4 ms·

Second article in one day mentioning how bad credit card fraud can be to handle, especially for smaller sites. I wonder if there might be an opportunity there?

Second article in one day mentioning how bad credit card fraud can be to handle, especially for smaller sites. I wonder if there might be an opportunity there? Or if the solutions have to be so custom that it'd be impossible to work out.

foota 11y ago
From the article, it sounds like they are working in using an existing fraud detection service, would be interesting to see what goes into that sort of service.
- Reason077 11y ago
  Presumably, it would at least involve implementing "Verified by Visa", which protects online transactions by requiring a password or PIN. Mastercard and Amex have equivalent services, and these are all widely implemented by websites and card issuers in Europe and other countries. I suppose they are not so widely deployed in the USA or Japan, but at the very least, you'd protect yourself against fraud involving cards issued in countries that do use it. http://www.visaeurope.com/making-payments/verified-by-visa/ http://www.visaeurope.com/making-payments/verified-by-visa/
  - foota 11y ago
    I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")
    - Reason077 11y ago
      The actual authentication mechanism is left up to the card issuer. But using the card's PIN would be considered insecure due to the risk of malware/key-loggers intercepting it. My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers.
      - paulhart 11y ago
        Which may mean that either the bank is storing your password as plaintext (or is hashing every three character combination possible, which would also help a hacker figure out the plaintext).
      - ceejayoz 11y ago
        > My bank asks for three random characters from my online banking password... That's terrifying, really. They shouldn't have any way of getting that data out of the hashed password.
        Reason077 11y ago
        Well, it's a bank. If a hacker can penetrate to the point that they can read passwords directly out of the bank's account database, then you have far greater things to worry about than just a compromised password.
        ceejayoz 11y ago
        Unhashed passwords means a SQL injection hole goes from "I can read some interesting transaction histories and balances" to "I can log in and make bank transfers in everyone's account". There's a reason bcrypt one-way hashing is the recommended standard for any web app.
    - rwmj 11y ago
      3D Secure can use 2 factor authentication, using a dongle supplied by your bank. Unfortunately there are so many other problems with 3D Secure that I wouldn't trust it except on high profile websites or for very technically competent users who are able to check the originating site and certificate of the iFrame used (ie. very few people indeed).
    - Symbiote 11y ago
      > is there a way to require someone to enter the pin that they use when they buy something in person A PIN can be required for "cardholder present" transactions in most of the world. Some combination of card issuer, transaction processor and merchant decide at what value transactions may proceed without a PIN — e.g. a train company's actual loss from a fraudulent ride is very small, so they might not want the delay of asking for a PIN on a ticket machine. Similarly for McDonalds. But if you're buying a TV, you will need to use a PIN. It's almost 100% of transactions in much of Europe, over 80% in Africa and South America, lower in the old Soviet Union and Asia: https://www.emvco.com/about_emvco.aspx?id=202 https://www.emvco.com/about_emvco.aspx?id=202
      - foota 11y ago
        That's very interesting, thank you. I've always wondered what the process is for deciding whether to ask for a pin. It's strange to me because I think of someone being there with the card as being more secure than accepting a payment online?
      - DanBC 11y ago
        > It's almost 100% of transactions in much of Europe Unless the customer is using contactless payment card?
        Reason077 11y ago
        There's a (relatively low) transaction limit for contactless payments without additional verification. So, to buy a TV, you still need to enter a PIN. Newer payment terminals can support device-based customer verification for contactless transactions, called CDCVM. The transaction limit doesn't apply if CDCVM is used. This is the mechanism used by Apple Pay, where you verify your identity using your fingerprint via Touch ID.
    - kalleboo 11y ago
      One of my banks requires me to enter my card in a physical card reader (and unlock the chip with the PIN) and validate the transaction by signing a nonce https://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.jpg https://farm4.staticflickr.com/3237/2486214902_8feafd8200_b....
adventured 11y ago
There is a huge opportunity there for companies like Stripe to buy eg MaxMind and integrate a quality risk scoring system directly into their payment solution. It's an obvious product expansion for someone like Stripe. Kind of hard to believe they haven't already gone after this.
- jib 11y ago
  PayPal does to some extent. And then people complain about how expensive PayPal is. In a commodity, race to the bottom world of cc processing I am not sure it would be a good business practise to bundle fraud prevention and processing. Let people be bitten and then willing to pay to avoid it is probably a better practise than charging for it up front. But they do buy them. ACI bought ReD last year for instance http://www.aciworldwide.com/news-and-events/press-releases/aci-completes-acquisition-of-red.aspx http://www.aciworldwide.com/news-and-events/press-releases/a...

foota 11y ago

From the article, it sounds like they are working in using an existing fraud detection service, would be interesting to see what goes into that sort of service.

Reason077 11y ago
Presumably, it would at least involve implementing "Verified by Visa", which protects online transactions by requiring a password or PIN. Mastercard and Amex have equivalent services, and these are all widely implemented by websites and card issuers in Europe and other countries. I suppose they are not so widely deployed in the USA or Japan, but at the very least, you'd protect yourself against fraud involving cards issued in countries that do use it. http://www.visaeurope.com/making-payments/verified-by-visa/ http://www.visaeurope.com/making-payments/verified-by-visa/
- foota 11y ago
  I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")
  - Reason077 11y ago
    The actual authentication mechanism is left up to the card issuer. But using the card's PIN would be considered insecure due to the risk of malware/key-loggers intercepting it. My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers.
    - paulhart 11y ago
      Which may mean that either the bank is storing your password as plaintext (or is hashing every three character combination possible, which would also help a hacker figure out the plaintext).
    - ceejayoz 11y ago
      > My bank asks for three random characters from my online banking password... That's terrifying, really. They shouldn't have any way of getting that data out of the hashed password.
      - Reason077 11y ago
        Well, it's a bank. If a hacker can penetrate to the point that they can read passwords directly out of the bank's account database, then you have far greater things to worry about than just a compromised password.
        ceejayoz 11y ago
        Unhashed passwords means a SQL injection hole goes from "I can read some interesting transaction histories and balances" to "I can log in and make bank transfers in everyone's account". There's a reason bcrypt one-way hashing is the recommended standard for any web app.
  - rwmj 11y ago
    3D Secure can use 2 factor authentication, using a dongle supplied by your bank. Unfortunately there are so many other problems with 3D Secure that I wouldn't trust it except on high profile websites or for very technically competent users who are able to check the originating site and certificate of the iFrame used (ie. very few people indeed).
  - Symbiote 11y ago
    > is there a way to require someone to enter the pin that they use when they buy something in person A PIN can be required for "cardholder present" transactions in most of the world. Some combination of card issuer, transaction processor and merchant decide at what value transactions may proceed without a PIN — e.g. a train company's actual loss from a fraudulent ride is very small, so they might not want the delay of asking for a PIN on a ticket machine. Similarly for McDonalds. But if you're buying a TV, you will need to use a PIN. It's almost 100% of transactions in much of Europe, over 80% in Africa and South America, lower in the old Soviet Union and Asia: https://www.emvco.com/about_emvco.aspx?id=202 https://www.emvco.com/about_emvco.aspx?id=202
    - foota 11y ago
      That's very interesting, thank you. I've always wondered what the process is for deciding whether to ask for a pin. It's strange to me because I think of someone being there with the card as being more secure than accepting a payment online?
    - DanBC 11y ago
      > It's almost 100% of transactions in much of Europe Unless the customer is using contactless payment card?
      - Reason077 11y ago
        There's a (relatively low) transaction limit for contactless payments without additional verification. So, to buy a TV, you still need to enter a PIN. Newer payment terminals can support device-based customer verification for contactless transactions, called CDCVM. The transaction limit doesn't apply if CDCVM is used. This is the mechanism used by Apple Pay, where you verify your identity using your fingerprint via Touch ID.
  - kalleboo 11y ago
    One of my banks requires me to enter my card in a physical card reader (and unlock the chip with the PIN) and validate the transaction by signing a nonce https://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.jpg https://farm4.staticflickr.com/3237/2486214902_8feafd8200_b....

adventured 11y ago

There is a huge opportunity there for companies like Stripe to buy eg MaxMind and integrate a quality risk scoring system directly into their payment solution. It's an obvious product expansion for someone like Stripe. Kind of hard to believe they haven't already gone after this.

jib 11y ago
PayPal does to some extent. And then people complain about how expensive PayPal is. In a commodity, race to the bottom world of cc processing I am not sure it would be a good business practise to bundle fraud prevention and processing. Let people be bitten and then willing to pay to avoid it is probably a better practise than charging for it up front. But they do buy them. ACI bought ReD last year for instance http://www.aciworldwide.com/news-and-events/press-releases/aci-completes-acquisition-of-red.aspx http://www.aciworldwide.com/news-and-events/press-releases/a...