5 ms·
I designed the fraud prevention for a major ecommerce site(PCI Level 1). We used to get hit with lots of card testing including bot nets. They are easily mit
by adrr 10y ago
I designed the fraud prevention for a major ecommerce site(PCI Level 1). We used to get hit with lots of card testing including bot nets. They are easily mitigated. First thing is detune your error messages. Combine all the errors into one generic message. This includes AVS, CVN, and Expiration. I've see so many sites return the raw message back from the processor.
We also actively black holed large blocks IP addresses including TOR exit nodes and open proxies. Before all the privacy people make comments. We're a store. If you show up wearing a ski mask we aren't going to sell to you.
Sometimes we go on the offense and detect the patterns/attributes for the botnets that allowed us distinguish them from real traffic. We didn't block them, we fed them bad data. That made them go away fast.
Most important take away: Mitigating fraud will lead to higher auth success rates as you build up the reputation on your MID(Merchant ID). Its not only important in preventing chargebacks but increasing revenue.
- politician 10y agoRegarding error messages: At a previous gig, we had to aggressively and repeatedly fight the business side who thought that vague credit card error messages were a large source of user confusion. Eventually, we won but it was certainly an eye-opening moment for the developers involved to even have to fight that battle.
- fphhotchips 10y agoAs a programmer, I get it, but as a user there's been a few times where I fat-fingered a number or an address and the payment failed - it was then a minor PITA to figure out exactly what I got wrong.
- adrr 10y agoScore your users based on attributes like whats in cart, IP reputation, browser/os, pages visited, source,3rd party fraud detecton providers etc. Score should reflect how likely the user is genuine or not. For well scoring users which should be 90% of your traffic, provide them with detailed messages.
- dawnerd 10y agoI wish sites like newegg would treat customs with successful transactions as safe. I've had many times where they've outright canned an important order for really no reason. Trying to get them to accept it is a whole other hassle.
- curun1r 10y agoI've had the same argument many times over error messages for login and forgot password flows. Being security conscious is a way of thinking that many people aren't really capable of and an even greater number have problem maintaining consistently. It's so ingrained in product managers to make their software as friendly as possible that they forget that sometimes their users don't have similarly noble intentions. This is also why social engineering is so successful. When it's your job to be helpful, it's very difficult to be strategically unhelpful when necessary.
- pavlik_enemy 10y agoIf you have a sign-up page, the usual "invalid email or password" message on sign-in form doesn't increase security.
- ian0 10y agoThere are tradeoffs, you have to balance security with usability. Generic payments failure messages are responsible for a lot of frustration in users, especially users who are paying online for the first time and have to go through complicated payments processes like 3D secure.
- ian0 10y agoIts opposite in my experience. Detuning error messaging will increase abandonment as users wont know how to recover from errors (Eg invalid CVV) - thereby decreasing revenue. Its especially true where something like 3D secure is in use and failure messages varied. Ive also never seen risk based authentication based on MID in place at issuers (Im in SEA it could be different in more developed markets). Rather they have blanket bans on MID or categories of MID with high fraud-to-sales ratios. Payments processors and acquirers have fraud detection systems, but they will score not actively decline. So while someone abusing your service may land you in hot water, reducing their ability doesn't necessarily mean a higher authorization rate for regular transactions.