4 ms·

I work at a company with a fairly large number of transactions and we don't really have a problem with fraud. I don't know anyone else who's really battled it e

I work at a company with a fairly large number of transactions and we don't really have a problem with fraud. I don't know anyone else who's really battled it either. Is it much more prevalent for certain industries and products?

mperham 10y ago
Of course. I sell business software, never had a fraudulent transaction ever. But the video game and porn industries, for example? Tons of fraud.
- falafel_muncher 10y ago
  You can prevent a lot of fraud by simply requiring both a postal code and the CVV on the card. It's unlikely that a card thief has both pieces of data. (If you steal the physical card, you won't have the postal code, if you buy a database of cards, unlikely that they will have CVV's)
  - deleted 10y ago
    [deleted]
  - 20years 10y ago
    I wish this were true. We have both AVS and CVV checks on payments and things still made it through a property rental advertising service we run. It was an uphill battle until we implemented https://www.maxmind.com/en/minfraud-services https://www.maxmind.com/en/minfraud-services
  - Silhouette 10y ago
    But not all countries use postal codes, and checking of card registered address details is always a bit fuzzy simply because there may be several correct but different ways a legitimate cardholder might enter them.
  - rwmurrayVT 10y ago
    This isn't even remotely true. There's tens of thousands listed for sale for < 10 USD all over the web right now.
bedros 10y ago
I have my stolen identity in the past, and had over 15 transactions in next few days. most are buying credit for online services, like online data storage, care.com, etc. and to throw a curve ball, they created yahoo account with my first name plus extra characters and created a subscription to USA today, verified with my fake yahoo account, and sent it to my home. it happened after I went out with friends to a bar and they had my Amex and ID on a tap.
- slv77 10y ago
  Most likely the card was compromised from an online store weeks or months before hand. Cards that are stolen at brick and mortar stores have the CVV value from the magnetic strip and are more valuable than those stolen from online databases. Those are re-encoded and typically used at gas station pumps or other stores that haven't switched to chips. Cards stolen online typically come with the CVV2 and billing data that makes online fraud easier. At one time the Secret Service would analyze patterns in purchases to identify which merchants had been compromised. They wouod identify large databases of cards that had been compromised and would turn that information over to the card issuing bank. Given the cost of reusing the cards most banks would chose to mark the cards for additional surveillance instead of re-issuing the cards. At a conference one bank executive said that 20% of cards in the portfolio were marked this way. The net is that if you carry five cards it's probably that one is in the hands of a fraudster already.
20years 10y ago
Yes unfortunately. We run a property rental advertising service and are always battling fraud. We have had to implement tons of security features to try and catch things before they come through. Fraud is not an issue at all for our business SaaS products.
hibikir 10y ago
There are many kinds of fraud with different patterns. Some have a lot to do with what you sell, but others can affect anyone that takes credit cards. For instance, fraudsters that have received a bunch of stolen credit card numbers will want to test which cards are still good. They'll do that by making a small purchase at an online retailer, and if the charge clears, then use the card to get something illegitimately. While you might not be a good target for that second step, anyone that takes credit cards and has weak fraud protection steps will be a target. What one day looks like an unexpected spike in sales becomes a huge spike in chargebacks later, as all of those sales were fraudulent. I am pretty sure there's been stories in Hacker News about this.
- patmcguire 10y ago
  I remember I had to pay $10 cash to get an account on the Computer Science lab back in college. For some reason their credit card option became very popular as a way to test that cards still worked and they couldn't do anything about it.
tyingq 10y ago
The most common scenario where we experience credit card fraud is high value items ($500+) and a freight forwarder. The scammer orders the item, using the billing address of the legitimate owner of the card, but a shipping address that corresponds with a freight forwarding operation. These places offer a US address, but forward the shipments on to various places, including South America, islands in the Caribbean, etc. Typically, the legit card owner notices the transaction way after it's shipped, and files a chargeback. As with all "card not present" transactions, the shop owner then foots the bill, including a chargeback fee. It took about 3 times getting burned before we took the time to put some countermeasures in place. The most helpful were geo-ip location for the purchase itself, and a "flag this for review" filter for anything going to the Miami area and/or anything with a longish suite number, keywords (freight, global), etc. Edit: Worth noting that most credit card fraud solutions I've seen don't have a way to take the shipping address (as opposed to billing address) as part of the data to check. For the type of fraud noted above, it's vital. Geo-ip doesn't work well when the buyer is using a US proxy, or US based accomplice.
- patmcguire 10y ago
  Yeah, before your last line I was wondering, "does this story end with it being impossible to get anything delivered to those addresses deemed sketchy?" Guess not yet.
- X-Cubed 10y ago
  I understand your concerns as seller, but as a buyer located outside the US, blacklisting freight forwarders is really annoying, as it blocks access to legitimate buyers as well. The government-owned postal service in New Zealand, NZPost, run a service known as YouShop https://www.nzpost.co.nz/tools/youshop https://www.nzpost.co.nz/tools/youshop specifically to allow Kiwis to get access to products that are either only sold overseas, or would cost ridiculous amounts of money to ship via those sellers. They operate by providing a personal address in US, the EU, or China, backed by third-party freight forwarders.
  - tyingq 10y ago
    Unfortunately, the fraud rate is just too high for us to do otherwise. Additionally, it creates issues even with legitimate customers. If the product arrives with shipping damage, there's no way to know if it was caused by our shipper, or the freight forwarder. The customer, though, is quite sure it's our issue to resolve...
buttscicles 10y ago
I once worked at a startup that took payments on behalf of charities. Due to the pick-your-price nature of donations there'd be a lot of users who've bought or stolen credit card information testing to see which ones are still active by making charges small enough to go unnoticed. What sucked is that the charity would then be charged a fee when the card holder reversed the transaction.
emdowling 10y ago
Charities are a huge fraud target too. Often, stolen credit cards get run against donation portals for charities like the Red Cross to see if the still work and are valid (as the charges can be quite small). This costs the charities a lot of money in chargebacks and man power in dealing with it. Stripe's offerings here could prove invaluable in this scenario.

mperham 10y ago

Of course. I sell business software, never had a fraudulent transaction ever. But the video game and porn industries, for example? Tons of fraud.

falafel_muncher 10y ago
You can prevent a lot of fraud by simply requiring both a postal code and the CVV on the card. It's unlikely that a card thief has both pieces of data. (If you steal the physical card, you won't have the postal code, if you buy a database of cards, unlikely that they will have CVV's)
- deleted 10y ago
  [deleted]
- 20years 10y ago
  I wish this were true. We have both AVS and CVV checks on payments and things still made it through a property rental advertising service we run. It was an uphill battle until we implemented https://www.maxmind.com/en/minfraud-services https://www.maxmind.com/en/minfraud-services
- Silhouette 10y ago
  But not all countries use postal codes, and checking of card registered address details is always a bit fuzzy simply because there may be several correct but different ways a legitimate cardholder might enter them.
- rwmurrayVT 10y ago
  This isn't even remotely true. There's tens of thousands listed for sale for < 10 USD all over the web right now.

bedros 10y ago

I have my stolen identity in the past, and had over 15 transactions in next few days. most are buying credit for online services, like online data storage, care.com, etc. and to throw a curve ball, they created yahoo account with my first name plus extra characters and created a subscription to USA today, verified with my fake yahoo account, and sent it to my home. it happened after I went out with friends to a bar and they had my Amex and ID on a tap.

slv77 10y ago
Most likely the card was compromised from an online store weeks or months before hand. Cards that are stolen at brick and mortar stores have the CVV value from the magnetic strip and are more valuable than those stolen from online databases. Those are re-encoded and typically used at gas station pumps or other stores that haven't switched to chips. Cards stolen online typically come with the CVV2 and billing data that makes online fraud easier. At one time the Secret Service would analyze patterns in purchases to identify which merchants had been compromised. They wouod identify large databases of cards that had been compromised and would turn that information over to the card issuing bank. Given the cost of reusing the cards most banks would chose to mark the cards for additional surveillance instead of re-issuing the cards. At a conference one bank executive said that 20% of cards in the portfolio were marked this way. The net is that if you carry five cards it's probably that one is in the hands of a fraudster already.

20years 10y ago

Yes unfortunately. We run a property rental advertising service and are always battling fraud. We have had to implement tons of security features to try and catch things before they come through. Fraud is not an issue at all for our business SaaS products.

hibikir 10y ago

There are many kinds of fraud with different patterns. Some have a lot to do with what you sell, but others can affect anyone that takes credit cards. For instance, fraudsters that have received a bunch of stolen credit card numbers will want to test which cards are still good. They'll do that by making a small purchase at an online retailer, and if the charge clears, then use the card to get something illegitimately. While you might not be a good target for that second step, anyone that takes credit cards and has weak fraud protection steps will be a target. What one day looks like an unexpected spike in sales becomes a huge spike in chargebacks later, as all of those sales were fraudulent. I am pretty sure there's been stories in Hacker News about this.

patmcguire 10y ago
I remember I had to pay $10 cash to get an account on the Computer Science lab back in college. For some reason their credit card option became very popular as a way to test that cards still worked and they couldn't do anything about it.

tyingq 10y ago

The most common scenario where we experience credit card fraud is high value items ($500+) and a freight forwarder. The scammer orders the item, using the billing address of the legitimate owner of the card, but a shipping address that corresponds with a freight forwarding operation. These places offer a US address, but forward the shipments on to various places, including South America, islands in the Caribbean, etc. Typically, the legit card owner notices the transaction way after it's shipped, and files a chargeback. As with all "card not present" transactions, the shop owner then foots the bill, including a chargeback fee. It took about 3 times getting burned before we took the time to put some countermeasures in place. The most helpful were geo-ip location for the purchase itself, and a "flag this for review" filter for anything going to the Miami area and/or anything with a longish suite number, keywords (freight, global), etc. Edit: Worth noting that most credit card fraud solutions I've seen don't have a way to take the shipping address (as opposed to billing address) as part of the data to check. For the type of fraud noted above, it's vital. Geo-ip doesn't work well when the buyer is using a US proxy, or US based accomplice.

patmcguire 10y ago
Yeah, before your last line I was wondering, "does this story end with it being impossible to get anything delivered to those addresses deemed sketchy?" Guess not yet.
X-Cubed 10y ago
I understand your concerns as seller, but as a buyer located outside the US, blacklisting freight forwarders is really annoying, as it blocks access to legitimate buyers as well. The government-owned postal service in New Zealand, NZPost, run a service known as YouShop https://www.nzpost.co.nz/tools/youshop https://www.nzpost.co.nz/tools/youshop specifically to allow Kiwis to get access to products that are either only sold overseas, or would cost ridiculous amounts of money to ship via those sellers. They operate by providing a personal address in US, the EU, or China, backed by third-party freight forwarders.
- tyingq 10y ago
  Unfortunately, the fraud rate is just too high for us to do otherwise. Additionally, it creates issues even with legitimate customers. If the product arrives with shipping damage, there's no way to know if it was caused by our shipper, or the freight forwarder. The customer, though, is quite sure it's our issue to resolve...

buttscicles 10y ago

I once worked at a startup that took payments on behalf of charities. Due to the pick-your-price nature of donations there'd be a lot of users who've bought or stolen credit card information testing to see which ones are still active by making charges small enough to go unnoticed. What sucked is that the charity would then be charged a fee when the card holder reversed the transaction.

emdowling 10y ago

Charities are a huge fraud target too. Often, stolen credit cards get run against donation portals for charities like the Red Cross to see if the still work and are valid (as the charges can be quite small). This costs the charities a lot of money in chargebacks and man power in dealing with it. Stripe's offerings here could prove invaluable in this scenario.