4 ms·

This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this

by Osiris 11y ago

This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this issue and recommend a fraud check service, or 2) include fraud protection in their service. I actually ran into an issue a little while ago in that I allowed my MaxMind account to run out of queries. Not realizing this, I saw a few days of higher than normal sales but just assumed it was a good day. When the first chargeback came through, I immediately noticed the problem, bought more credits, then began to go through each transaction one and a time and noticed a pattern in the email addresses (all two words followed by 3 numbers @hotmail.com) and individually refunded each and every one of them. I still got chargebacks but I was able to dispute them by showing that the transaction had already been refunded. My ideal credit card would be on where the physical card has e-paper on it with a 6-digit PIN that changes periodically, like 2-factor auth, and that PIN could be required for purchases to be authenticated. The new smart-chip cards don't help at all with online purchases, only point of sale. On a side note, I found that nearly all of my fraudulent purchases came from Vietnam to the point that at one time I put in an IPTABLES rule to block the entire country.

bemmu 11y ago
All of mine seemed to come from Mexico. Either IP being in Mexico or the shipping address being there. Still many orders originating from Mexico seemed like they might be genuine, as the customers had filled in the questionnaire with their favorite animes etc. valid looking answers, so I didn't want to block the entire country. My theory is that there really was some kind of media mention there, which resulted in some real orders but also some fraudster happened to hear about the service that way as well. it seemed possible that I had been mentioned in some local
lifeisstillgood 11y ago
Since pro accounts initially cost £6 for month, it turns out that this is low enough that it won't send red flags to stolen cards That's interesting (scary). What is the minimum transaction that Visa actually gives a monkeys about? And why, if a card is stolen, does not any activity flag up? Edit: more importantly I never even thought Inwoukd need to implement fraud detection - is there a primer on "things you never thought of when selling on line - from VATMOSS to Vampires"?
- EwanToo 11y ago
  It's not normally a single transaction that triggers the fraud detection, but a small initial transaction (say <$20) then one that's much larger - the first transaction validates the card works, the second one is the money grab. So if you sell something small, you'll be used to validate newly bought cards before they go off and buy $1000 of something else.
mootothemax 11y ago
>all of my fraudulent purchases came from Vietnam to the point that at one time I put in an IPTABLES rule to block the entire country. I can never work this out; it seems that scammers from different countries (or using hacked servers / proxies?) are attracted to different sites or types of ecommerce sites. For example: - One of my sites has huge fraud from Ukraine and Russia - Another from Indonesia - Another's problem country is Pakistan I typically use https://siftscience.com https://siftscience.com to identify fraud, plus country-level blocks where it makes sense. Damned shame that all the legitimate users from a given country get blocked thanks to the fraudsters!
- jasontan 11y ago
  Thanks for using us! If you need extra help feel free to email me - jason at siftscience dot com
chli 11y ago
Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure I have to use it with most online shops here in Switzerland.
- SyneRyder 11y ago
  3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will freak some people out. Consider that some banks make the Verified By Visa password the customer's birthday (ie something easily researched) and you quickly realize it's a horrible system.
  - CyberThijs 11y ago
    Here in Belgium 3D-Secure is also commonplace, and the experience provided by my bank has significantly improved throughout the years. I also don't think it hurts the conversion of webshops around here because everybody is used to performing these extra steps. It works as follows: - Merchant redirects me to his payment provider - I enter my debit/credit card number into the payment provider screen - I am redirected to my bank website, and am able to verify the URL (no iframes anymore!) - My bank has two methods of verification: scanning a QR-code with the mobile banking app on my phone, or logging into the online banking website (with a Vasco DIGIPASS 836, which requires a debit card+pin to generate a OTP) - I verify the amount and creditor in the mobile/online banking app, and sign the transaction with my mobile pin/digipass. - I am redirected back to the merchant. All in all, I think it costs me 30 seconds to complete the extra 3D-Secure steps when using my mobile banking app.
  - Nullabillity 11y ago
    Sure, banks can do it really horribly (most of them), but some use it to force proper 2FA. For example, Nordea asks you to open their phone app and confirm the purchase (with a message that includes the total price) on there.
lifeisstillgood 11y ago
Let me say I vastly appreciate the honesty in your blog series having caught up just now. It's good to hear others have these worries and can learn - if painfully ! Good luck
maemre 11y ago
> My ideal credit card would be on where the physical card has e-paper on it with a 6-digit PIN that changes periodically, like 2-factor auth, and that PIN could be required for purchases to be authenticated. The new smart-chip cards don't help at all with online purchases, only point of sale. The banks and companies like Visa/MasterCard in Turkey use something called 3D Secure [1], in which you are directed to your bank's 3D secure page and enter a code that is sent to you via SMS and your CVC number so they have 2-factor auth. Most of the merchants I used in Turkey supported 3D Secure but I don't know the situation with other countries. Banks in Turkey still support the processing system that is currently used worldwide however some banks have an option where you can cancel all non-3D-Secure online transactions. Also the chip-and-PIN standard was conceived in 1990s AFAIK so the smart-chip cards are not new at all, they are just not adopted in some countries like US. [1]: https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure
elsjaako 11y ago
> My ideal credit card would be on where the physical card has e-paper on it with a 6-digit PIN that changes periodically, like 2-factor auth, and that PIN could be required for purchases to be authenticated. The new smart-chip cards don't help at all with online purchases, only point of sale. You may be interested in the system I use with my bank in the Netherlands. The old system worked like this: The bank gave me a device they called a "Random Reader". To make a payment, I had to insert my card into the device, enter my pin, enter a (random?) number that the payment site gave me, and enter the amount. It then gave me a number back that I had to give the website, which authenticated me. These days I use a "Rabo Scanner", which works the same except instead of entering a code and the amount it has a camera on there that scans a kind of barcode on the screen that contains that information. So it does use the smart-chip, and the (8-digit) pin changes every time you make a payment. You do have to take the device with you, but it isn't very big.

by Osiris 11y ago

bemmu 11y ago

All of mine seemed to come from Mexico. Either IP being in Mexico or the shipping address being there. Still many orders originating from Mexico seemed like they might be genuine, as the customers had filled in the questionnaire with their favorite animes etc. valid looking answers, so I didn't want to block the entire country. My theory is that there really was some kind of media mention there, which resulted in some real orders but also some fraudster happened to hear about the service that way as well. it seemed possible that I had been mentioned in some local

lifeisstillgood 11y ago

Since pro accounts initially cost £6 for month, it turns out that this is low enough that it won't send red flags to stolen cards That's interesting (scary). What is the minimum transaction that Visa actually gives a monkeys about? And why, if a card is stolen, does not any activity flag up? Edit: more importantly I never even thought Inwoukd need to implement fraud detection - is there a primer on "things you never thought of when selling on line - from VATMOSS to Vampires"?

EwanToo 11y ago
It's not normally a single transaction that triggers the fraud detection, but a small initial transaction (say <$20) then one that's much larger - the first transaction validates the card works, the second one is the money grab. So if you sell something small, you'll be used to validate newly bought cards before they go off and buy $1000 of something else.

mootothemax 11y ago

>all of my fraudulent purchases came from Vietnam to the point that at one time I put in an IPTABLES rule to block the entire country. I can never work this out; it seems that scammers from different countries (or using hacked servers / proxies?) are attracted to different sites or types of ecommerce sites. For example: - One of my sites has huge fraud from Ukraine and Russia - Another from Indonesia - Another's problem country is Pakistan I typically use https://siftscience.com https://siftscience.com to identify fraud, plus country-level blocks where it makes sense. Damned shame that all the legitimate users from a given country get blocked thanks to the fraudsters!

jasontan 11y ago
Thanks for using us! If you need extra help feel free to email me - jason at siftscience dot com

chli 11y ago

Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure I have to use it with most online shops here in Switzerland.

SyneRyder 11y ago
3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will freak some people out. Consider that some banks make the Verified By Visa password the customer's birthday (ie something easily researched) and you quickly realize it's a horrible system.
- CyberThijs 11y ago
  Here in Belgium 3D-Secure is also commonplace, and the experience provided by my bank has significantly improved throughout the years. I also don't think it hurts the conversion of webshops around here because everybody is used to performing these extra steps. It works as follows: - Merchant redirects me to his payment provider - I enter my debit/credit card number into the payment provider screen - I am redirected to my bank website, and am able to verify the URL (no iframes anymore!) - My bank has two methods of verification: scanning a QR-code with the mobile banking app on my phone, or logging into the online banking website (with a Vasco DIGIPASS 836, which requires a debit card+pin to generate a OTP) - I verify the amount and creditor in the mobile/online banking app, and sign the transaction with my mobile pin/digipass. - I am redirected back to the merchant. All in all, I think it costs me 30 seconds to complete the extra 3D-Secure steps when using my mobile banking app.
- Nullabillity 11y ago
  Sure, banks can do it really horribly (most of them), but some use it to force proper 2FA. For example, Nordea asks you to open their phone app and confirm the purchase (with a message that includes the total price) on there.

lifeisstillgood 11y ago

Let me say I vastly appreciate the honesty in your blog series having caught up just now. It's good to hear others have these worries and can learn - if painfully ! Good luck

maemre 11y ago

> My ideal credit card would be on where the physical card has e-paper on it with a 6-digit PIN that changes periodically, like 2-factor auth, and that PIN could be required for purchases to be authenticated. The new smart-chip cards don't help at all with online purchases, only point of sale. The banks and companies like Visa/MasterCard in Turkey use something called 3D Secure [1], in which you are directed to your bank's 3D secure page and enter a code that is sent to you via SMS and your CVC number so they have 2-factor auth. Most of the merchants I used in Turkey supported 3D Secure but I don't know the situation with other countries. Banks in Turkey still support the processing system that is currently used worldwide however some banks have an option where you can cancel all non-3D-Secure online transactions. Also the chip-and-PIN standard was conceived in 1990s AFAIK so the smart-chip cards are not new at all, they are just not adopted in some countries like US. [1]: https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure

elsjaako 11y ago

> My ideal credit card would be on where the physical card has e-paper on it with a 6-digit PIN that changes periodically, like 2-factor auth, and that PIN could be required for purchases to be authenticated. The new smart-chip cards don't help at all with online purchases, only point of sale. You may be interested in the system I use with my bank in the Netherlands. The old system worked like this: The bank gave me a device they called a "Random Reader". To make a payment, I had to insert my card into the device, enter my pin, enter a (random?) number that the payment site gave me, and enter the amount. It then gave me a number back that I had to give the website, which authenticated me. These days I use a "Rabo Scanner", which works the same except instead of entering a code and the amount it has a camera on there that scans a kind of barcode on the screen that contains that information. So it does use the smart-chip, and the (8-digit) pin changes every time you make a payment. You do have to take the device with you, but it isn't very big.