4 ms·

Definitely definitely definitely use something like Minfraud from Maxmind. The cost is negligible. We set the score we block transactions at rather low, and m

by thesis 11y ago

Definitely definitely definitely use something like Minfraud from Maxmind. The cost is negligible. We set the score we block transactions at rather low, and manually approve anything over that. It's super cheap and has saved us tons of money and headaches!

finnn 11y ago
Seems like this should be on the credit card processor to deal with?
- pjlegato 11y ago
  Unfortunately for merchants, no, the legal responsibility for fraudulent transactions rests entirely with the merchant. Not only that, but processors routinely penalize merchants who fail to screen fraudulent transactions sufficiently with fines and eventually banishment from the processor. A few processors might provide something like this as a paid value-added service, but it's unusual. The next-gen all-in-one card processors would make a lot of money if they offered this.
  - ricardobeat 11y ago
    By "all-in-one card processors" do you mean payment gateways? The majority of them do offer built-in fraud protection, though the efficacy varies a lot. In fact, Stripe also offers it: https://stripe.com/docs/fraud https://stripe.com/docs/fraud But if you think about the case he describes in the article, there is very little distinguishing a fraudulent purchase to test the validity of a credit card vs a legitimate one, unless they are completely careless and initiate multiple transactions from a russian IP, in the middle of the night. The biggest problem is the very expensive chargeback fee from Stripe. It looks like he could avoid some of them by, for example, reporting accounts that had no activity as fraudulent and refunding the purchase before being hit with a chargeback claim, but I don't see how putting such a burden on businesses makes sense to begin with. A fee that grows in proportion to the % of chargebacks the company generates would be more fair.
    - deleted 11y ago
      [deleted]

by thesis 11y ago

finnn 11y ago

Seems like this should be on the credit card processor to deal with?

pjlegato 11y ago
Unfortunately for merchants, no, the legal responsibility for fraudulent transactions rests entirely with the merchant. Not only that, but processors routinely penalize merchants who fail to screen fraudulent transactions sufficiently with fines and eventually banishment from the processor. A few processors might provide something like this as a paid value-added service, but it's unusual. The next-gen all-in-one card processors would make a lot of money if they offered this.
- ricardobeat 11y ago
  By "all-in-one card processors" do you mean payment gateways? The majority of them do offer built-in fraud protection, though the efficacy varies a lot. In fact, Stripe also offers it: https://stripe.com/docs/fraud https://stripe.com/docs/fraud But if you think about the case he describes in the article, there is very little distinguishing a fraudulent purchase to test the validity of a credit card vs a legitimate one, unless they are completely careless and initiate multiple transactions from a russian IP, in the middle of the night. The biggest problem is the very expensive chargeback fee from Stripe. It looks like he could avoid some of them by, for example, reporting accounts that had no activity as fraudulent and refunding the purchase before being hit with a chargeback claim, but I don't see how putting such a burden on businesses makes sense to begin with. A fee that grows in proportion to the % of chargebacks the company generates would be more fair.
  - deleted 11y ago
    [deleted]