5 ms·

Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first do

by Osiris 11y ago

Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score is too high, I void the auth and decline the transaction. This has saved me a lot of chargeback fees, though it's still not perfect. I prefer PayPal because a "not authorized" just reverses the transaction; there is no chargeback fee.

thesis 11y ago
Definitely definitely definitely use something like Minfraud from Maxmind. The cost is negligible. We set the score we block transactions at rather low, and manually approve anything over that. It's super cheap and has saved us tons of money and headaches!
- finnn 11y ago
  Seems like this should be on the credit card processor to deal with?
  - pjlegato 11y ago
    Unfortunately for merchants, no, the legal responsibility for fraudulent transactions rests entirely with the merchant. Not only that, but processors routinely penalize merchants who fail to screen fraudulent transactions sufficiently with fines and eventually banishment from the processor. A few processors might provide something like this as a paid value-added service, but it's unusual. The next-gen all-in-one card processors would make a lot of money if they offered this.
    - ricardobeat 11y ago
      By "all-in-one card processors" do you mean payment gateways? The majority of them do offer built-in fraud protection, though the efficacy varies a lot. In fact, Stripe also offers it: https://stripe.com/docs/fraud https://stripe.com/docs/fraud But if you think about the case he describes in the article, there is very little distinguishing a fraudulent purchase to test the validity of a credit card vs a legitimate one, unless they are completely careless and initiate multiple transactions from a russian IP, in the middle of the night. The biggest problem is the very expensive chargeback fee from Stripe. It looks like he could avoid some of them by, for example, reporting accounts that had no activity as fraudulent and refunding the purchase before being hit with a chargeback claim, but I don't see how putting such a burden on businesses makes sense to begin with. A fee that grows in proportion to the % of chargebacks the company generates would be more fair.
      - deleted 11y ago
        [deleted]
TheSmoke 11y ago
risk score means the possibility of a transaction being fraudulent. here's another way you can do this for cards issued in Europe: if the risk score is too high start a 3D secure transaction. if the risk score is acceptable then start a normal transaction. a full 3D transaction will never mean it is not fraud however you will have no liabilities when a chargeback is issued by the card holder. many of your US customers, if not all, will fail to pay via 3D-secure because god knows why tons and tons of US card holders or issuing banks are not enrolled in 3D-secure system.
- daxelrod 11y ago
  As a US customer, I'm hesitant to use 3D Secure because: 1) The implementations by Visa and MasterCard have security weaknesses, terrible usability and look like phishing: http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf 2) My understanding is that my bank shifts liability to me for 3D Secure transactions. Why would I want extra liability?
  - TheSmoke 11y ago
    in turkey, banks automatically enroll your debit or credit cards to 3d secure networks so you don't have to do it yourself. all you have to do is to enter a one time password sent to your mobile phone during payment. with full 3d secure payments the liability shifts to the customer and you will have no liability. because the customer verified the payment him/herself by hand with the otp. p.s. i am yet to read that link.
  - PhantomGremlin 11y ago
    Yeah, "Verified by Visa" is exactly like phishing. Good paper. Fortunately here in the USA I haven't been asked for my credentials in at least 10 years. So it seems to have died the death it so richly deserved. Do people encounter this on a daily basis?
    - Symbiote 11y ago
      It's ages since I've seen it used in the UK, although not 10 years. More like three or four. (The redirect sometimes happens, but it's automatically approved.)
EdwardDiego 11y ago
Are the details of Maxmind's algorithm available to you? I'm wondering what factors increase risk.
- nchelluri 11y ago
  > The minFraud service determines the likelihood that a transaction is fraudulent based on many factors, including whether an online transaction comes from a high risk IP address, high risk email, high risk device, or anonymizing proxy. One of the key features of the minFraud service is the minFraud Network, which allows MaxMind to establish the reputations of IP addresses, emails, and other parameters. - https://www.maxmind.com/en/minfraud-services https://www.maxmind.com/en/minfraud-services So not a full list of factors, but some of them...

by Osiris 11y ago

thesis 11y ago

Definitely definitely definitely use something like Minfraud from Maxmind. The cost is negligible. We set the score we block transactions at rather low, and manually approve anything over that. It's super cheap and has saved us tons of money and headaches!

finnn 11y ago
Seems like this should be on the credit card processor to deal with?
- pjlegato 11y ago
  Unfortunately for merchants, no, the legal responsibility for fraudulent transactions rests entirely with the merchant. Not only that, but processors routinely penalize merchants who fail to screen fraudulent transactions sufficiently with fines and eventually banishment from the processor. A few processors might provide something like this as a paid value-added service, but it's unusual. The next-gen all-in-one card processors would make a lot of money if they offered this.
  - ricardobeat 11y ago
    By "all-in-one card processors" do you mean payment gateways? The majority of them do offer built-in fraud protection, though the efficacy varies a lot. In fact, Stripe also offers it: https://stripe.com/docs/fraud https://stripe.com/docs/fraud But if you think about the case he describes in the article, there is very little distinguishing a fraudulent purchase to test the validity of a credit card vs a legitimate one, unless they are completely careless and initiate multiple transactions from a russian IP, in the middle of the night. The biggest problem is the very expensive chargeback fee from Stripe. It looks like he could avoid some of them by, for example, reporting accounts that had no activity as fraudulent and refunding the purchase before being hit with a chargeback claim, but I don't see how putting such a burden on businesses makes sense to begin with. A fee that grows in proportion to the % of chargebacks the company generates would be more fair.
    - deleted 11y ago
      [deleted]

TheSmoke 11y ago

risk score means the possibility of a transaction being fraudulent. here's another way you can do this for cards issued in Europe: if the risk score is too high start a 3D secure transaction. if the risk score is acceptable then start a normal transaction. a full 3D transaction will never mean it is not fraud however you will have no liabilities when a chargeback is issued by the card holder. many of your US customers, if not all, will fail to pay via 3D-secure because god knows why tons and tons of US card holders or issuing banks are not enrolled in 3D-secure system.

daxelrod 11y ago
As a US customer, I'm hesitant to use 3D Secure because: 1) The implementations by Visa and MasterCard have security weaknesses, terrible usability and look like phishing: http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf 2) My understanding is that my bank shifts liability to me for 3D Secure transactions. Why would I want extra liability?
- TheSmoke 11y ago
  in turkey, banks automatically enroll your debit or credit cards to 3d secure networks so you don't have to do it yourself. all you have to do is to enter a one time password sent to your mobile phone during payment. with full 3d secure payments the liability shifts to the customer and you will have no liability. because the customer verified the payment him/herself by hand with the otp. p.s. i am yet to read that link.
- PhantomGremlin 11y ago
  Yeah, "Verified by Visa" is exactly like phishing. Good paper. Fortunately here in the USA I haven't been asked for my credentials in at least 10 years. So it seems to have died the death it so richly deserved. Do people encounter this on a daily basis?
  - Symbiote 11y ago
    It's ages since I've seen it used in the UK, although not 10 years. More like three or four. (The redirect sometimes happens, but it's automatically approved.)

EdwardDiego 11y ago

Are the details of Maxmind's algorithm available to you? I'm wondering what factors increase risk.

nchelluri 11y ago
> The minFraud service determines the likelihood that a transaction is fraudulent based on many factors, including whether an online transaction comes from a high risk IP address, high risk email, high risk device, or anonymizing proxy. One of the key features of the minFraud service is the minFraud Network, which allows MaxMind to establish the reputations of IP addresses, emails, and other parameters. - https://www.maxmind.com/en/minfraud-services https://www.maxmind.com/en/minfraud-services So not a full list of factors, but some of them...