17 ms·

Credit card fraud warning signs

302 points by hamstercat 8y ago

illustrioussuit 8y ago
I like how the author doesn't immediately reject orders if they have just one sign (IP address country different from shipping country, shipping to a reshipping center, etc.) but looks at all the indicators as a whole to make a decision. Edit: isn't this how Stripe Radar[1] works? [1]: https://stripe.com/us/radar https://stripe.com/us/radar
- zrail 8y ago
  Yes, Stripe Radar will automate most of these checks. They also have the benefit of being able to see other merchants' transactions within their network, which helps when someone tries test transactions across a bunch of different merchants all at the same time from the same IP.
- Raphmedia 8y ago
  From my experience, nothing drives users away faster than a false positive on a fraud check. You immediately lose all trust in the eyes of the users.
  - bpicolo 8y ago
    Yeah, but that's something you have to accept for the positive benefits. In a lot of online businesses, credit card fraud is just insanely rampant. You lose a lot more money by not doing checks with the occasional false positive than you do by not having it. The cost of fraud is chargeback fee (usually ~15 bucks) + merchandise. It gets expensive fast. Every modern e-commerce business has to be fighting it now to stay alive. For certain SaaS / Software products the cost of failing to fight it is a tad lower, but for physical products it's killer.
    - Raphmedia 8y ago
      Sure, you can't ignore fraud. We have a lot of those each months. What is more important is to have a smart way to detect the frauds. Most clients that had received false positives never came back even with discount codes and apologies. Nobody likes getting stuck on a checkout page with an error message telling them they are in the wrong.
      - alexbeloi 8y ago
        One way to optimize is to maximize expected revenue - expected cost of false positives or fraud. A savvy business will know (or can estimate): customer lifetime value, false/true positive/negative rates of their fraud detection system, rate of charge-backs, expected rate of fraudulent purchases, revenue from given suspected transaction. If average discounted customer lifetime value is $10k, charge-back rate is 2%, your fraud detection false positive rate is 0.1% and true negative rate is 99.9%, fraud detection true positive rate is 95% and false negative is 5%, customer is purchasing a $20 item. Then * expected revenue if purchase is fraudulent: $0 * (true positive rate) - $20 * (false negative rate) = -$1 * expected revenue if purchase is non-fraudulent: $20 * (true negative rate) - $10k * (false positive rate) = $9.98 * total expected revenue value (with fraud detection enabled): (expected revenue if purchase is fraudulent) * (rate of fraudulent purchases) + (expected revenue if purchase is non-fraudulent) * (1 - rate of fraudulent purchases) = $9.7604 Without fraud detection, your expected revenue is: $20 * 0.98 = $19.6 Simplifying assumptions: false positive results in complete loss of customer value (realistically, replace this with big drop in customer lifetime value). Fraud rate is constant (realistically, should be modeled). Fraud rate is charge-back rate. In this case, it's easy to see that seemingly low 0.1% false positive rate is still too high for this small of a purchase and these customer lifetime values. The 'smart' decision would be to ignore fraudulent purchases of this size in this case. (for this scenario, you need FPR below 0.004% with all else same) Better model still would be a fraud detector that outputs a confidence score rather than "yes/no", and use the formula above to determine if the predicted false-positive-rate at this confidence level is sufficiently high to expect a revenue uplift from enabling the detector.
      - nucleardog 8y ago
        Or even better, one retailer I dealt with that did all their fraud checking manually after charging you. So they took my money, decided they wouldn't sell to me, then I had to wait a week to get my money back. At no point did they so much as call or email me to try and see if we could correct any issues with the information before initiating the refund. I've spent more on identical products from other retailers just to avoid them.
    - notatoad 8y ago
      >The cost of fraud is chargeback fee (usually ~15 bucks) + merchandise. that's the least of the cost. the real cost of chargebacks is in the processing rate increases.
  - yani 8y ago
    Fully agree. It multiplies the anxienty for a novice online shopper.
  - slivanes 8y ago
    I see it differently. A merchant who takes fraud seriously is someone I would trust more.
    - Someone1234 8y ago
      I had NewEgg flag a transaction of mine as fraudulent in 2009, they just silently cancelled it then gave me strange errors on the order status page. When contacted they said the transaction was flagged and there was nothing they could do. I didn't use NewEgg again until 2017 as a direct result. That one bounced transaction (and frankly how they handled it) cost them six years worth of business that Amazon got (talking easily $3K+). I think you're the edge case. Most customers will be somewhere between put out and outright angry.
      - slivanes 8y ago
        The problem I see is NewEgg handled it poorly, it doesn't sound right that there wasn't anything they could do. That's NewEgg's problem and nothing wrong with actually flagging a transaction that requires a manual investigation.
      - reaperducer 8y ago
        Not even angry or slighted. People will just assume that Merchant X doesn’t ship to their area and they never go back because they never receive any information to the contrary. I’ve only been flagged once, and that was when I was a new B&H customer. A quick phone call fixed the problem and in spite of changing addresses at least ten times since then, haven’t had a problem since. However, it is occasionally a problem that B&H won’t ship to hotels.
      - inetknght 8y ago
        On the other hand I've shopped with NewEgg since 2005. I've had orders flagged as fraud once in a while both from NewEgg and also (more often, actually) from the bank when they receive the charge from NewEgg. While quite annoying, it is one of the many reasons I continue to order from them.
      - ggg9990 8y ago
- notafraudster 8y ago
  It seems to me like the author doesn't actually do anything programmatically, and instead has few enough orders that they eyeball it and do additional human steps. A good start but not scalable.
jdietrich 8y ago
Don't roll your own crypto, don't roll your own fraud prevention. Stripe include very sophisticated fraud prevention in their standard pricing and charge pennies per transaction if you're on custom pricing. Numerous third-party providers offer excellent fraud detection and prevention tools for CNP transactions. Unless you're big enough to have a dedicated fraud prevention team, just leave it to the professionals.
- sbov 8y ago
  I've never used stripe specifically, but in my experience its always good to have your own layer of fraud prevention, because if you have too much fraud reach whoever is providing payment processing, they will terminate your account. Beyond that, a few simple checks will make most fraudsters move onto other websites. It's not about being bulletproof, it's about being harder to abuse than the others.
  - bpicolo 8y ago
    I think the point is that it's very hard to do as good a job as providers like Stripe and SiftScience will do (assuming machine learning against fraud is not your core competency) - they take into account a lot of the signals you might take into account anyway if you feed them clean data. Better to focus on sending them the clean data.
    - yani 8y ago
      Exactly the opposite. Generic fraud checks will perform worse
      - bpicolo 8y ago
        They're not generic, though. Those providers build custom ML models specifically from your data (and they pull in a ton of signals for this), and then have the data of many other merchants to work with. At a previous employer we found both of those products to be effective.
stronglikedan 8y ago
> Later on when the post attempts to deliver it, they will at some point realize that the country is wrong and reroute it to the correct country Will they? Or will they return it to sender with a bad address note? Would the rates be different by country?
- dawnerd 8y ago
  Maybe it depends on your shipping deal? Thinking they might just charge the account the different?
- rocqua 8y ago
  I recall we once sent something from the Netherlands to Canada, but didn't include the country. We later got a surprised email by the recipient that they received the mail despite it not including the country. I suppose the post office decided to do some digging and managed to deliver correctly.
  - Scoundreller 8y ago
    I'm pretty sure my domestic package to Newfoundland ended up in your country, and then back. My buyer reports it isn't the first time that's happened to him.
- reaperducer 8y ago
  USPS used to have huge offices at its distribution centers with people who figure out bad addresses. At one time you could send a letter to a particular famous person (I can’t remember if it was an actor named “Rip” or Mr. Ripley from “Ripley’s Believe it or Not”) by simply putting a rip in a blank envelope. I bet the U.K. has massive departments for this since so many addresses are just something like “Stuffypants House, Humberside.”
  - Symbiote 8y ago
    > “Stuffypants House, Humberside.” British people who live in places with address like that tend to go the opposite way, and add superfluous lines: Lord and Lady Cockwomble Stuffypants House Glebe Farm Cross Road Ulceby near Thornton Curtis Barton-upon-Humber Humberside When the official database (and preferred form) for the address will have something like Glebe Farm Cross Rd ULCEBY DN39 6TR The postcode tends to identify between one office in a building and about 30 houses, so with that and the building name/number the rest doesn't matter. You can paste that one into Google and change the last letter to see it move slightly.
dawnerd 8y ago
Fraud prevention can also be extremely annoying to customers when not done correctly. I've yet to be able to buy something from newegg without them cancelling the order saying its fraudulent. I'm not sure why they still continue to flag my orders considering I've contacted them every time and they've ended up authorizing it. At least now they don't immediately blame my credit card... If it was a smaller company and more of an impulse buy I could see a bad system definitely hurting sales. I'd probably not order from newegg again if they weren't one of the few places that ship harddrives correctly and have reasonable prices.
- ryan-c 8y ago
  I bought a laptop from HP about a year ago, and they canceled my order after shipping it, having FedEx return it to them. I'm still mad about it.
- Matheus28 8y ago
  I've had issues mainly with manufacturers web stores. Fender apologized and gave me the part number for the exact model I wanted and suggested I try third party stores. EVGA was annoying. They called me at 10 am to confirm details, put me on a three way call with my bank and I thought that was it. For whatever reason they tried to call me again the following day but I couldn't answer, when I called them back they told me they cancelled my order. They said my billing details didn't match (simply not true, I've used that address countless time and checked my order confirmation), and that my phone area code didn't match where I lived (no shit, people move...). I decided to just never buy from them again, since there are plenty of other GPU manufacturers.
  - nucleardog 8y ago
    At least EVGA tried to resolve it. I tried to order from an computer component retailer here in Canada. They specifically called out that my information needed to match, so I went and logged into my credit card's online portal and copy and pasted my information directly. However what I didn't think to copy and paste was my own fucking name. After charging my card and taking my money automatically, they then seemingly manually went to review the transaction and found that something didn't match, though were apparently unsure as to what that might be. When I sent them a screenshot of my online banking portal showing all my information with a "Wtf?" their response was "Oh, it's probably your missing middle initial. Also we've already refunded your order so there's nothing we can do. You should have your money back in a week." When I asked them why the hell on top of a completely user-hostile validation process they then make it worse by cancelling and processing the refund before even calling me or emailing to give me a chance to correct the information, their response was basically that that's how they have to do it and it's outside their control and shrug. Needless to say when I finally got my money back a week later I spent it elsewhere.
ohthanks 8y ago
I periodically deal with recurring fraud from what seems to be a pretty organized network. - Orders are placed with stolen credentials with correct billing info that matches AVS. - Shipto address are located near billing info, typically in the same state/metro area. - They are often rural addresses, trailer parks, what appear to be rent houses that may be empty. - Phone number provided has correct area code and rings a call center that has stolen billing info available and will confirm billing address order details verbally. - Ip is geolocated at/near the billing info area via a proxy. - Email addresses are often setup on custom domains. We catch them, but only because they don't vary the pattern much and we know what to look for. I don't know how fraud tools would be able to effectively filter in these cases without a lot of false positives.
- blackice 8y ago
  Another easy & free thing you can use is proxy detection, sites like https://getipintel.net https://getipintel.net would beneficial in preventing fraud.
  - chipperyman573 8y ago
    FWIW this website is 82% certain that my IP (university) is a VPN/Proxy/Bad IP.
    - Symbiote 8y ago
      It's 94% certain the VPN endpoint IP my work VPN (only 25 people, university IP) is a VPN/proxy/bad. That's correct, but not at all correlated with us being likely to commit fraud. It's 79% certain the office LAN NAT gateway IP is a VPN/proxy/bad. My work desktop's static IP gets 23%, so that's something. My home IP gets 60%. (Is this thing just connected to a random number generator?)
    - slivanes 8y ago
      A lot of students have buyer remorse when they realize the money they just spent online could have been used more wisely. Unfortunately, when a network has a small percent of bad actors, the network as a whole is punished.
deleted 8y ago
[deleted]
47 8y ago
If you really care about your customer you should be worried about false positive. I hope as a business you do not cancel customer orders because your fraud detection system has flagged them. Depending on your scale you may using 3rd parties like Sift science, Stripe Radar or Roll your own fraud detection system. Flagging orders as potential fraud is the easier part these days. The difficult part is how to come up with a process to verify these flagged orders. This process need to be simple and quick. Because essentially you are saying to your customer we think you are a fraud and can you prove that your not. Banks merchant checks to verify flagged orders is extremely cumbersome. They require you to call a special phone number (which is different for each bank) provide customer Name, Billing Address, Billing Phone and Credit Information. Then they can only give you a response whether it is a match or not. They can't tell you whether it has been reported stolen or anything else for privacy reason. At scale this is a very time consuming process. It becomes even more cumbersome if you are security conscious business and do not store customer credit card information. In that case you have to communicate with the customer asking them to call you to provide your credit card information again. There are solutions like 3D Secure but they are not widely supported and adds its own problems. It is high time credit card companies start providing merchant with a 2nd factor check for transaction. For example maybe once a transaction is placed with a merchant. They can trigger a 2nd factor check where by the bank automatically send a code to their email/phone number on file. If the customer is able to provide a correct code merchant can proceed with the order. Fraud detection will always remain a point of contention between customer and businesses. I just hope business make sensible decision based on their situation. For example I have seen legitimate customer with all the above cases mentioned in the article.
- kristianc 8y ago
  The OP has written extensively about this subject in the past, and I get the sense that he is intimately aware of the risk of false positives, however catching a high volume of fraud could for him literally be the difference between staying in business and not. His fraud tolerance is going to be much much lower than a large vendor.
- dcbadacd 8y ago
  Reading all of these issues I'm really flabbergasted that you have such issues. Like, my bank offers me temporary non-physical credit cards with small limits for 1€/month/piece and that's what I use to do all my online purchases with, do US banks really not have that option? Second thing that I often use (where possible) wire transfer, it requires my ID-card and the payment is done in seconds. This thread has honestly made me really appreciate what I have available to me compared to some countries.
inetknght 8y ago
I find it strange that the de-facto thing to do for fraud is to simply not accept the order. Why not report the fraud to authorities instead?
- kogir 8y ago
  Time. Nothing will come of it and it will cost you your wasted time.
- michaelbuckbee 8y ago
  Fraud falls into a weird category of crime where: - happens globally (far outside of local police jurisdiction) - per event small monetary value - widespread but difficult to tell how connected (is it tens of thousand of fraudulent events from a single actor or tens of thousands of different actors?) All of which adds up to there not being a clear cut law enforcement agency to handle these types of things (aka you can't reasonably ask the local police to help you track down a scammer in singapore).
  - splonk 8y ago
    Yeah, essentially no local law enforcement is going to care about some guy successfully scamming you for a $100 chargeback. We were basically told not to bother for anything under $25k from a single actor, and even for amounts over that I think we only managed to get law enforcement action through personal contacts. I think the one case that law enforcement did act on was a group that was using a newly built neighborhood as a drop point for stolen goods. It was complete enough that there were addresses to ship to, but nobody was living there yet, so it was easy to just pick up packages off the front steps. From what I heard, the police ended up picking up some guy with a truck full of iPods who was just going house to house picking up the deliveries.
  - chrischen 8y ago
    Yes I tried to report CC fraud (as a merchant) and the local departments kept bouncing me back and forth between my local police and the department at the fraudster’s jurisdiction. I had address, email, IP, and name, yet no one could do anything.
4ad 8y ago
> Using an inconsistent and unlikely email address [...] By "unlikely" I mean one that no reasonable person would want to have, usually containing a big batch of numbers in it. This is awful. I create random e-mail addresses for every online merchant I have to interact with. It's by far the best way to avoid both real spam and "promotional message" spam. I don't even use my "real" domains, because anybody who knows my name and the domains I use can construct my personal e-mail addresses. I have special domains dedicated to online commerce, and they look pretty random.
- cortesoft 8y ago
  If you go out of your way to appear fraudulent, you can't be angry when you get flagged as fraudulent. What do you want merchants to do? It appears you have gone out of your way to make sure all your information is completely unconnected to you, which is exactly the case for someone committing fraud.
  - kodablah 8y ago
    > What do you want merchants to do? Accept a certain amount of loss in exchange for fair customer treatment. Obviously this isn't binary, but for something like an email address, it can be considered a factor, but should not be a determining one.
    - chipperyman573 8y ago
      >something like an email address, it can be considered a factor, but should not be a determining one. The article specifically states that no one indicator will result in a payment being denied. There aren't any determining factors in this system
      - kodablah 8y ago
        True. I mean in the general case.
    - notatoad 8y ago
rb808 8y ago
CC fraud is such a big problem, it must be a huge advantage for Amazon. Most of their purchases come from repeat customers that they can be confident exist. Smaller shops have to figure that out nearly every purchase. I never thought of that before. Maybe there should be a central shared central repository of who are known good customers/address/cc combinations, or maybe that is what stripe etc do already.
- singlow 8y ago
  There are services that do this. Several retail stores I consult for have transaction filtering through an independent fraud detection service which has its oen blacklists of hashed CC numbers, emails, and street addresses. They also evaluate the ip address, distance fom billing and shipping addresses and a slew of other factors.
  - santiagogo 8y ago
    Which do you recommend? I work with custom solutions for banks which a lot of times include fraud prevention services from third parties, so I'm consistently benchmarking for better alternatives.
  - bleachedsleet 8y ago
    Criminals have many tools that can circumvent these systems though and many are very hard to defeat while still providing a smooth customer experience. There are entire web browsers developed by Russian groups that exist solely to clone the entire fingerprint of the victim, complete with session cookies. A lot of bank fraud happens this way...a hidden RDP service is installed on victims machines and then sold online so you can just remote into their computer, login to their bank and nobody is the wiser. There are services to conduct COBs (change of billing) so you can get new credit cards shipped to fake addresses under the attacker's control. And nearly all online bank account/CC sellers usually include cookies with the stolen cards now. Criminals have quickly figured out that a VPN in the general location of the victim is no longer good enough and they've adapted much faster than security systems can keep up with. There's also still a very big and unfounded trust system between certain merchants and certain banks. For example, AMEX cards sell for much more on the markets because many merchants (including Amazon) will usually assume trust in those cards even if other factors seem a bit off and will often ship products before fully confirming the transaction, so even if the card is flagged, it's likely a criminal could still steal a product or two. This is nonsense and despite being well known information to anyone that's spent even a little time researching fraud networks, it remains an exploitable loophole.
madamelic 8y ago
Reshipping centers, I don't want to sound weird, are basically hives of scum and villainy in my opinion. I was selling something Ebay (a phone) and I got a really weird address, it was a shipping center. I googled around because I got a strange vibe, apparently, this shipping center had this issue all the time and didn't really care to stop it. I got a horrendous review from the person because I canceled the order and refused to ship it. I am wondering if fraud is honestly the business model of shipping centers. I can't really think of a good use for them nowadays, especially in a consumer context.
- post_break 8y ago
  I want to buy something that doesn't ship to my country, I use a shipping center.
- zeroxfe 8y ago
  Reshipping centers are used heavily by people outside the US to get access to goods sold online. Tons of stores (especially on Amazon) don't ship outside a few select countries, so customers pay a small fee to these reshipping centers to have packages forwarded to them.
  - zodPod 8y ago
    Do they do the opposite too? I feel like there have been frequent times I've bought Chinese components (like bulk LEDs or something) on eBay from a seller that has an address in the US but it still took a long time (about on par with shipping from China) to get to me. Could that have been a person living in China selling stuff on ebay and having an address listed in the US to trick me?
    - dahdum 8y ago
      Those are dropshippers, many of those items you can order from Alibaba / Aliexpress and skip a layer of reseller.
      - 8y ago
jerzyt 8y ago
I've had a case of someone walking into a Verizon store and buy 4 new iphones and charge it to my account. The amazing thing is that between phones, tablets and hot spots, my family has 7 mobile devices. The perpetrator did not upgrade any of the existing phones, but created 4 new phone numbers. This should have been a huge warning sign. I'm 100% convinced that the person at Verizon was in on this. In addition, over the next few days, they've made thousands of dollars in international calls. To Verizon's credit, they were great at resolving the mess for me as an individual customer, but in the end they ate the cost, which means that it got diluted to all the customers.
mleonhard 8y ago
I love the artwork behind the article: https://www.candyjapan.com/static/credit-card-fraud_s.png https://www.candyjapan.com/static/credit-card-fraud_s.png
stef25 8y ago
Doesn't Stripe cover some / most of this? There are some settings, or at least an overview in the dashboard where you can see if the address was verified and it matched the one on the card. Using billing / shipping address in your order form is obviously for this reason.
namibj 8y ago
In Germany we have a system called 'giropay', which is basically instant wire transfer via your online banking. With this system the merchant gets a guarantee from the consumer's bank (as it seems, but I am not sure who in the pipeline eats the cost, as the contracts are ask-only), so that even if there was fraud, he will not loose the money. This does limit it to 10k EUR per transaction, which should be enough. The merchant receives the money within 2 bank days in his account, and the max fees for the merchant are 0.89% with a minimum of 33ct, but volume discounts seem likely. What I don't understand, is why the US was not able to set such a system up, but I assume it's related to the general distaste for chip+pin, as well as any sensible security mechanisms for online banking. Yes, pushTan and mobileTan are usable, but they only work if you have a phone you trust with the deductible applicable in case of pishing, or, if you have actual reason to not trust it, the daily online banking limit.
- johnymontana 8y ago
  Banks and credit card companies in the US have a vested interest in ensuring that credit cards are used to purchase goods and services on credit. In 2017 total credit card debt in the US was ~$941 billion.[1] At an average rate of 15%[2] that's $141 billion per year that banks make on credit card debt interest (not counting interest on interest and fees). [1] https://www.nerdwallet.com/blog/average-credit-card-debt-household/ https://www.nerdwallet.com/blog/average-credit-card-debt-hou... [2] https://www.creditcards.com/credit-card-news/interest-rate-report-081413-unchanged-2121.php https://www.creditcards.com/credit-card-news/interest-rate-r...
  - hoschicz 8y ago
    How much of the credit card debt has been paid off within a month?
  - bboreham 8y ago
    How much of the credit card debt is eventually written off as bad debt?
- draw_down 8y ago
  As a consumer why would I change payment methods in order to bolster the merchant's certainty that they will receive their money? I suppose the ultimate answer is "fees", but those are hidden in the prices. And who is to say that the increased margin won't simply go in the merchant's pocket? Rather, what I care about as a consumer WRT payment methods is simply convenience. Apple Pay is probably the best one I've ever used, very simple and quick to pay.
ehsankia 8y ago
Slightly off-topic, but last time CandyJapan made it onto HN, I decided to sign up and give it a try, and was very underwhelmed. I canceled after two boxes. Hey each contained 3-4 candies, and over half of them were very basic candies such as chocolate. In total I think only a single one was the "cool" kind of candies you associate with Japan. Honestly in the ~8 candies I tried, not a single one was even really edible or interesting. Also, I'm not sure how much of this is their, but a lot of the candies had also melted and re-solidified into a single chunk.
notafraudster 8y ago
A better approach to writing this article would be to gather a wide array of customer features, fit a model using training data from actual fraudulent/non-fraudulent orders, and then interpret the model to explain the features actually connected to fraud. My guess would be that given there's no reason to believe a particular functional form or additivity of effects, a random forest would likely be the most effective classifier, but ultimately I'd just go with whatever empirically does best on the test set. As-is the article is basically a pretty naive approach to feature engineering a few features that may or may not ultimately be useful in the real data. It's a cute anecdote, but hire a data scientist.
Johnny555 8y ago
Overagressive fraud protection can lose customers as well. I placed an order to be shipped to my new address from a merchant I'd ordered a dozen times before for home and work. 2 days after the day the order was supposed to ship, they suddenly canceled it due to "security reasons". I've stopped using that merchant.
- davidsawyer 8y ago
  Reminds me a lot of massive email validation regex: http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html
  - falsedan 8y ago
    Can you explain the relationship? Also, the regex is longer than the (reasonably clear) code[0] which generates it… 0: https://metacpan.org/source/PDWARREN/Mail-RFC822-Address-0.3/Address.pm https://metacpan.org/source/PDWARREN/Mail-RFC822-Address-0.3...
a-dub 8y ago
Now that everyone has smartphones, I wonder if you could do something with the camera... like require a photo or video of the physical card in front of some visual token on the screen for orders that don't ship to the billing address on file...
TekMol 8y ago
Another Problem that goes away with crypto currencies.
- cleong 8y ago
  How does crypto currencies solve this if a bad actor gets a hold of your wallet...
- DEFCON28 8y ago
  Ha! Neither buyer nor seller is protected with Crypto Currencies.
- anitil 8y ago
  This seems like a variation on the Zawinski Quote - Some people, when confronted with a problem, think "I know, I'll use crypto currencies." Now they have two problems.
TekMol 8y ago
When you accept credit cards, how long do you have to wait until you know the payment went through? Could you simply wait that amount of time for every order?
- driverdan 8y ago
  Typically chargebacks can happen for 90 days. No one is going to wait that long for you to ship.
  - lucb1e 8y ago
    I guess that's exactly why the period is so long: they force the merchant to ship before and take that risk.
djrogers 8y ago
I cannot imagine running a bunsiness where I ship things ot people for money without doing address verification. In the mid 90s one of my first database related jobs was parsing the complete US address list we purchased from the USPS and comparing it to our internal mailng list - the process has gotten much simpler over the years. This would have prevented 3 of the problems on this list, and would also result in a much lower rate of failed deliveries (expensive)...
rossdavidh 8y ago
My wife had to learn just about every one of these lessons the hard way in the first few years of running her own (small retail) business. In retrospect, we should have posted the hard-learned lessons online. I'm glad this person did.
supernova87a 8y ago
You would think with the amount of value / fraud at stake, Visa/MC/AMEX themselves would invest in fraud detection technology and offer that as a service to their participating banks and merchants. They have so much more volume and cost absorption capability that they could spin up a much more talented / sophisticated detection group than any individual bank or merchant could, you would think? And charge for it accordingly?
- jimktrains2 8y ago
  They normally don't shoulder the financial burden of fraud.
  - supernova87a 8y ago
    Sure, but who wouldn't like to make a buck from it? Well, I guess they kind of do with every chargeback, so they have conflicting incentives.
- robalfonso 8y ago
  Visa/MC/AMEX make a MASSIVE amount of money on Fraud - it's in their interest to perpetuate it. I've experienced this myself with > 6 figures in CC fraud in a month. Here is the financial break down: Every time a customer gets a charge due to Fraud, they file a chargeback. If we are able to contest it, all is well, other wise they hit you with a $25-$35 fee PLUS the charge is reversed so depending on margins you are out you're costs on the transaction as well. If the # of fraud transactions gets bad enough (even if you are working with them diligently to get things under control) and not able to stop it, they will charge you a chargeback penalty fee. This essentially says you are high risk and so now give us 50,000 or 100,000 dollars or you can't accept credit cards AND you have X days to resolve this and get you're charge back rate to a reasonable level or we will hit you with another charge bigger charge in 30/60/90 days or whatever the risk management department wants. They may also come back and say now we've told your processor (stripe, braintree, etc) that THEY need to charge you more because we are charging them more to deal with you. So instead of 2.5% of each transaction they are getting 3% for example. It all adds up to billions across the world economy, it costs them only to deal with it administratively and they are collecting many many times that in fees from the merchants. It is very much a scam and the average customer doesn't realize the massive hit companies can take for the convenience of Credit Cards.
sytelus 8y ago
naive question: Why should merchant be worried about this? Isn't it responsibility of CC company to back up the promised credit? If someone unauthorized used someone elses CC then shouldn't CC company swallow that loss?
- detaro 8y ago
  No. CC companies protect the customer from fraud, not the vendor, unless you have really good proof the customer isn't right a chargeback means you loose the money and often pay a fee on top. + if you are the source of to many chargebacks, they'll drop you entirely.
- iamwil 8y ago
  The credit card company charges really high fees (on the order of tens to hundreds of thousands of dollars if you have any significant volume) if you have more than 1% of all your transactions as chargebacks. The CC company doesn't swallow the loss--it's the merchant that does.
rdl 8y ago
I’m fine with fraud detection like this, but probably 90% of my ordering is a credit card, through a VPN, or sometimes from a foreign country, shipped to a freight forwarder, with a VOIP PSTN number. There have to be ways to get around this for false positives.
- digianarchist 8y ago
  There are. Mail you government ID to small business owner that will probably leave it on some vulnerable windows xp machine.
tzs 8y ago
> Two bonus signs for the end. You can use a Geo IP database to check if the shipping address country differs from the IP address country. That's a weak sign (people do place orders while traveling, or to friends in other countries), but can break the tie if there is another suspicion. You can add to that using the first few digits of the credit card to look up the card issuer. If the card is from a bank that does not have a presence in either the region the order is coming from or the region it is being shipped to, that order probably merits a closer look.
- anonnyj 8y ago
  I kept getting flagged for that kind of thing, had to start using a proxy to make my actually legitimate purposes. Though looking at it from the other side, using a proxy should probably count against you a little.
dottrap 8y ago
So if you see one of these warning signs, what should you do? What if it is a legitimate order? You don't want to turn down a real customer? I presume if you try contacting the person and asking them if it is a fraudulent order, they will deny it. (I suppose if you can't reach them, that is good enough indication to cancel the order as fraudulent.) Can you call the credit card companies or payment processors and ask them to do their own fraud checks to see if it is okay, or are they going to leave you on the hook if it still goes bad? (I suspect the latter.)
mostlyjason 8y ago
If fraud is such a problem for stores would it make sense to offer a discount for payment methods like bitcoin that don’t allow chargebacks? This could reduce the cost of doing business by gaurenteeing payment.
- asclepi 8y ago
  This is an excellent idea to prevent revenue loss caused by false positives, which are rampant IMHO. It's beyond me why so many merchants opt for the revenue-losing and customer-hostile choice to silently cancel flagged orders and let their competitors run away with the money, while they could easily get a safe sale by making a non-negotiable offer to use an irreversible payment method when a credit card gets flagged. This reverses the trust issue, it's then up to the customer to determine if he trusts the merchant enough and is willing to give up the additional protection that a purchase on a credit card may offer - some of which the merchant may offer instead - to get the item he wants.
trumped 8y ago
Today my bank detected a fraudulent transaction on my CC. They blocked the transaction right away and cancelled my card after confirming it with me... so they probably can prevent a lot of these cases. Very interesting article nonetheless...
sho 8y ago
> One time when I tried googling for an address, I found that the person was also active on a forum for trading stolen credit card details. That was a bad sign Ha. You don't say!
inopinatus 8y ago
The payment service I use (Pin Payments) can include a random value in the payment card narrative, allowing you to hold delivery until the cardholder authorises dispatch with the correct code.
inertial 8y ago
The bad part of credit card fraud is that the card network, issuing bank & gateways pass on the liability to the small merchant. There is always a looming risk of losing your account & business due to excessive fraud, something over which you have no control at times. If you become over aggressive with fraud protection, you risk not only losing revenue but pissing off genuine customers. Your gateway would tell you that as a merchant, it's your job & responsibility to accept a charge & related risk of fraud. Well, if big guys handling billions of payments can't catch fraud, it's quite easy for a small guy to miss it as well. When you are selling a digital product, it's very difficult to win a chargeback. Some low level bank employee hardly cares about your meticulous documentation & proof that you delivered the product. 3D secure is one way to shift liability to issuing bank but it only works for the first charge (not recurring subscription). There are lots of reasons for getting hit by incorrect chargebacks e.g. mistake on part of a customer because they didn't recognize, customer's card getting stolen midway during a subscription, unhappy customer who wants a refund after using your service for months etc. I wish the industry would side with the merchant as well at times i.e. maybe a rating system to see how easy is the merchant's cancellation / refund policy etc.
reembs 8y ago
Some companies today offer a fraud prevention solution which is covered, meaning they will pay the merchant for whatever fraud transaction that slipps through their systems. These companies employ pretty sophisticated methods as this is their core buisiness. I work at one such company, Forter. We take pride at the fact that we approve more than the others would, and we take complete financial responsibility for our mistakes so merchants just don't have to deal with it...
- usr1106 8y ago
  Paying for fraud that slips through should be the easier part. Do they compensate for lost business because of false positives? The problem is that even the wannabe seller cannot quantify it. At several occasions I have not been able to order something online, because they would not accept my card.
victor106 8y ago
I have a genuine question that is kind of unrelated to this discussion:- What is special about Japanese candy? Is it the packaging? The ingredients?
mcherm 8y ago
You know... there is one entity that is reasonably well funded, has incredibly strong capabilities for card fraud detection, and is well motivated to identify the fraud: the credit card companies. (I work for one, which makes me especially interested in this topic. But I don't work in that particular area, nor do I speak for my employer.) It makes me wonder whether some sort of collaborative fraud detection might be possible. As the merchant, you have access to additional information that the credit card company lacks -- things like the customer's name and the delivery address are (as this article explains) very helpful in detecting fraud, and these are data that the credit card company does not have access to. And of course the credit card company has access to information like the customer's purchase history and their recent transactions, which are useful for identifying fraud from a different direction. If both sources of data were available, it might be possible to detect a higher percentage of fraudulent purchases, and merchants who ship goods could be provided with the information so they could delay or cancel the shipment. Do you think merchants would be interested in such a program?
- hackbinary 8y ago
  Would merchants be interested in my purchase history? Yes. Would I want/trust merchants to have this information? No.
  - mcherm 8y ago
    Oh, I'm fairly certain that the information sharing would only go one direction: the merchants would share the data to the credit card companies, who would run fraud models on it and provide near-real-time feedback to the merchants. In terms of user privacy, this gives the credit card information more information than they already have access to. It is reasonable to worry about the privacy implications of that sharing. But to be honest, the credit card company already knows a great deal just from processing the customer's purchases. Adding in the delivery address (when it differs from the card's billing address) is a leak of personal data, but not a huge one. Additionally, we might be able to put in place contractual controls limiting the data to certain uses. I can assure you (from my own experience), credit card companies are well experienced at compartmentalizing data and limiting data sharing.
bjacobs 8y ago
Run an e-commerce business that sells tires. It seems that a common pattern that’s arising is for a bad actor to use a foreclosed property or rental to ship to, within spitting distance of the billing address, then have the carrier redirect to a pickup store, such as the Fedex store. They have absolutely no problem walking into the store and signing off, all on camera. Troubling times.
Veronica2falkn 8y ago
I recently hired the service of hacker_timothy@outlook.com to test their services with an email hacking job. To my greatest surprise, it worked! I got the email password within 5 hours. They're experts and I appreciate the enthusiasm displayed towards solving my problem. Thanks to hacker_timothy@outlook.com +1 ( 339-337-2730 ) and his team who were ready and helpful in handling my situation to ensure guaranteed results. I give them a 5 STAR RATING! Contact them for : Cyber Tracking * Spying * Retrieving of deleted text messages * Upgrading of results* recovering of Social media passwords* Military hacking* Dump Cards* Bank Transfers* Bitcoin Wallet Hacksbitcoin increaing DDoS Attacks* Website Hacks* Credit Score Boosting* Many more special jobs too & they always offer an affordable price.
DoubleGlazing 8y ago
My old employer, a phone retailer, would check how long the user had been browsing the site and what they looked at. We noticed that legit customers tended to take their time on our site. They would look at several pages and not immediately add something to the basket and checkout. Of course, some legit customers would demonstrate the same pattern particularly when a new phone was launched - but that wasn't too common. So if the user spent less than five mins on the site before checking out, or if they only looked at one product page then that order would automatically be flagged for manual review. 60% percent of those orders were rejected.
petraeus 8y ago
A velocity report is the only real way of pro-actively catching fraudsters. something like ip address by alias or something similar.
pitahummus 8y ago
I work with Signifyd. We are expanding and hiring more Data Scientists and Fraud Analytics ninjas. Apply through the website. We do care about approving good orders while stopping fraudulent ones. In case of a chargeback, we guarantee it.

302 points by hamstercat 8y ago

I like how the author doesn't immediately reject orders if they have just one sign (IP address country different from shipping country, shipping to a reshipping center, etc.) but looks at all the indicators as a whole to make a decision. Edit: isn't this how Stripe Radar[1] works? [1]: https://stripe.com/us/radar https://stripe.com/us/radar

zrail 8y ago
Yes, Stripe Radar will automate most of these checks. They also have the benefit of being able to see other merchants' transactions within their network, which helps when someone tries test transactions across a bunch of different merchants all at the same time from the same IP.
Raphmedia 8y ago
From my experience, nothing drives users away faster than a false positive on a fraud check. You immediately lose all trust in the eyes of the users.
- bpicolo 8y ago
  Yeah, but that's something you have to accept for the positive benefits. In a lot of online businesses, credit card fraud is just insanely rampant. You lose a lot more money by not doing checks with the occasional false positive than you do by not having it. The cost of fraud is chargeback fee (usually ~15 bucks) + merchandise. It gets expensive fast. Every modern e-commerce business has to be fighting it now to stay alive. For certain SaaS / Software products the cost of failing to fight it is a tad lower, but for physical products it's killer.
  - Raphmedia 8y ago
    Sure, you can't ignore fraud. We have a lot of those each months. What is more important is to have a smart way to detect the frauds. Most clients that had received false positives never came back even with discount codes and apologies. Nobody likes getting stuck on a checkout page with an error message telling them they are in the wrong.
    - alexbeloi 8y ago
      One way to optimize is to maximize expected revenue - expected cost of false positives or fraud. A savvy business will know (or can estimate): customer lifetime value, false/true positive/negative rates of their fraud detection system, rate of charge-backs, expected rate of fraudulent purchases, revenue from given suspected transaction. If average discounted customer lifetime value is $10k, charge-back rate is 2%, your fraud detection false positive rate is 0.1% and true negative rate is 99.9%, fraud detection true positive rate is 95% and false negative is 5%, customer is purchasing a $20 item. Then * expected revenue if purchase is fraudulent: $0 * (true positive rate) - $20 * (false negative rate) = -$1 * expected revenue if purchase is non-fraudulent: $20 * (true negative rate) - $10k * (false positive rate) = $9.98 * total expected revenue value (with fraud detection enabled): (expected revenue if purchase is fraudulent) * (rate of fraudulent purchases) + (expected revenue if purchase is non-fraudulent) * (1 - rate of fraudulent purchases) = $9.7604 Without fraud detection, your expected revenue is: $20 * 0.98 = $19.6 Simplifying assumptions: false positive results in complete loss of customer value (realistically, replace this with big drop in customer lifetime value). Fraud rate is constant (realistically, should be modeled). Fraud rate is charge-back rate. In this case, it's easy to see that seemingly low 0.1% false positive rate is still too high for this small of a purchase and these customer lifetime values. The 'smart' decision would be to ignore fraudulent purchases of this size in this case. (for this scenario, you need FPR below 0.004% with all else same) Better model still would be a fraud detector that outputs a confidence score rather than "yes/no", and use the formula above to determine if the predicted false-positive-rate at this confidence level is sufficiently high to expect a revenue uplift from enabling the detector.
    - nucleardog 8y ago
      Or even better, one retailer I dealt with that did all their fraud checking manually after charging you. So they took my money, decided they wouldn't sell to me, then I had to wait a week to get my money back. At no point did they so much as call or email me to try and see if we could correct any issues with the information before initiating the refund. I've spent more on identical products from other retailers just to avoid them.
  - notatoad 8y ago
    >The cost of fraud is chargeback fee (usually ~15 bucks) + merchandise. that's the least of the cost. the real cost of chargebacks is in the processing rate increases.
- yani 8y ago
  Fully agree. It multiplies the anxienty for a novice online shopper.
- slivanes 8y ago
  I see it differently. A merchant who takes fraud seriously is someone I would trust more.
  - Someone1234 8y ago
    I had NewEgg flag a transaction of mine as fraudulent in 2009, they just silently cancelled it then gave me strange errors on the order status page. When contacted they said the transaction was flagged and there was nothing they could do. I didn't use NewEgg again until 2017 as a direct result. That one bounced transaction (and frankly how they handled it) cost them six years worth of business that Amazon got (talking easily $3K+). I think you're the edge case. Most customers will be somewhere between put out and outright angry.
    - slivanes 8y ago
      The problem I see is NewEgg handled it poorly, it doesn't sound right that there wasn't anything they could do. That's NewEgg's problem and nothing wrong with actually flagging a transaction that requires a manual investigation.
    - reaperducer 8y ago
      Not even angry or slighted. People will just assume that Merchant X doesn’t ship to their area and they never go back because they never receive any information to the contrary. I’ve only been flagged once, and that was when I was a new B&H customer. A quick phone call fixed the problem and in spite of changing addresses at least ten times since then, haven’t had a problem since. However, it is occasionally a problem that B&H won’t ship to hotels.
    - inetknght 8y ago
      On the other hand I've shopped with NewEgg since 2005. I've had orders flagged as fraud once in a while both from NewEgg and also (more often, actually) from the bank when they receive the charge from NewEgg. While quite annoying, it is one of the many reasons I continue to order from them.
    - ggg9990 8y ago
notafraudster 8y ago
It seems to me like the author doesn't actually do anything programmatically, and instead has few enough orders that they eyeball it and do additional human steps. A good start but not scalable.

jdietrich 8y ago

Don't roll your own crypto, don't roll your own fraud prevention. Stripe include very sophisticated fraud prevention in their standard pricing and charge pennies per transaction if you're on custom pricing. Numerous third-party providers offer excellent fraud detection and prevention tools for CNP transactions. Unless you're big enough to have a dedicated fraud prevention team, just leave it to the professionals.

sbov 8y ago
I've never used stripe specifically, but in my experience its always good to have your own layer of fraud prevention, because if you have too much fraud reach whoever is providing payment processing, they will terminate your account. Beyond that, a few simple checks will make most fraudsters move onto other websites. It's not about being bulletproof, it's about being harder to abuse than the others.
- bpicolo 8y ago
  I think the point is that it's very hard to do as good a job as providers like Stripe and SiftScience will do (assuming machine learning against fraud is not your core competency) - they take into account a lot of the signals you might take into account anyway if you feed them clean data. Better to focus on sending them the clean data.
  - yani 8y ago
    Exactly the opposite. Generic fraud checks will perform worse
    - bpicolo 8y ago
      They're not generic, though. Those providers build custom ML models specifically from your data (and they pull in a ton of signals for this), and then have the data of many other merchants to work with. At a previous employer we found both of those products to be effective.

stronglikedan 8y ago

> Later on when the post attempts to deliver it, they will at some point realize that the country is wrong and reroute it to the correct country Will they? Or will they return it to sender with a bad address note? Would the rates be different by country?

dawnerd 8y ago
Maybe it depends on your shipping deal? Thinking they might just charge the account the different?
rocqua 8y ago
I recall we once sent something from the Netherlands to Canada, but didn't include the country. We later got a surprised email by the recipient that they received the mail despite it not including the country. I suppose the post office decided to do some digging and managed to deliver correctly.
- Scoundreller 8y ago
  I'm pretty sure my domestic package to Newfoundland ended up in your country, and then back. My buyer reports it isn't the first time that's happened to him.
reaperducer 8y ago
USPS used to have huge offices at its distribution centers with people who figure out bad addresses. At one time you could send a letter to a particular famous person (I can’t remember if it was an actor named “Rip” or Mr. Ripley from “Ripley’s Believe it or Not”) by simply putting a rip in a blank envelope. I bet the U.K. has massive departments for this since so many addresses are just something like “Stuffypants House, Humberside.”
- Symbiote 8y ago
  > “Stuffypants House, Humberside.” British people who live in places with address like that tend to go the opposite way, and add superfluous lines: Lord and Lady Cockwomble Stuffypants House Glebe Farm Cross Road Ulceby near Thornton Curtis Barton-upon-Humber Humberside When the official database (and preferred form) for the address will have something like Glebe Farm Cross Rd ULCEBY DN39 6TR The postcode tends to identify between one office in a building and about 30 houses, so with that and the building name/number the rest doesn't matter. You can paste that one into Google and change the last letter to see it move slightly.

dawnerd 8y ago

Fraud prevention can also be extremely annoying to customers when not done correctly. I've yet to be able to buy something from newegg without them cancelling the order saying its fraudulent. I'm not sure why they still continue to flag my orders considering I've contacted them every time and they've ended up authorizing it. At least now they don't immediately blame my credit card... If it was a smaller company and more of an impulse buy I could see a bad system definitely hurting sales. I'd probably not order from newegg again if they weren't one of the few places that ship harddrives correctly and have reasonable prices.

ryan-c 8y ago
I bought a laptop from HP about a year ago, and they canceled my order after shipping it, having FedEx return it to them. I'm still mad about it.
Matheus28 8y ago
I've had issues mainly with manufacturers web stores. Fender apologized and gave me the part number for the exact model I wanted and suggested I try third party stores. EVGA was annoying. They called me at 10 am to confirm details, put me on a three way call with my bank and I thought that was it. For whatever reason they tried to call me again the following day but I couldn't answer, when I called them back they told me they cancelled my order. They said my billing details didn't match (simply not true, I've used that address countless time and checked my order confirmation), and that my phone area code didn't match where I lived (no shit, people move...). I decided to just never buy from them again, since there are plenty of other GPU manufacturers.
- nucleardog 8y ago
  At least EVGA tried to resolve it. I tried to order from an computer component retailer here in Canada. They specifically called out that my information needed to match, so I went and logged into my credit card's online portal and copy and pasted my information directly. However what I didn't think to copy and paste was my own fucking name. After charging my card and taking my money automatically, they then seemingly manually went to review the transaction and found that something didn't match, though were apparently unsure as to what that might be. When I sent them a screenshot of my online banking portal showing all my information with a "Wtf?" their response was "Oh, it's probably your missing middle initial. Also we've already refunded your order so there's nothing we can do. You should have your money back in a week." When I asked them why the hell on top of a completely user-hostile validation process they then make it worse by cancelling and processing the refund before even calling me or emailing to give me a chance to correct the information, their response was basically that that's how they have to do it and it's outside their control and shrug. Needless to say when I finally got my money back a week later I spent it elsewhere.

ohthanks 8y ago

I periodically deal with recurring fraud from what seems to be a pretty organized network. - Orders are placed with stolen credentials with correct billing info that matches AVS. - Shipto address are located near billing info, typically in the same state/metro area. - They are often rural addresses, trailer parks, what appear to be rent houses that may be empty. - Phone number provided has correct area code and rings a call center that has stolen billing info available and will confirm billing address order details verbally. - Ip is geolocated at/near the billing info area via a proxy. - Email addresses are often setup on custom domains. We catch them, but only because they don't vary the pattern much and we know what to look for. I don't know how fraud tools would be able to effectively filter in these cases without a lot of false positives.

blackice 8y ago
Another easy & free thing you can use is proxy detection, sites like https://getipintel.net https://getipintel.net would beneficial in preventing fraud.
- chipperyman573 8y ago
  FWIW this website is 82% certain that my IP (university) is a VPN/Proxy/Bad IP.
  - Symbiote 8y ago
    It's 94% certain the VPN endpoint IP my work VPN (only 25 people, university IP) is a VPN/proxy/bad. That's correct, but not at all correlated with us being likely to commit fraud. It's 79% certain the office LAN NAT gateway IP is a VPN/proxy/bad. My work desktop's static IP gets 23%, so that's something. My home IP gets 60%. (Is this thing just connected to a random number generator?)
  - slivanes 8y ago
    A lot of students have buyer remorse when they realize the money they just spent online could have been used more wisely. Unfortunately, when a network has a small percent of bad actors, the network as a whole is punished.

deleted 8y ago

[deleted]

47 8y ago

If you really care about your customer you should be worried about false positive. I hope as a business you do not cancel customer orders because your fraud detection system has flagged them. Depending on your scale you may using 3rd parties like Sift science, Stripe Radar or Roll your own fraud detection system. Flagging orders as potential fraud is the easier part these days. The difficult part is how to come up with a process to verify these flagged orders. This process need to be simple and quick. Because essentially you are saying to your customer we think you are a fraud and can you prove that your not. Banks merchant checks to verify flagged orders is extremely cumbersome. They require you to call a special phone number (which is different for each bank) provide customer Name, Billing Address, Billing Phone and Credit Information. Then they can only give you a response whether it is a match or not. They can't tell you whether it has been reported stolen or anything else for privacy reason. At scale this is a very time consuming process. It becomes even more cumbersome if you are security conscious business and do not store customer credit card information. In that case you have to communicate with the customer asking them to call you to provide your credit card information again. There are solutions like 3D Secure but they are not widely supported and adds its own problems. It is high time credit card companies start providing merchant with a 2nd factor check for transaction. For example maybe once a transaction is placed with a merchant. They can trigger a 2nd factor check where by the bank automatically send a code to their email/phone number on file. If the customer is able to provide a correct code merchant can proceed with the order. Fraud detection will always remain a point of contention between customer and businesses. I just hope business make sensible decision based on their situation. For example I have seen legitimate customer with all the above cases mentioned in the article.

kristianc 8y ago
The OP has written extensively about this subject in the past, and I get the sense that he is intimately aware of the risk of false positives, however catching a high volume of fraud could for him literally be the difference between staying in business and not. His fraud tolerance is going to be much much lower than a large vendor.
dcbadacd 8y ago
Reading all of these issues I'm really flabbergasted that you have such issues. Like, my bank offers me temporary non-physical credit cards with small limits for 1€/month/piece and that's what I use to do all my online purchases with, do US banks really not have that option? Second thing that I often use (where possible) wire transfer, it requires my ID-card and the payment is done in seconds. This thread has honestly made me really appreciate what I have available to me compared to some countries.

inetknght 8y ago

I find it strange that the de-facto thing to do for fraud is to simply not accept the order. Why not report the fraud to authorities instead?

kogir 8y ago
Time. Nothing will come of it and it will cost you your wasted time.
michaelbuckbee 8y ago
Fraud falls into a weird category of crime where: - happens globally (far outside of local police jurisdiction) - per event small monetary value - widespread but difficult to tell how connected (is it tens of thousand of fraudulent events from a single actor or tens of thousands of different actors?) All of which adds up to there not being a clear cut law enforcement agency to handle these types of things (aka you can't reasonably ask the local police to help you track down a scammer in singapore).
- splonk 8y ago
  Yeah, essentially no local law enforcement is going to care about some guy successfully scamming you for a $100 chargeback. We were basically told not to bother for anything under $25k from a single actor, and even for amounts over that I think we only managed to get law enforcement action through personal contacts. I think the one case that law enforcement did act on was a group that was using a newly built neighborhood as a drop point for stolen goods. It was complete enough that there were addresses to ship to, but nobody was living there yet, so it was easy to just pick up packages off the front steps. From what I heard, the police ended up picking up some guy with a truck full of iPods who was just going house to house picking up the deliveries.
- chrischen 8y ago
  Yes I tried to report CC fraud (as a merchant) and the local departments kept bouncing me back and forth between my local police and the department at the fraudster’s jurisdiction. I had address, email, IP, and name, yet no one could do anything.

4ad 8y ago

> Using an inconsistent and unlikely email address [...] By "unlikely" I mean one that no reasonable person would want to have, usually containing a big batch of numbers in it. This is awful. I create random e-mail addresses for every online merchant I have to interact with. It's by far the best way to avoid both real spam and "promotional message" spam. I don't even use my "real" domains, because anybody who knows my name and the domains I use can construct my personal e-mail addresses. I have special domains dedicated to online commerce, and they look pretty random.

cortesoft 8y ago
If you go out of your way to appear fraudulent, you can't be angry when you get flagged as fraudulent. What do you want merchants to do? It appears you have gone out of your way to make sure all your information is completely unconnected to you, which is exactly the case for someone committing fraud.
- kodablah 8y ago
  > What do you want merchants to do? Accept a certain amount of loss in exchange for fair customer treatment. Obviously this isn't binary, but for something like an email address, it can be considered a factor, but should not be a determining one.
  - chipperyman573 8y ago
    >something like an email address, it can be considered a factor, but should not be a determining one. The article specifically states that no one indicator will result in a payment being denied. There aren't any determining factors in this system
    - kodablah 8y ago
      True. I mean in the general case.
  - notatoad 8y ago

rb808 8y ago

CC fraud is such a big problem, it must be a huge advantage for Amazon. Most of their purchases come from repeat customers that they can be confident exist. Smaller shops have to figure that out nearly every purchase. I never thought of that before. Maybe there should be a central shared central repository of who are known good customers/address/cc combinations, or maybe that is what stripe etc do already.

singlow 8y ago
There are services that do this. Several retail stores I consult for have transaction filtering through an independent fraud detection service which has its oen blacklists of hashed CC numbers, emails, and street addresses. They also evaluate the ip address, distance fom billing and shipping addresses and a slew of other factors.
- santiagogo 8y ago
  Which do you recommend? I work with custom solutions for banks which a lot of times include fraud prevention services from third parties, so I'm consistently benchmarking for better alternatives.
- bleachedsleet 8y ago
  Criminals have many tools that can circumvent these systems though and many are very hard to defeat while still providing a smooth customer experience. There are entire web browsers developed by Russian groups that exist solely to clone the entire fingerprint of the victim, complete with session cookies. A lot of bank fraud happens this way...a hidden RDP service is installed on victims machines and then sold online so you can just remote into their computer, login to their bank and nobody is the wiser. There are services to conduct COBs (change of billing) so you can get new credit cards shipped to fake addresses under the attacker's control. And nearly all online bank account/CC sellers usually include cookies with the stolen cards now. Criminals have quickly figured out that a VPN in the general location of the victim is no longer good enough and they've adapted much faster than security systems can keep up with. There's also still a very big and unfounded trust system between certain merchants and certain banks. For example, AMEX cards sell for much more on the markets because many merchants (including Amazon) will usually assume trust in those cards even if other factors seem a bit off and will often ship products before fully confirming the transaction, so even if the card is flagged, it's likely a criminal could still steal a product or two. This is nonsense and despite being well known information to anyone that's spent even a little time researching fraud networks, it remains an exploitable loophole.

madamelic 8y ago

Reshipping centers, I don't want to sound weird, are basically hives of scum and villainy in my opinion. I was selling something Ebay (a phone) and I got a really weird address, it was a shipping center. I googled around because I got a strange vibe, apparently, this shipping center had this issue all the time and didn't really care to stop it. I got a horrendous review from the person because I canceled the order and refused to ship it. I am wondering if fraud is honestly the business model of shipping centers. I can't really think of a good use for them nowadays, especially in a consumer context.

post_break 8y ago
I want to buy something that doesn't ship to my country, I use a shipping center.
zeroxfe 8y ago
Reshipping centers are used heavily by people outside the US to get access to goods sold online. Tons of stores (especially on Amazon) don't ship outside a few select countries, so customers pay a small fee to these reshipping centers to have packages forwarded to them.
- zodPod 8y ago
  Do they do the opposite too? I feel like there have been frequent times I've bought Chinese components (like bulk LEDs or something) on eBay from a seller that has an address in the US but it still took a long time (about on par with shipping from China) to get to me. Could that have been a person living in China selling stuff on ebay and having an address listed in the US to trick me?
  - dahdum 8y ago
    Those are dropshippers, many of those items you can order from Alibaba / Aliexpress and skip a layer of reseller.
    - 8y ago

jerzyt 8y ago

I've had a case of someone walking into a Verizon store and buy 4 new iphones and charge it to my account. The amazing thing is that between phones, tablets and hot spots, my family has 7 mobile devices. The perpetrator did not upgrade any of the existing phones, but created 4 new phone numbers. This should have been a huge warning sign. I'm 100% convinced that the person at Verizon was in on this. In addition, over the next few days, they've made thousands of dollars in international calls. To Verizon's credit, they were great at resolving the mess for me as an individual customer, but in the end they ate the cost, which means that it got diluted to all the customers.

mleonhard 8y ago

I love the artwork behind the article: https://www.candyjapan.com/static/credit-card-fraud_s.png https://www.candyjapan.com/static/credit-card-fraud_s.png

stef25 8y ago

Doesn't Stripe cover some / most of this? There are some settings, or at least an overview in the dashboard where you can see if the address was verified and it matched the one on the card. Using billing / shipping address in your order form is obviously for this reason.

namibj 8y ago

In Germany we have a system called 'giropay', which is basically instant wire transfer via your online banking. With this system the merchant gets a guarantee from the consumer's bank (as it seems, but I am not sure who in the pipeline eats the cost, as the contracts are ask-only), so that even if there was fraud, he will not loose the money. This does limit it to 10k EUR per transaction, which should be enough. The merchant receives the money within 2 bank days in his account, and the max fees for the merchant are 0.89% with a minimum of 33ct, but volume discounts seem likely. What I don't understand, is why the US was not able to set such a system up, but I assume it's related to the general distaste for chip+pin, as well as any sensible security mechanisms for online banking. Yes, pushTan and mobileTan are usable, but they only work if you have a phone you trust with the deductible applicable in case of pishing, or, if you have actual reason to not trust it, the daily online banking limit.

johnymontana 8y ago
Banks and credit card companies in the US have a vested interest in ensuring that credit cards are used to purchase goods and services on credit. In 2017 total credit card debt in the US was ~$941 billion.[1] At an average rate of 15%[2] that's $141 billion per year that banks make on credit card debt interest (not counting interest on interest and fees). [1] https://www.nerdwallet.com/blog/average-credit-card-debt-household/ https://www.nerdwallet.com/blog/average-credit-card-debt-hou... [2] https://www.creditcards.com/credit-card-news/interest-rate-report-081413-unchanged-2121.php https://www.creditcards.com/credit-card-news/interest-rate-r...
- hoschicz 8y ago
  How much of the credit card debt has been paid off within a month?
- bboreham 8y ago
  How much of the credit card debt is eventually written off as bad debt?
draw_down 8y ago
As a consumer why would I change payment methods in order to bolster the merchant's certainty that they will receive their money? I suppose the ultimate answer is "fees", but those are hidden in the prices. And who is to say that the increased margin won't simply go in the merchant's pocket? Rather, what I care about as a consumer WRT payment methods is simply convenience. Apple Pay is probably the best one I've ever used, very simple and quick to pay.

ehsankia 8y ago

Slightly off-topic, but last time CandyJapan made it onto HN, I decided to sign up and give it a try, and was very underwhelmed. I canceled after two boxes. Hey each contained 3-4 candies, and over half of them were very basic candies such as chocolate. In total I think only a single one was the "cool" kind of candies you associate with Japan. Honestly in the ~8 candies I tried, not a single one was even really edible or interesting. Also, I'm not sure how much of this is their, but a lot of the candies had also melted and re-solidified into a single chunk.

notafraudster 8y ago

A better approach to writing this article would be to gather a wide array of customer features, fit a model using training data from actual fraudulent/non-fraudulent orders, and then interpret the model to explain the features actually connected to fraud. My guess would be that given there's no reason to believe a particular functional form or additivity of effects, a random forest would likely be the most effective classifier, but ultimately I'd just go with whatever empirically does best on the test set. As-is the article is basically a pretty naive approach to feature engineering a few features that may or may not ultimately be useful in the real data. It's a cute anecdote, but hire a data scientist.

Johnny555 8y ago

Overagressive fraud protection can lose customers as well. I placed an order to be shipped to my new address from a merchant I'd ordered a dozen times before for home and work. 2 days after the day the order was supposed to ship, they suddenly canceled it due to "security reasons". I've stopped using that merchant.

davidsawyer 8y ago
Reminds me a lot of massive email validation regex: http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html
- falsedan 8y ago
  Can you explain the relationship? Also, the regex is longer than the (reasonably clear) code[0] which generates it… 0: https://metacpan.org/source/PDWARREN/Mail-RFC822-Address-0.3/Address.pm https://metacpan.org/source/PDWARREN/Mail-RFC822-Address-0.3...

a-dub 8y ago

Now that everyone has smartphones, I wonder if you could do something with the camera... like require a photo or video of the physical card in front of some visual token on the screen for orders that don't ship to the billing address on file...

TekMol 8y ago

Another Problem that goes away with crypto currencies.

cleong 8y ago
How does crypto currencies solve this if a bad actor gets a hold of your wallet...
DEFCON28 8y ago
Ha! Neither buyer nor seller is protected with Crypto Currencies.
anitil 8y ago
This seems like a variation on the Zawinski Quote - Some people, when confronted with a problem, think "I know, I'll use crypto currencies." Now they have two problems.

TekMol 8y ago

When you accept credit cards, how long do you have to wait until you know the payment went through? Could you simply wait that amount of time for every order?

driverdan 8y ago
Typically chargebacks can happen for 90 days. No one is going to wait that long for you to ship.
- lucb1e 8y ago
  I guess that's exactly why the period is so long: they force the merchant to ship before and take that risk.

djrogers 8y ago

I cannot imagine running a bunsiness where I ship things ot people for money without doing address verification. In the mid 90s one of my first database related jobs was parsing the complete US address list we purchased from the USPS and comparing it to our internal mailng list - the process has gotten much simpler over the years. This would have prevented 3 of the problems on this list, and would also result in a much lower rate of failed deliveries (expensive)...

rossdavidh 8y ago

My wife had to learn just about every one of these lessons the hard way in the first few years of running her own (small retail) business. In retrospect, we should have posted the hard-learned lessons online. I'm glad this person did.

supernova87a 8y ago

You would think with the amount of value / fraud at stake, Visa/MC/AMEX themselves would invest in fraud detection technology and offer that as a service to their participating banks and merchants. They have so much more volume and cost absorption capability that they could spin up a much more talented / sophisticated detection group than any individual bank or merchant could, you would think? And charge for it accordingly?

jimktrains2 8y ago
They normally don't shoulder the financial burden of fraud.
- supernova87a 8y ago
  Sure, but who wouldn't like to make a buck from it? Well, I guess they kind of do with every chargeback, so they have conflicting incentives.
robalfonso 8y ago
Visa/MC/AMEX make a MASSIVE amount of money on Fraud - it's in their interest to perpetuate it. I've experienced this myself with > 6 figures in CC fraud in a month. Here is the financial break down: Every time a customer gets a charge due to Fraud, they file a chargeback. If we are able to contest it, all is well, other wise they hit you with a $25-$35 fee PLUS the charge is reversed so depending on margins you are out you're costs on the transaction as well. If the # of fraud transactions gets bad enough (even if you are working with them diligently to get things under control) and not able to stop it, they will charge you a chargeback penalty fee. This essentially says you are high risk and so now give us 50,000 or 100,000 dollars or you can't accept credit cards AND you have X days to resolve this and get you're charge back rate to a reasonable level or we will hit you with another charge bigger charge in 30/60/90 days or whatever the risk management department wants. They may also come back and say now we've told your processor (stripe, braintree, etc) that THEY need to charge you more because we are charging them more to deal with you. So instead of 2.5% of each transaction they are getting 3% for example. It all adds up to billions across the world economy, it costs them only to deal with it administratively and they are collecting many many times that in fees from the merchants. It is very much a scam and the average customer doesn't realize the massive hit companies can take for the convenience of Credit Cards.

sytelus 8y ago

naive question: Why should merchant be worried about this? Isn't it responsibility of CC company to back up the promised credit? If someone unauthorized used someone elses CC then shouldn't CC company swallow that loss?

detaro 8y ago
No. CC companies protect the customer from fraud, not the vendor, unless you have really good proof the customer isn't right a chargeback means you loose the money and often pay a fee on top. + if you are the source of to many chargebacks, they'll drop you entirely.
iamwil 8y ago
The credit card company charges really high fees (on the order of tens to hundreds of thousands of dollars if you have any significant volume) if you have more than 1% of all your transactions as chargebacks. The CC company doesn't swallow the loss--it's the merchant that does.

rdl 8y ago

I’m fine with fraud detection like this, but probably 90% of my ordering is a credit card, through a VPN, or sometimes from a foreign country, shipped to a freight forwarder, with a VOIP PSTN number. There have to be ways to get around this for false positives.

digianarchist 8y ago
There are. Mail you government ID to small business owner that will probably leave it on some vulnerable windows xp machine.

tzs 8y ago

> Two bonus signs for the end. You can use a Geo IP database to check if the shipping address country differs from the IP address country. That's a weak sign (people do place orders while traveling, or to friends in other countries), but can break the tie if there is another suspicion. You can add to that using the first few digits of the credit card to look up the card issuer. If the card is from a bank that does not have a presence in either the region the order is coming from or the region it is being shipped to, that order probably merits a closer look.

anonnyj 8y ago
I kept getting flagged for that kind of thing, had to start using a proxy to make my actually legitimate purposes. Though looking at it from the other side, using a proxy should probably count against you a little.

dottrap 8y ago

So if you see one of these warning signs, what should you do? What if it is a legitimate order? You don't want to turn down a real customer? I presume if you try contacting the person and asking them if it is a fraudulent order, they will deny it. (I suppose if you can't reach them, that is good enough indication to cancel the order as fraudulent.) Can you call the credit card companies or payment processors and ask them to do their own fraud checks to see if it is okay, or are they going to leave you on the hook if it still goes bad? (I suspect the latter.)

mostlyjason 8y ago

If fraud is such a problem for stores would it make sense to offer a discount for payment methods like bitcoin that don’t allow chargebacks? This could reduce the cost of doing business by gaurenteeing payment.

asclepi 8y ago
This is an excellent idea to prevent revenue loss caused by false positives, which are rampant IMHO. It's beyond me why so many merchants opt for the revenue-losing and customer-hostile choice to silently cancel flagged orders and let their competitors run away with the money, while they could easily get a safe sale by making a non-negotiable offer to use an irreversible payment method when a credit card gets flagged. This reverses the trust issue, it's then up to the customer to determine if he trusts the merchant enough and is willing to give up the additional protection that a purchase on a credit card may offer - some of which the merchant may offer instead - to get the item he wants.

trumped 8y ago

Today my bank detected a fraudulent transaction on my CC. They blocked the transaction right away and cancelled my card after confirming it with me... so they probably can prevent a lot of these cases. Very interesting article nonetheless...

sho 8y ago

> One time when I tried googling for an address, I found that the person was also active on a forum for trading stolen credit card details. That was a bad sign Ha. You don't say!

inopinatus 8y ago

The payment service I use (Pin Payments) can include a random value in the payment card narrative, allowing you to hold delivery until the cardholder authorises dispatch with the correct code.

inertial 8y ago

The bad part of credit card fraud is that the card network, issuing bank & gateways pass on the liability to the small merchant. There is always a looming risk of losing your account & business due to excessive fraud, something over which you have no control at times. If you become over aggressive with fraud protection, you risk not only losing revenue but pissing off genuine customers. Your gateway would tell you that as a merchant, it's your job & responsibility to accept a charge & related risk of fraud. Well, if big guys handling billions of payments can't catch fraud, it's quite easy for a small guy to miss it as well. When you are selling a digital product, it's very difficult to win a chargeback. Some low level bank employee hardly cares about your meticulous documentation & proof that you delivered the product. 3D secure is one way to shift liability to issuing bank but it only works for the first charge (not recurring subscription). There are lots of reasons for getting hit by incorrect chargebacks e.g. mistake on part of a customer because they didn't recognize, customer's card getting stolen midway during a subscription, unhappy customer who wants a refund after using your service for months etc. I wish the industry would side with the merchant as well at times i.e. maybe a rating system to see how easy is the merchant's cancellation / refund policy etc.

reembs 8y ago

Some companies today offer a fraud prevention solution which is covered, meaning they will pay the merchant for whatever fraud transaction that slipps through their systems. These companies employ pretty sophisticated methods as this is their core buisiness. I work at one such company, Forter. We take pride at the fact that we approve more than the others would, and we take complete financial responsibility for our mistakes so merchants just don't have to deal with it...

usr1106 8y ago
Paying for fraud that slips through should be the easier part. Do they compensate for lost business because of false positives? The problem is that even the wannabe seller cannot quantify it. At several occasions I have not been able to order something online, because they would not accept my card.

victor106 8y ago

I have a genuine question that is kind of unrelated to this discussion:- What is special about Japanese candy? Is it the packaging? The ingredients?

mcherm 8y ago

You know... there is one entity that is reasonably well funded, has incredibly strong capabilities for card fraud detection, and is well motivated to identify the fraud: the credit card companies. (I work for one, which makes me especially interested in this topic. But I don't work in that particular area, nor do I speak for my employer.) It makes me wonder whether some sort of collaborative fraud detection might be possible. As the merchant, you have access to additional information that the credit card company lacks -- things like the customer's name and the delivery address are (as this article explains) very helpful in detecting fraud, and these are data that the credit card company does not have access to. And of course the credit card company has access to information like the customer's purchase history and their recent transactions, which are useful for identifying fraud from a different direction. If both sources of data were available, it might be possible to detect a higher percentage of fraudulent purchases, and merchants who ship goods could be provided with the information so they could delay or cancel the shipment. Do you think merchants would be interested in such a program?

hackbinary 8y ago
Would merchants be interested in my purchase history? Yes. Would I want/trust merchants to have this information? No.
- mcherm 8y ago
  Oh, I'm fairly certain that the information sharing would only go one direction: the merchants would share the data to the credit card companies, who would run fraud models on it and provide near-real-time feedback to the merchants. In terms of user privacy, this gives the credit card information more information than they already have access to. It is reasonable to worry about the privacy implications of that sharing. But to be honest, the credit card company already knows a great deal just from processing the customer's purchases. Adding in the delivery address (when it differs from the card's billing address) is a leak of personal data, but not a huge one. Additionally, we might be able to put in place contractual controls limiting the data to certain uses. I can assure you (from my own experience), credit card companies are well experienced at compartmentalizing data and limiting data sharing.

bjacobs 8y ago

Run an e-commerce business that sells tires. It seems that a common pattern that’s arising is for a bad actor to use a foreclosed property or rental to ship to, within spitting distance of the billing address, then have the carrier redirect to a pickup store, such as the Fedex store. They have absolutely no problem walking into the store and signing off, all on camera. Troubling times.

Veronica2falkn 8y ago

I recently hired the service of hacker_timothy@outlook.com to test their services with an email hacking job. To my greatest surprise, it worked! I got the email password within 5 hours. They're experts and I appreciate the enthusiasm displayed towards solving my problem. Thanks to hacker_timothy@outlook.com +1 ( 339-337-2730 ) and his team who were ready and helpful in handling my situation to ensure guaranteed results. I give them a 5 STAR RATING! Contact them for : Cyber Tracking * Spying * Retrieving of deleted text messages * Upgrading of results* recovering of Social media passwords* Military hacking* Dump Cards* Bank Transfers* Bitcoin Wallet Hacksbitcoin increaing DDoS Attacks* Website Hacks* Credit Score Boosting* Many more special jobs too & they always offer an affordable price.

DoubleGlazing 8y ago

My old employer, a phone retailer, would check how long the user had been browsing the site and what they looked at. We noticed that legit customers tended to take their time on our site. They would look at several pages and not immediately add something to the basket and checkout. Of course, some legit customers would demonstrate the same pattern particularly when a new phone was launched - but that wasn't too common. So if the user spent less than five mins on the site before checking out, or if they only looked at one product page then that order would automatically be flagged for manual review. 60% percent of those orders were rejected.

petraeus 8y ago

A velocity report is the only real way of pro-actively catching fraudsters. something like ip address by alias or something similar.

pitahummus 8y ago

I work with Signifyd. We are expanding and hiring more Data Scientists and Fraud Analytics ninjas. Apply through the website. We do care about approving good orders while stopping fraudulent ones. In case of a chargeback, we guarantee it.