4 ms·

Should that have really been your concern? If every company that processes cards has to be fraud detecting experts, then they CC system is totally broken.

gcb0 10y ago
it is.
notwhereyouare 10y ago
we lost thousands in a couple weeks due to fraud and had to up our game in detecting fraud and now are overzellous in rejecting cards due to fraud
- nitrogen 10y ago
  I cynically wonder if any anti-fraud companies have posted vulnerable sites to carding forums to help make a sale.
  - wruza 10y ago
    Of course they did! Escalating that was an instant win-win-win.
a3n 10y ago
As Harry Tuttle said, "We're all in it together." https://www.youtube.com/watch?v=xlCPkmb6cuY https://www.youtube.com/watch?v=xlCPkmb6cuY Which is why it pisses me off when a company deploys insecure software or hardware, claiming that network security is the customer's responsibility. So my home network should be reasonably secure, so that it doesn't become part of a bot net. Which means that I have to, or should, become at least knowledgeable enough to know what to buy, what to do, and what not to do. Which means that my router vendor better step up and sell me something secure. Is it the responsibility of end users to submit bug tickets? I think it is. Is it the responsibility of end users, or the vendors receiving reports, to publish discoveries of exploits in the wild? I think it is. Is it the responsibility of a pedestrian who notices a skateboard on the sidewalk to move it aside and upside down so no one does a splat fall? I think it is. We're all in it together.
- Jarwain 10y ago
  I heard a neat definition of responsibility the other day: "If it is to be, it's up to me"
- Retra 10y ago
  This is why I get angry at people who say things like "mind your own business" or "that's not your job." It is, and it is. Anyone who doesn't like that can take their own advice.
- jasonkostempski 10y ago
  I get that, but the problem is we all accepted the system into our lives before it was ready and now the key players have, by their own design, no incentive to improve. Who do we submit bugs to in this scenario?
tyingq 10y ago
>If every company that processes cards has to be fraud detecting experts, then they CC system is totally broken. That is 100% the case, at least in the US, for card-not-present (online, phone, etc) transactions. The credit card companies have zero liability for fraud in those cases...the liability is 100% on the merchant seller. In fact, the CC companies collect a non-trivial chargeback fee, so they arguably profit from the fraud. Predictably, since they have zero risk, they provide almost zero fraud protection for sellers. For example, if they changed the system to accept data like "shipping address vs just billing" or "ip address", they could use their aggregate view to squash A LOT of fraud.
- dahdum 10y ago
  Many processors do have fraud checks that work quite well, and you can always use services like Amazon Payments which includes fraud protection.
  - tyingq 10y ago
    Some do, but they are working with a much smaller subset of data than would be possible of the cc companies were to do it. The quality of a real anti fraud solution, if it were to include all data, could be amazing.
- was_boring 10y ago
  It sounds like you've stumbled upon the next great way for credit card networks to make money! Charge for fraud detection, and if a customer doesn't want fraud detection, then do the chargebacks. I'm kind of surprised they don't do this already (or maybe they do?). It's win-win either way for the credit card network.
  - digi_owl 10y ago
    To me that sounds like borderline racketeering.
bemmu 10y ago
It does seem to be broken and yes, if you run an online store it seems we have to be somewhat informed about CC fraud.

gcb0 10y ago

it is.

notwhereyouare 10y ago

we lost thousands in a couple weeks due to fraud and had to up our game in detecting fraud and now are overzellous in rejecting cards due to fraud

nitrogen 10y ago
I cynically wonder if any anti-fraud companies have posted vulnerable sites to carding forums to help make a sale.
- wruza 10y ago
  Of course they did! Escalating that was an instant win-win-win.

a3n 10y ago

As Harry Tuttle said, "We're all in it together." https://www.youtube.com/watch?v=xlCPkmb6cuY https://www.youtube.com/watch?v=xlCPkmb6cuY Which is why it pisses me off when a company deploys insecure software or hardware, claiming that network security is the customer's responsibility. So my home network should be reasonably secure, so that it doesn't become part of a bot net. Which means that I have to, or should, become at least knowledgeable enough to know what to buy, what to do, and what not to do. Which means that my router vendor better step up and sell me something secure. Is it the responsibility of end users to submit bug tickets? I think it is. Is it the responsibility of end users, or the vendors receiving reports, to publish discoveries of exploits in the wild? I think it is. Is it the responsibility of a pedestrian who notices a skateboard on the sidewalk to move it aside and upside down so no one does a splat fall? I think it is. We're all in it together.

Jarwain 10y ago
I heard a neat definition of responsibility the other day: "If it is to be, it's up to me"
Retra 10y ago
This is why I get angry at people who say things like "mind your own business" or "that's not your job." It is, and it is. Anyone who doesn't like that can take their own advice.
jasonkostempski 10y ago
I get that, but the problem is we all accepted the system into our lives before it was ready and now the key players have, by their own design, no incentive to improve. Who do we submit bugs to in this scenario?

tyingq 10y ago

>If every company that processes cards has to be fraud detecting experts, then they CC system is totally broken. That is 100% the case, at least in the US, for card-not-present (online, phone, etc) transactions. The credit card companies have zero liability for fraud in those cases...the liability is 100% on the merchant seller. In fact, the CC companies collect a non-trivial chargeback fee, so they arguably profit from the fraud. Predictably, since they have zero risk, they provide almost zero fraud protection for sellers. For example, if they changed the system to accept data like "shipping address vs just billing" or "ip address", they could use their aggregate view to squash A LOT of fraud.

dahdum 10y ago
Many processors do have fraud checks that work quite well, and you can always use services like Amazon Payments which includes fraud protection.
- tyingq 10y ago
  Some do, but they are working with a much smaller subset of data than would be possible of the cc companies were to do it. The quality of a real anti fraud solution, if it were to include all data, could be amazing.
was_boring 10y ago
It sounds like you've stumbled upon the next great way for credit card networks to make money! Charge for fraud detection, and if a customer doesn't want fraud detection, then do the chargebacks. I'm kind of surprised they don't do this already (or maybe they do?). It's win-win either way for the credit card network.
- digi_owl 10y ago
  To me that sounds like borderline racketeering.

bemmu 10y ago

It does seem to be broken and yes, if you run an online store it seems we have to be somewhat informed about CC fraud.