital accountability. Digital accountability involves both considerations of the digital mediation of the distribution and take up of responsibilities, how the adequacy of this take up might be assessed and calls for specific digital systems to be made accountable (Neyland, 2019). The latter includes demands that algorithmic systems be held responsible for their consequences (Diakopoulos, 2014) and for governments to hold technology to account (e.g. the Algorithmic Accountability Act, 2022). Following on from the work of scholars like Bovens and Wille (2021) these demands hold the focus steady on external accountability of digitally saturated settings. Calls are made for new technologies to be answerable to the public (Baykurt, 2022) or various transparency initiatives (Neyland, 2007) are designed to assist regulators. Algorithms, surveillance technologies, large scale governmental systems and smartphone apps among other systems have been the focus of calls for adequate legislation, oversight and meaningful recompense for the decision making consequences of these systems. In these calls, we can see that accountability involves questions of who and what is responsible for the distribution, management and decision making of digital technologies and what can adequately render these systems answerable for their consequences (see e.g. Mayernik, 2017; Reddy et al., 2019; Young et al., 2019).

However, accomplishing accountability is by no means straightforward. There is no single point from which to view an entire organisation and its digital operations (Widder and Nafus, 2023). Many digitally saturated organisational settings are opaque (Ziewitz, 2016). Proprietorial concerns often set limits regarding what information is made available about the inner workings of digital decision making processes (MacKenzie, 2018). And settings where sensitive digital data is handled, pose difficult questions regarding the consequences of making data externally available (Neyland, 2019). Following from these concerns, we can say that the internal accountability relations through which these settings operate – how, for example, employees, data and technology come together to establish who and what is responsible for who and what and under what conditions the take up and discharge of these responsibilities might be called to question – can remain somewhat unknown. An interesting challenge that then arises with opaque digital decision making processes where proprietary concerns or worries about sensitive data dominate, is how an understanding of internal accountability relations might be developed and might be used to meet calls for enhanced external accountability (see, e.g. Amelang and Bauer, 2019; Matzner, 2019; Ziewitz, 2016). As Suchman (2002) among others points out, it is through this local accountability that organisations get to make sense of themselves. In this article we will explore the internal accountability characteristic of the Customer Service Centre focused on online fraud in order to shed light on this otherwise opaque environment. We will then consider the challenges involved in shifting from internal to external accountability.

A key starting point for up-close studies of the accountability relations internal to organisational settings has been work in the field of ethnomethodology. Ethnomethodologists have considered interactions as account-able – that is each turn in an interaction can be considered in relation to its ability to demonstrate that it can take responsibility for making sense of previous turns in an interaction and produce further accounts that take part in the on-going sense-making work of the interaction (Garfinkel, 1967; Garfinkel and Sacks, 1970). This form of accountable, demonstrable and on-going sense-making has been oriented towards scientific and technological settings to analyse how, for example, users come to understand a technology or how scientific evidence is made to withstand the rigours of interrogation (Lynch and McNally, 2005; Suchman, 1987; cf Neyland and Coopmans, 2014). For Lynch (2022) these up-close studies of accountable interactions in the workplace are particularly useful for making sense of the ‘canonical procedures, organisational standards and constituent practices’, (p. 115) that lend a distinctive character to each workplace setting.

The distinctive character of accountable relations internal to the Customer Service Centre, alongside its concerns for opacity, derive from its focus on fraud. We can see in previous studies of fraud (Clark and Pinch, 1992; Goffman, 1952) that concealment, revelation and ambiguity often sit centrally. Here then we have a doubling of opacity. Fraudsters seek to evade detection while the Centre, its computer system and its operatives will look to build accounts that bring fraud to light. At the same time, data-sensitivities around financial information, illegal activity and reputational risk for clients of the Centre mean that processes of producing accounts of fraud are retained in the Centre. Concealment and revelation are thus rife. Coopmans (2021) and Coopmans and Rappert (2020) in their study of fakes (a specific kind of fraud) suggest revelation and concealment provide an indication of ‘(1) what, in a given setting, is valued, and (2) how deception and its interception are distributed across ever-changing sociomaterial relations’ (Coopmans, 2021: 77). Those involved in ‘unmasking’ fraud, they suggest, need to provide a warrantable and witnessable account of, for example, a painting as genuinely by a particular artist or indeed a fake so ‘that there is a way out from the havoc wreaked by ambiguity and close resemblances’ (Coopmans and Rappert, 2020: 383).

In our study of the Customer Service Centre, we will need to look at how the Centre's computer system and human operatives come together to produce accounts that cut through the havoc that might otherwise be wreaked by ambiguity. The computer flags to operatives potential cases of fraud (thus emphasising ambiguity) and the operatives are expected to produce an account drawing on data from the system, that enables a decision (allowing or cancelling a purchase) that cuts out any ambiguity. Without resolution to the ambiguity, the Centre would not be able to carry on sensibly with its work. Garfinkel (1967) recognised this difficulty in the accountability of day to day life, that many matters were in some way inconcludable. In order for everyday life to sensibly carry on, Garfinkel suggested participants in a setting would adopt an et cetera clause that recognised that many other questions could be asked but would not be in order to get on with the practical tasks at hand.

In the Centre we will explore how accounts are produced in a way that recognises the potential for, but also tries to eliminate, the need for further questions to get on with the decision making tasks at hand. We will pay attention to the ways in which accounts are produced in the Customer Service Centre that manage to cut ambiguity to make and hold decisions ‘in the moment’. Strathern's (1996) work can be helpful here in addressing how accounts can cut further relations. Strathern suggests that an account of any matter at least in principle is ‘able to take into account, and thus create, any number of new forms’ (p. 523). But in practice this does not happen – things come to ‘a stopping place’ (Strathern, 1996: 523). The question is, how might a potentially lengthy network of relations between people, data and technology be ‘“cut” at a point, “stopped” from further extension’ (Strathern, 1996: 523)? We will need to make sense of the pressures brought to bear upon the employees of the Customer Service Centre to not just account for matters of fraud, but to do so swiftly and in a way that cuts the number of entities involved, the number of relations in play and as a result, cuts out the havoc otherwise wreaked by ambiguity. Here we will draw on Munro's (2004) work on accounts and accountability to understand how accounts are made ‘punctual’ (p. 293). Munro suggests that an account can be produced in time and for a time – the account can be seen to respond to the temporal, not just evidential, demands of the organisational relations through which it is produced.

Via an important note on methods, the article will proceed to consider how decisions on online fraud are made in a Customer Service Centre, bringing to light the ‘in the moment’ accountability relations internal to the Centre. In the subsequent Discussion and Conclusion we will explore the challenges involved in using this understanding of internal accountability to address calls for external accountability in data sensitive settings.

An important note on method

Carrying out this research involved Semire, making contact to negotiate entry into a Customer Service Centre that is based in Germany, but deals globally with fraud. The Centre works on behalf of clients in the retail industry in Germany, across mainland Europe, the UK and in North and South America.

In line with many other organisational ethnographies, getting agreement to research and publish insights into the setting involved back and forth negotiation (Neyland, 2009). It also involved having, if not a gatekeeper, then at least a strong advocate for the research (for more on different types of gatekeeper, see Reeves, 2010). This advocate allowed Semire to have access to the Customer Service Centre and observe the activity taking place. Semire had some prior experience of working in such Centres and she drew on this to establish a working role. Working within such a setting is a potentially valuable means to gain an insider perspective on the nature of work taking place. It also raises ethical concerns about the extent to which knowledge of the researcher-worker is shared among other employees. In this instance we made it clear to other employees that Semire was both working in and carrying out research in the Centre. Employees had the opportunity to discuss this with Semire and raise questions and concerns. This overt research status had the combined advantage of side-stepping the ethical concerns associated with covert research (Neyland, 2009) and enabled Semire to set up interviews with employees in the Centre. ³

Semire carried out 32 in-depth semistructured interviews with individuals in the age range 21 to 56 with an even gender distribution. In total, 19 interviews were conducted with fraud management team members, managers and retail clients of the Centre. Eleven interviews were conducted with Centre operatives with a role in fraud management. Additionally, 2 interviews were conducted with German Police officers who had interacted with the Centre. The interviews lasted between 40 minutes and 1.5 hours. Interviewees were guided by a set of interview questions, but they also had the opportunity to go beyond those questions and cover topics they proposed. The employees handling fraud-related issues at the Centre were selected as possible participants while priority was given to those who played a key role in fraud detection to generate reliable accounts of fraud. Further, key managers and retailers as well as local police officers were included into the sample to present a wider picture of fraud detection practices. These interviews were informed by the ethnographic research conducted by Semire and also provided a range of experiences and viewpoints beyond those of Semire alone. The interviews were transcribed and reviewed in detail, with an inductive coding process used to establish a set of commonly recurring themes in the transcripts. Three of the themes that were most prevalent in discussions of online fraud were: how to build an account of fraud, the pressures of building an account and concerns for accountability. These three dominant themes were then utilised to build the following analysis in this article. Several sub-themes emerged within these dominant themes (around cost and timeliness, for example) and these are also analysed in the following sections.

The Customer Service Centre granted approval for the research to include observations by Semire and to conduct interviews with the employees, if the employees were happy to take part. Semire was also permitted to use the data collected during the study under the condition that no confidential information, or identifiable information about employees, customers, victims, fraudsters, potential fraudsters or retailers was made available. The cases discussed in this paper relate to several different retailers that were supported by the Customer Service Centre. Due to reputational concerns among retailers, particularly derived from being linked to fraud cases, we can only say that all retailers were from the fashion industry. Given the absence of detailed studies of online fraud, its growing importance and prevalence, and the growth in concerns for digital accountability, we were happy to work under these terms.

Analysis

The following analysis is focused on the interview data ⁴ to analyse how accounts of online fraud are produced, the pressures involved and the relations of accountability and responsibility internal to the organisation that shape these actions.

How to build an account of fraud

Training

The Customer Service Centre where we carried out our research works for a number of different retailers (clients) who have an interest in limiting their exposure to fraudulent online purchases. Our point of interest here is in working through how the operatives in the Centre produce accounts of fraud, what shapes these accounts and what happens in any subsequent follow-up actions as a result of these accounts. We use the term internal accountability to refer to this process of producing an account (involving operatives drawing together data from the computer system in the Customer Service Centre) to make a decision on fraud and subsequent processes wherein those accounts and their decisions might be subject to further scrutiny. These accounts demonstrate that an employee has understood and taken on specific responsibilities for action and can, on future occasions, become part of a process of further internal accountability (interrogating the account, its contents, how it was put together and the decision this prompted on possible fraud). We might assume that training provides a foundational element in informing Customer Service Centre operatives how to produce an account of potential fraud and what to include in that account. However, as the following quotes show, training is extremely brief:

It was shown to me at that time by Sheila ⁵ … what we need to pay attention to, and you check that everything is complete, the data that we put together and that's it. Otherwise, we did not have training or anything like that. (Team Leader, 26 Female)

Ms Holmes showed me with what kind of data I must work and how I must process it. It was a one-day induction and then it was okay. (Backoffice Team Member, 29 Female)

We can note here the brevity of training, but we can also start to see some hints of the orientation operatives take to producing accounts. This orientation is provided by more senior members of the team (in this case Sheila and Ms Holmes). These senior members of the team provide something of a basic frame for establishing an account – in effect, what the operatives can look for through the Centre's computer system – and the senior staff provide an initial internal audience for the operatives to consider future occasions of accountability. The senior members of staff provide one grounds for newer members of the team to assess whether or not the accounts and their content are adequate.

Where an alert comes from

Although we might understand this oversight by senior staff as an important adequacy requirement for establishing new team members’ ability to produce accounts, senior staff are not the only audience for accounts. Alerts of potentially fraudulent activity are sent to the Customer Service Centre team and it is up to operatives to adequately respond to these calls for accounts. We still view this as a form of internal accountability as the data that flows between the sources of these alerts and the Centre is heavily controlled – these are not data flows that are opened up for external scrutiny. Depending on the source of the alert, members of the team may find themselves not only having to assess and respond to what they perceive to be the adequacy requirements of senior members of staff in the Centre, but also financial institutions and the police. For example, in the following quote the operative describes how they received a report via the Centre's computer system from a financial institution that a card had been used fraudulently:

We had a case where a credit card institution got in touch and said there are fraud cases related to this credit card. Then we had many customer accounts for that, and we got them blocked. (Agent, 24 Male)

Receiving the alert provided a clear indication of fraudulent activity. The response by the operative to the alert was to cancel current and future purchases using that card. A unilateral decision to cancel is made on the basis that the operative can utilise the alert raised by the credit card company as a sufficient warrant for action (Coopmans and Rappert, 2020; Neyland and Coopmans, 2014). The warrant here provides a straightforward basis for action because it has been received from a credit card company, the alert itself links this card to previous fraud and, should a customer later complain in this case that they have made a legitimate purchase, the operative can say that purchases were cancelled to save the customer from being a further victim of fraud. The operative in any later situation where they might be called to account for their decision by senior staff in the Customer Service Centre or one of their retail clients, can also re-use the warrant in a similar way to show how they have acted to protect the Centre or retailer from fraud. In this case, then, the speed with which the account and the action (to cancel purchases) can be achieved, is related to the source of the alert (a financial institution), the content of the alert (suggesting previous fraudulent activity has taken place using this card) and the warrant that this alert provides in any future moments of accountability (that the operative was acting to protect the customer, retailer and credit card company).

Although we have opened here with a relatively straightforward case of an alert, leading to an account that can be used to justify an action, decision making is not always so straightforward. Alerts sent through by police officers, for example, often arrive in the form of a question, requesting extra information in a potential case of fraud. This requires that operatives must produce evidence for the police:

The police often call us directly. We are basically not allowed to give any information on the phone. Then we ask to send their enquiry via email or mail. Then we forward it completely. (Supervisor, 44 Male)

Once I received an email from an officer and forwarded him all the details, and he requested I give him a call to verify, yeah it is the police, then forwarded him all the details we could find about the order, name, address, where it was collected, how it was paid, etc. Another time the police officer actually called me, and we spoke for about 15 minutes about finding out where the card had been used, the IP address etc., forwarded all the information to them. (Agent, 21 Male)

Both excerpts demonstrate that the Customer Service Centre is called upon by the police to provide details (what was purchased, where, when, addresses, order, names, etc). In these cases the operatives provide nothing more than a putative account and do not suggest any immediate action. The data itself is simply drawn from the computer system and producing the putative account is a matter of straightforward data collection for the most part.

Returning to the work of Coopmans (2021) and Coopmans and Rappert (2020) we can say that the operatives in the Customer Service Centre eliminate the havoc that would otherwise be wreaked by ambiguity by taking the credit card company's alert as an accountable warrant for action or they shift the responsibility for resolving ambiguity away from the Centre and to the police. In both cases, accountability still operates within this closed loop of participants – there is no further external scrutiny of these decisions.

However, operatives are caught between various demands here. They are held accountable and responsible by senior staff who do not want to see fraudulent orders going through (and so the inclination is often to cancel the order), but at the same time operatives know that they might later receive complaints from customers who hold them responsible for incorrectly cancelling orders:

Most of them [customers] are pretty annoyed, disappointed and frustrated by what happened with our e-shop. Most of them say in this case I don't see the point in ordering again. We have difficulties on the technical side at the moment – too much frustration because of cancelled orders without a reason. (Agent, 21 Male)

As a result of being in the middle of various demands, operatives do not always have an easy way to cut out ambiguity that provides a straightforward warrant for future occasions of accountability where their decisions can be questioned. For example, cancelling customer orders is the easiest way to cut fraud, but can also be a source of customer complaint and retailers do not want to lose sales.

People, processes, relations involved

As the preceding analysis suggests, the kinds of accounts produced by operatives in the Customer Service Centre vary according to the source of the alert that they have received. As the following excerpt suggests, having to deal with complex cases and multiple potential sources of information while also carrying out other tasks (in this case answering the phone), can make the whole business of producing an account less straightforward:

It is confusing … In Mexico, the system is not installed properly. It doesn't show the chargeback. ⁶ We have different lists to check the chargeback. You have to copy this number and search. You have to be really concentrated on that, and then the phone rings. You were like, “Oh, where am I?” It happens to me every time, when I have for example five credit cards, four emails, five different Mexican names and I have to compare, and then the phone rings and the customer wants something. […] Then I forget about the Mexico thing and I have to restart again. I forget it and I have to take all these steps once more and the phone rings once more for the third time and you get back to the big case. For me it is not easy. (Agent, 26 Female)

For this operative, cases of potential fraud in their region of Mexico are particularly challenging because she has to move between systems. Possibly relevant evidence has to be copied down from one computer system and then checked against another. But as the excerpt suggests, some potential cases can be very complex when multiple names, addresses, cards and orders are involved. Each potential fraud has to be copied down and checked against another system and accounts produced to give a warrant for any decisions made. In this way the account of the decision must be produced in such a manner that the account is able to endure future occasions in which it might be interrogated (Neyland and Coopmans, 2014). Eliminating the potential havoc wreaked by ambiguity is not straightforward. However, as we will see in the next section, managing ambiguity is also shaped by various pressures to produce accounts.

Pressures made manifest in building an account

Time

One of the key pressures that operatives drew to our attention in producing accounts of possible fraud, is the time available to them. Although all the operatives suggested they were trying to make the ‘right’ decisions, time was oriented towards in different ways as the following excerpts show:

Theoretically, we are supposed to be done with an order within 2 and a half minutes. (Fraud Agent, 26 Female)

I think I need at average between 20 seconds and 1 to 1 and a half minutes. I would say about one minute on average per day. (Team Leader, 33 Male)

In Germany, I need about 30 seconds and in Europe 1 and a half minutes. (Agent, 26 Female)

As we can see here, for these operatives the time constraints were clear and their practices of producing accounts of potential fraud were developed within those constraints. Time here is what Munro (2004) would call a demanding relation that insists accounts and accountability are ‘punctual’ (p. 293). Munro suggests that punctualized accounts can be demanded, produced in time and for a time, responding to the temporal, not just evidential, demands of the organisational relations through which they are produced. Cutting out ambiguity, producing an account in and for the here and now, producing a warrant for future moments of interrogation, can all be understood as responses to the pressures made manifest in the accountability relations of the Customer Service Centre. Several operatives clearly took pride in their ability to produce an account at speed. Even if later questions were asked about a particular order being cancelled or allowed to proceed, the accounts were designed in such a way as to navigate this interrogation. Data would be drawn together in order that a defensible decision could be made ‘in the moment’. If interrogated at a later point, the reasons why the data was used in a particular way (to cancel or allow an order) would be replayed through the account. To be able to operate across timeframes – making a decision now that could be later called to account – the accounts thus needed to be account-able (Garfinkel and Sacks, 1970). That is, the accounts needed to be prepared in such a way that they served the purposes (and further emphasised the purposes) of the Customer Service Centre: the accounts needed to order the evidence into a logic that for all practical purposes and within the timeframe available to hand, could be shown (and relayed again if necessary) why a decision was taken.

As the following excerpt starts to show, the pressures imposed by these time constraints were not always easy to navigate:

But sometimes I have cases where I don't find anything. I then search everything possible and then suddenly 20 minutes gone, and I’ve still not found anything. That's crazy. When you work on a case you absolutely want to find something and then the time passes, sometimes about 10–20 minutes with special cases. (Fraud Agent, 35 Male)

The quote suggests that on occasions operatives find it difficult to produce accounts that order the evidence swiftly into a logic that supports a decision for all practical purposes. Instead this operative tries to produce a more complete account with greater certainty derived from amassing further possible evidence from the computer system. This risks moving beyond the expected time constraints oriented towards by other operatives and by senior members of staff in the Centre who emphasise to operatives that accounts should be produced in around 2 minutes. More in-depth assessments of evidence can be tolerable for exceptional cases or when there are few incoming orders but not as an everyday practice. Not being able to produce accounts ‘in the moment’ has its consequences. Unfortunately, this operative's contract was not extended. Although the reasons for this decision were not communicated, not producing accounts of potential fraud within the required timeframe might have played a crucial role.

Cost

Expected timeframes for producing accounts were not, then, only established in relation to a demand for accuracy. The Customer Service Centre like most call centres is structured in such a way as to reduce costs at the same time as providing a service. In the case of producing accounts of potential fraud, the two demands seem to be balanced against each other. The operatives are called upon to produce a timely account – that is, an account that is on time to produce a decision (e.g. before goods are shipped) and in time (in order that the operative can get on with the next alert). Producing an account of fraud in approximately 2 minutes was considered timely. It worked for all practical purposes in providing sufficient time to order the data into a logic on the basis of which a decision could be made, ambiguity eliminated and multiple further decisions could be made by every operative, every hour.

But costs for the Customer Service Centre were slightly more complex than some other call centres. Every time a decision was made it ought to be made in around 2 minutes (to manage the cost of staff time) but decisions also ought to be correct most of the time (to ensure multiple fraudulent and costly purchases were not approved). As the following excerpts suggest, the costs of fraud were understood in the Customer Service Centre in different ways. First, we can note that for senior staff and retailers there was a broad concern for the cost of fraud:

This year we expect globally for all e-commerce transactions more than 10 billion Euros in fraud associated with cards which is about 0.5% of card associated volume in e-commerce. (Head of Payment Department, 35 Male)

Fraudsters are a small number but have a high impact. 3–4% of fraud cases can cause damage of 8–10%. (Manager E-Commerce/Payment, Male)

Second, the cost of fraud was also understood in relation to the cost of preventing fraud. For example, one of the online retailers who is a client for the Customer Service Centre spends at least 500,000 Euros annually on fraud prevention. This is where the time cost for producing accounts of potential fraud is made manifest:

The system also costs lots of money. The team for analysis costs a lot of money. The colleagues cost a lot. (Account Manager, 38 Male)

Third, financial institutions also have a concern for the costs of fraud. Credit card companies, for example, monitor closely how many cases of fraud are prevented and how often chargeback takes place (when a refund has to be issued). As the following excerpts demonstrate, online retailers can face punishment for failing to deal with fraud:

Merchants are strongly penalised when fraud rates increase. (Account Manager, 38 Male)

As a general rule, I would say if we go over 1.5% chargeback then we have a problem … If you continue to have a major issue for a long period of time, then you will get fines and you can lose your right to process [specific credit cards]. (Payment Director, 39 Male)

[The credit card company] sees every transaction which was processed. They need to protect their name, their brand, their value, and proposition as a pretty safe payment. That is why they make sure that it will not happen and that their brand will not be diminished… At the end they can kick you out, so you are no longer able to process [specific credit cards] for example. (Head of Payment Department, 35)

As Swartz (2020) makes clear, chargeback whereby a refund has to be issued to customers, has become a threat wielded by credit card companies. If the Centre produces too many instances of chargeback – where an order has been allowed to go through, but subsequently found to be fraudulent and a refund issued at a cost to the credit card company – the threat is that the Centre will face higher charges for participating in, or be prohibited from, infrastructures of digital financial exchange. Time and cost, then, need to be finely balanced in the process of producing an account. If too many orders are cancelled, retailers lose out on sales. If too many orders are allowed to go through that turn out to be fraudulent, the credit card companies might punish retailers and the Centre. The timely, punctual ‘in the moment’ account cannot then be a rushed account with no regard for the data in the system. Operatives are placed under pressure to produce accounts in time, but they must also be able to produce accounts that are account-able: that is, accounts that are able to navigate future moments of interrogation. Such interrogation as we can see in the excerpts above could include questions of the timeliness of the account, its cost, its ordering, consideration of data, but also the potential threat wielded by credit card companies to punish retailers or the Centre for inadequately handling cases of potential fraud.

The need to stop an order

The internal accountability relations of the Centre often involve cancelling an order. Such cancellation effectively declares a purchase in that moment as fraudulent. Often it is no more than a continuation of the aforementioned processes of internal accountability. An alert comes through, data is drawn together from the system and an account of potential fraud is produced in such a way that it can navigate future interrogation. At that point an order is cancelled.

This process becomes more complex when, for example, an alert is received some time after the purchase has been made. In these cases, timeliness returns to the process, but in particular ways. If an order has been approved that then needs to be cancelled, the first point of contact for the Customer Service Centre is the shipping company:

Sometimes, [the shipping company] is fairly quick. Sometimes, we send an email and a couple of minutes later the answer is, “Yes, we were able to cancel”. Sometimes, during the weekend, [the shipping company] does not work, which means we send the list there, well we say, “Please cancel this and that”, but the response comes basically just on Monday. (Agent, 24 Male)

Cost and timeliness are tied together once again. To be able to intervene in time to stop an order, saves the merchants from some of the costs. As the following excerpt makes clear, however, once an order has been delivered, there is nothing more the Customer Service Centre can do to recall those goods:

Relatively often we first realise that the order is fraudulent after it has been delivered. Then it is over. (Project Coordinator, 46 Male)

‘In the moment’ accountability requires decision making on potential fraud to prevent the delivery of goods while also navigating evidence, timeliness, cost, and the potential for future interrogation. Eliminating ambiguity by selecting and ordering the data into an account, and doing so swiftly to ensure the operative meets the Centre's expectation on cost, are continual processes, every 2 minutes for an 8 hour shift. As the next section will show, internal accountability is circumscribed both in terms of time and the number of participants involved. This cutting of further potential connections, sits centrally in distributing relations of accountability and responsibility for who is, and who is not, involved in cases of potential fraud.

Challenges and limitations of external accountability

Distributing accountability and responsibility

The accounts produced by operatives in the Customer Service Centre draw together data and participate in decisions over whether or not to allow a purchase to go ahead, while also distributing and taking on relations of accountability, responsibility and potentially answerability through future moments of interrogation. As we noted earlier in the article, responsibility here relates to taking on a duty for addressing matters of concern, such as time, cost and fraud. Accountability can be understood as the set of relations through which responsibilities are taken on, discharged and sometimes shifted to others. Answerability is characteristic of those moments when accounts are opened for interrogation. All this takes place within relations between the Centre and its close associates (police, financial institutions and retail clients). To use Lynch's (2022) term, the canonical procedures of the Customer Service Centre involve producing ‘in the moment’ accounts in around 2 minutes, that cut ambiguity and can navigate through future moments of interrogation, displays these responsibilities and take part in future relations of accountability – but only within this tightly circumscribed set of participants. Accountability does not shift towards an external orientation.

An internal focus on issues of responsibility and relations of accountability is managed through this circumscribing of relations. For example, relations between the operatives of the Customer Service Centre and the police are limited as the following excerpts suggest:

There is no good contact with law enforcement. (Payment Director, 39 Male)

Well I must clearly say; the police do not make any effort. It is a victimless offence. There is no body lying on the ground bleeding. It's a faceless company or faceless corporation that has the damage and that can be paid by the insurance company. (Account Manager, 38 Male)

It depends on the extent of fraud and on the chances, whether the police will be able to investigate it successfully. It depends on the amount. If it is about 2000–3000 Euros you can report it to the police. (Manager E-commerce/Payment)

In this way, there is a limited extent to which accounts of fraud are likely to become entangled in external relations of accountability wherein operatives are called to account by, for example, courts of law for their decisions. The Customer Service Centre itself tends to look on the potential for extended legal cases as a further cost:

We don't report them anymore, because it brings nothing … As a company it is always a cost-benefit calculation, and when reporting it costs me time, money and trouble and I am invited to attend court hearings where nothing comes of it, and then I say I will let it be. I believe many companies handle it in the same way. (Account Manager, 38 Male)

The decision on whether or not an order is fraudulent is kept within the set of defined participants (the Customer Service Centre, the client (online retailers) and on occasions financial institutions or shipping companies) that ensures that accountability only operates between these participants to further ensure the timeliness of accounts and manage the potential costs. Although as we noted, police officers do sometimes contact the operatives to ask for data, it is rare for operatives to call on the police to take action. Relations of accountability and distributions of responsibility are arranged among these participants and mostly focus on the quick and defensible decision making of the operatives.

Making and marking distributions of responsibility ‘in the moment’

We have already seen how accounts of potential fraud are time limited (ideally to under 2 minutes). In various ways these accounts could play a part in further relations of external accountability and questions of responsibility. Who has made what decision, what data was used as evidence and how, could be opened for broader scrutiny. Instead, relations of accountability are cut.

First, victims of fraud could be provided with greater opportunities to respond to, and hold to account, the decision making of the Centre. This is entirely absent from our research findings. From initial training onwards, there is no external orientation towards involving victims in the accountability relations of the Centre. Senior staff do not include this in training and operatives have no mechanism for contacting potential victims. When customers do make complaints, these are dealt with swiftly and separately from the accountability processes outlined here.

Second, the kinds of internal accountability we have noted, could in theory be extended through an external orientation. However, retailers (or merchants), who are clients of the Customer Service Centre, appear to be reluctant to take part in further relations of accountability:

merchants […] basically they don't know what they are doing. They really don't know what they do. […] They just don't want to hear about it. They do not basically believe that this [fraud] is a big issue. (Head of Payment Department, 35 Male)

Third, even when a concern over fraud is raised by an external party – for example, when credit card companies are worried about levels of chargeback – these concerns are managed through tightly bounded relations between the Centre and financial institutions. There is no opportunity for, or interest in, these concerns over chargeback turning into a broader concern for accountability, incorporating a broader number of participants. For the senior staff in the Centre, when there are instances of chargeback, the concern is to limit future occasions of chargeback rather than to pursue the individual fraudster who caused this particular instance:

We don't go after the fraudsters at the moment. If we have a chargeback we do know that it was a fraudster, but we don't go to the police try to get this person arrested. It's not an efficient way for us to manage it at the moment … We have tried it once or twice and it was like a small project for one person to go after one or two cases. It is not worth it. (Payment Director, 39 Male)

The police officers who took part in our research seemed to come to a similar conclusion:

I can understand from the perspective of an online shop that they don't want to report the cases to the police. They probably will need to open a department for that. (Police Officer, 44 Female)

Fourth, as we noted with the delayed issuing of some alerts, once orders have been sent, there is little the Customer Service Centre can do to get those products returned. In this sense, potential relations of accountability and distributions of responsibility that might involve the offenders returning their fraudulently obtained goods are also not pursued. As we can see in the following excerpt, in some cases substantial numbers of items are involved, but little effort is made to re-collect these goods:

Well we had a crystal-clear case [of fraud] where 35 or 40 orders were given to an address of a big family … but what do you do with 70 pair of shoes and 65 T-shirts which were worn and are old? (Account Manager, 38 Male)

The absence of contact with potential victims of fraud, the somewhat tense relations with merchants and police, the inability to recall goods, continuing concerns for costs and timeliness, are what cut the network (Strathern, 1996) of accountability relations. Fraud is held ‘in the moment’ in closely managed relations of internal accountability for as long as distributions of responsibility are circumscribed, involving a limited number of participants whose roles are narrowly defined. Future occasions of potential interrogation for accounts are limited to senior members of staff looking at specific decisions made by operatives in the Centre and credit card companies raising concerns over the number of fraudulent orders allowed to proceed. The possibilities of external accountability are cut.

Discussion

Building on existing work (e.g. Cross, 2015; 2020) that focuses on the victims of online fraud, our study can help to inform discussions of the potential for further accountability of settings that manage fraud. We can see from the preceding analysis that a careful and on-going cutting of the network of relations takes place that might otherwise enable a pivoting between internal and external forms of accountability. We can also see that the relations of internal accountability have a specific character – what Lynch (2022) would term the canonical procedures of the setting. These comprise decision making processes that produce ‘in the moment’ accounts which declare something as fraudulent (or genuine) and thus cut out the potential havoc that would otherwise be wreaked by ambiguity (Coopmans and Rappert, 2020). By bringing together ideas developed in ethnomethodology, we illustrated the ways employees produce accounts that are account-able (Garfinkel and Sacks, 1970) – involving decisions that order evidence from the Centre's system swiftly into a logic that is designed to withstand future occasions of interrogation. We add to our understanding of online fraud here by demonstrating how decisions on fraud are contingent on resolving the relative difficulties of producing account-able decisions. If an alert comes from a financial institution, this is taken by operatives to mean that they can cancel the order and use the source of the alert as a warrant in any future interrogation that questions the appropriateness of the decision. If an alert comes from the police requesting evidence, the responsibility for resolving ambiguity might be handed back to the police, but questions are seldom re-opened regarding who has taken responsibility for what.

We have also added to our understanding of online fraud by detailing the pressures involved in producing account-able decisions. Relations between operatives and senior staff, financial institutions, sometimes the police and customers distribute responsibility in such a way that a strong emphasis is placed on operatives producing accounts in a timely (Munro, 2004) manner. The accounts should be produced in around 2 minutes, reducing the staff costs involved in making each account, ensuring sufficient time is available to deal with the number of alerts received during the day and assisting with the Centre's aim to stop purchases where possible before goods are shipped. Cost underpins the ordering of these accountability relations between members of staff in the Customer Service Centre and between the Centre and its clients. The focus on timeliness as a basis for ordering relations of accountability reveals what is valued and what is at stake in producing accounts of fraud: employees must produce a reasonable number of accurate decisions that cut fraudulent purchases sufficiently to justify the continued existence of the Centre to clients who will save money through the Centre.

Online fraud, as we suggested in the opening to this article, is increasing in volume and there are increasing numbers of victims. Although these victims and potential future victims could benefit from external accountability, currently they are no more than a briefly considered data-point within internal account building processes. Developing greater external accountability to enable victims to have some voice, to be able to gain greater insights into how decisions on fraud are processed, would help address this issue. As these Centres are dealing with fraud, but are outside the regulatory environment to which the police are subjected, introducing external accountability by a notable authority would provide a means of ensuring that the quality of fraud processing by the Centre is made answerable. But the characteristics of these internal accountability relations – the canonical procedures of the Centre – help explain the absence of any external orientation to accountability. Passing large numbers of cases onto the police, involving external parties in decision making, building a system that might in some way enable victims to have more detail – or even a voice – in relation to incidents, each involve more time and more cost than the Centre is currently able to commit. The Centre's organisational model and its relationships with clients is held steady on ‘in the moment’ accounts.

Conclusion

Returning to the concerns of digital accountability (Amelang and Bauer, 2019; Diakopoulos, 2014; Ziewitz, 2016) that we considered in the opening of this article, what we can note from this study, is that calls for (external) accountability are not only limited by data sensitivity. It is clear in the case of Customer Service Centres dealing with cases of potential online fraud that there are data sensitivities. For example, collating data to make decisions on fraud, choosing to cancel purchases, working with the police and financial institutions, individual credit card details and who has taken on responsibility for making decisions, are among a variety of potentially sensitive data sources. This range of sensitive data precludes a broad brush form of transparency that simply enables an external view into the organisation that might then be used as part of a process of accountability (Neyland, 2007). But this is not the whole picture.

Alongside these data sensitivities are what we might term process sensitivities. How the Centre looks to cut the havoc otherwise wreaked by ambiguity, the focus on time, cost, its particular approach to accuracy, the authority wielded by credit card companies, an absence of regular interaction with police officers, are each processes that are not made available for routine, external scrutiny. Indeed in our research the sensitivity of the processes appear as important as the sensitivity of the data. To allow broad oversight of the regular, internal accountability processes would put the regular, internal accountability processes of the Centre at risk. ‘In the moment’ accounts – produced swiftly, at a reasonably low cost, cutting out other potential participants, with just about enough data and proving to be more or less reliable, sufficiently regularly – justify the continued existence of the Centre. A fuller, lengthier internal accountability mechanism, further caught up with detailed external accountability, would undermine the Centre's ability to prove its financial viability to its retail clients. Not having external accountability and thus not having to face pressures to do more, in more detail, is essential to the Centre continuing in its current form.

In sum, what we can note from our study of Customer Service Centres that deal with cases of potential online fraud is that they remain stubbornly opaque to external accountability. This is a necessity for the Centre that goes beyond concerns for data sensitivity. The Centre is also characterised by a process sensitivity that demands the retention of opacity in order to ensure that their timely account building processes, central to their relations with clients, can be maintained. In this way, we suggest that calls for greater digital accountability of opaque settings need to pay attention not only to data sensitivities but also process sensitivities operating within those settings. Future research could take up the challenge of working through the potential for introducing external accountability to digital settings characterised by both data and process sensitivity. Clearly a move to introduce broad brush transparency that simply makes the internal operations of the setting available to external parties would not enable the setting to carry on operating. Instead, future research should look at the possibilities of independent expert oversight that operates on behalf of, in our case, victims of fraud and provides a basis for holding to account Centres that are dealing with issues on the margins of law but which are not themselves subject to the same regulatory processes as law enforcement agencies.