5 ms·
I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used
by Osiris 11y ago
I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees.
I ended up implementing a system using Braintree to do
1) Request an AUTHORIZATION for the amount
2) If the AUTHORIZATION fails, return the error (sounds like I need to change this part, but how to do it without hurting legitimate users?)
3) Send information, including IP and email address, to minFraud
4) If the minFraud riskScore is >= 20, request a VOID on the authorization request
4b) If the riskScore is low, submit a REQUEST SETTLEMENT on the AUTHORIZATION
This has worked extremely well, but a few still slip through the minFraud check.
Even though Braintree offers it's own fraud checking, I still feel more comfortable with minFraud. I really wish that processors like Braintree would put more effort into fraud detection.
I NEVER have this issue with PayPal transactions. Even if it's fraud, they just reverse the transaction and there's no chargeback fee.
- TylerE 11y agoWhy not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?
- epa 11y agoFor some simple companies, this may be the right answer. However this grows in complexity as your business scales so don't forget about that.
- bduerst 11y agoA simple situational cost/benefit analysis can answer that. If combating CC fraud is leading to negative profits in those countries then cut them. If not, continue the war.
- siberianbear 11y agoI am a native-born American citizen living in Russia. The amount of grief that your solution causes me is significant. I'm a legitimate customer who does nothing fraudulent. However, whole swaths of the internet treat me as if I have leprosy just because my IP address is in Russia.
- omarchowdhury 11y agoSo use a VPN, buddy.
- goodJobWalrus 11y agoSo, I use VPN, and order my stuff to arrive where? If someone doesn't ship to Russia, they don't ship to Russia, how can VPN help there?
- bitserf 11y agoFreight forwarders are how most of us outside of the US get stuff from companies that only ship to the US - There must be a market for such services that ship to Russia too.
- TylerE 11y agoSure, but you've just made fraud cost them actual money.
- jackvalentine 11y agoAs a seller, it is not your responsibility to compensate for the fraud issues impacting your customer's ability to participate in the marketplace without it being worth it. I don't know exactly what causes Russia to be a fraud hot spot but Australia not to be, but the issue can only really be resolve inside Russia.
- rubber_duck 11y agoCouldn't you use VPN ? On the other hand so could the scammers if you could.
- jackvalentine 11y agoI don't know how to say this without coming off harsh, so I'll say it and ask you to use the principle of charity when reading it. If the Russian state refuses to stamp out crime that is causing negative externalities, then people should rightly stop dealing with people inside Russia as a logical response.
- bcoates 11y agoBecause it's trivial for Vietnamese carders to pretend to be from any country they need to be if you're checking? They don't even need to actually get your delivery to win, they're just tasting for validity.
- kweks 11y agoWe ran a fairly prominent online store for two years, and had huge amounts of fraud from the countries you mention. We essentially stamped it out overnight by giving false positives. If we detected and order as fraudulent (and you can do it in a number of ways, that you seem to be doing) - we'd show a 'Successful Order' page and send them a success email. The guys that were pre-testing cards had bad data, and the guys trying to fraud would have to wait .. weeks to find out nothing came in the mail, and then try again, unsure what got them caught in the first place. Personally, I'd avoid trying to interract with their card. Authing / voiding is going to cost you money, and if it slips through, you'll get a chargeback. We only ever had one 'false positive' (or false-negative..?) - the guy emailed us inquiring about his order, we took some extra steps to check his card, and the problem was solved.