3 ms·

If a system requires that it be a black box to prevent abuse, you should use another system. A black box with flaws that allow abuse is difficult to fix. With a

• derefr 10y ago
  The problem is not "flaws" being protected in a security-by-obscurity sense. Rather, it's that these predictive models mostly consist of linear combinations of metrics. (By necessity: "linear combinations of metrics" is usually what most accurately reflects the real world.) If you know exactly which factors, at what weightings, a given predictive model has, you can build a simple function to spread out your fraudulent activity that will ensure that you never exceed their fraud threshold in your aggregate score. Say someone's anti-fraud model uses two factors: P(using a prepaid card) and P(using a Nigerian postal address). If you know the weights on those two factors are (0.3, 0.7), and you know that the system says "fraud" when you score above 1.0, then you can still do both of those things, just so long as you never do them both at the same time. Basically the only thing that makes these systems useful at all is that their input-factors and weights are hidden information. There is no anti-fraud system that would survive being public; they'd all, as a class, be rendered instantly useless.
  • Dylan16807 10y ago
    "Useless" is a pretty big exaggeration. Harshly limiting the methods of scammers is still valuable.
    • MertsA 10y ago
      But you can't really harshly limit their methods. So long as a scammer uses the exact same method as a real customer would use he can get away with it. The effectiveness of fraud detection is finding where the scammer slipped up.
  • deleted 10y ago
    [deleted]