7 ms·
CC fraud is such a big problem, it must be a huge advantage for Amazon. Most of their purchases come from repeat customers that they can be confident exist. Sma
by rb808 9y ago
CC fraud is such a big problem, it must be a huge advantage for Amazon. Most of their purchases come from repeat customers that they can be confident exist. Smaller shops have to figure that out nearly every purchase.
I never thought of that before. Maybe there should be a central shared central repository of who are known good customers/address/cc combinations, or maybe that is what stripe etc do already.
- singlow 9y agoThere are services that do this. Several retail stores I consult for have transaction filtering through an independent fraud detection service which has its oen blacklists of hashed CC numbers, emails, and street addresses. They also evaluate the ip address, distance fom billing and shipping addresses and a slew of other factors.
- santiagogo 9y agoWhich do you recommend? I work with custom solutions for banks which a lot of times include fraud prevention services from third parties, so I'm consistently benchmarking for better alternatives.
- bleachedsleet 9y agoCriminals have many tools that can circumvent these systems though and many are very hard to defeat while still providing a smooth customer experience. There are entire web browsers developed by Russian groups that exist solely to clone the entire fingerprint of the victim, complete with session cookies. A lot of bank fraud happens this way...a hidden RDP service is installed on victims machines and then sold online so you can just remote into their computer, login to their bank and nobody is the wiser. There are services to conduct COBs (change of billing) so you can get new credit cards shipped to fake addresses under the attacker's control. And nearly all online bank account/CC sellers usually include cookies with the stolen cards now. Criminals have quickly figured out that a VPN in the general location of the victim is no longer good enough and they've adapted much faster than security systems can keep up with. There's also still a very big and unfounded trust system between certain merchants and certain banks. For example, AMEX cards sell for much more on the markets because many merchants (including Amazon) will usually assume trust in those cards even if other factors seem a bit off and will often ship products before fully confirming the transaction, so even if the card is flagged, it's likely a criminal could still steal a product or two. This is nonsense and despite being well known information to anyone that's spent even a little time researching fraud networks, it remains an exploitable loophole.
- singlow 9y agoI don't doubt that your statements are true. However, services like this do stop a lot of fraud. If you do not have some basic filtering in place, it is that much easier for the less sophisticated fraudster. The particulars of your business will definitely affect the ability to stop some types of fraud. However if you are shipping a product to your customer you can make fraud pretty hard. It will depend largely on the product you are selling. You have to increase the effort required to successfully get a product shipped so that it exceeds the profit that can be made from it. In our case we often do something similar to this: --- No order is rejected outright - but various combinations of criteria cause a manual review of the order. This prevents customers getting error messages and also avoids having fraudsters receive quick feedback. Shipping addresses known to be forwarding mail centers or mailboxes are flagged. If the billing address does not match the shipping address, and the IP is flagged as proxy/vpn/datacenter, etc. or is too far from the billing/shipping address, it is flagged. This allows most people to ship to their office even though the credit card is at their home address, etc. If the billing address is to far from the shipping address it is flagged. Fraudster are limited to using cards that have billing addresses in a close range to where they can receive goods. The machine learning system gives a score and various thresholds of that score are used to trigger in combination with other factors. Flagged items are manually reviewed. Sometimes customers are called to do human verification. --- Some still get through, but I just implemented one a few weeks ago and saw 99% reduction in fraud orders, and a 90% reduction in man-hours for reviewing orders. In most cases, the fraudsters will just see that it is no longer worth their time and move on to easier targets. Obviously this particular store had a serious problem due to a high level of automation and an easily resalable product. The margin of the product and relatively low shipping costs allowed the fraud to get to pretty high levels before they really focused on it.
- darksim905 9y agoWhat services do this & are they expensive to implement? Are you just unloading CC data & other hashed values for matches like Maxmind?
- singlow 8y agoYes - you send a hashed cc number along with client ip and most of the order/payment info. I wrote another response to a sibling post with it but I must have never submitted it because I don't see it there. FraudLabsPro and Subuno are entry/mid level products. Others like Sift Science, Riskified and Simility only have very high volume options or don't advertise any entry-level pricing.
- splonk 9y agoYes. There are significant beneficial network effects in payment processing. Back in the day, eBay had ludicrously good fraud rates (and hundreds of engineers working on models, from what I heard). We hired a few people from them and were quite proud to achieve rates in the same ballpark with orders of magnitude less traffic.
- paulie_a 9y agoeBay also had and still has a reputation for outright letting fraudsters operate easily as buyers. I would never trust eBay to sell anything there anymore.
- StudentStuff 9y agoSame for sellers. Its really sucky to get a bunch of broken laptop keyboards from a seller, then get replacements that are also liquid damaged or physically damaged.
- paulie_a 9y agoBuyers automatically win all disputes though. And every though PayPal thankfully split from eBay the buyer wins there too.
- thecosas 9y agoYep, Stripe handles that via "Radar": https://stripe.com/us/radar https://stripe.com/us/radar
- skookumchuck 9y agoWhenever I travel, I learned the hard way to put a "travel alert" on the credit cards. Otherwise, they may shut them off if suddenly charges start appearing from a foreign country!
- Jach 9y agoI've never had problems not posting notice on my trips to Canada but I didn't feel brave enough to try transacting in Japan without notifying first... Still, I wonder with the prevalence of chip readers, isn't the "card is present" signal much stronger? So unless they think I've had my card stolen and haven't bothered to report it yet they probably shouldn't stop any card-present transactions.
- Rjevski 9y agoChip transactions are indeed a huge signal - a chip transaction can’t be faked due to strong cryptography. Granted, the card can still be stolen, but it’s rare enough that most banks let it though.
- InitialLastName 9y agoI feel like if my card gets stolen and I don't notice before it gets to Japan and starts spending money, I have bigger issues.
- ahakki 9y agoMagstrip cards can be cloned very easily. You might still have your card, but maybe someone copied the data off it last week. The chip is a different story.
- zeusk 9y ago> a chip transaction can’t be faked due to strong cryptography. There is always a defcon pwn https://www.youtube.com/watch?v=JABJlvrZWbY https://www.youtube.com/watch?v=JABJlvrZWbY
- 9y ago
- janesvilleseo 9y agoI once bought a 2k item online from a well known camera store in the US. I called and asked for a competitor price adjustment. I did end up purchasing it over the phone. A day later I noticed that a fraud specialist from that company looked at my LinkedIn profile. So, yeah I guess that they do have to figure it out on almost every transaction/customer
- acomjean 9y agoThe camera stores have it down pretty well. I remember trying to ship a camera lens to my fathers place (He's retired and can sign for it) as opposed to my usual address. Long story short (and a phone call), I did get it sorted. But part of that was I was a customer for a few years and was able to prove that it was ok. I was glad they were vigilant. They have databases of "known addresses" so if your order doesn't match, it can be hard. (They keep the old addresses too, as an attempt to get UPS automated phone center to hold for pickup one time ended up with them shipping the clothes to an 8 year address of mine in a adjacent state. )
- kevin_thibedeau 9y agoI just bought an expensive bed yesterday and got a fraud alert text within 5 seconds of the transaction going out and my card was shut off today temporarily until I confirmed the purchase again. Some banks are fairly on the ball when it comes to detecting irregular purchase patterns.
- arbuge 9y agoServices such as Stripe and PayPal indeed serve as central repositories for fraud intelligence. I imagine that other payment gateways also provide a similar function, though those two are the ones I'm personally familiar with. We've operated a small ecommerce business for almost 8 years and although PayPal fees are probably on the high side, fraud has been a non-issue for us.
- wslh 9y ago> PayPal fees are probably on the high side, fraud has been a non-issue for us. It should he an issue for you. That is because PayPal is stopping a lot of payments with false positives. I live outside US and using PayPal is generally a pain in the ass.
- arbuge 9y agoHmmm... that does sound interesting. Might you have any hard data to back this up? If it's true I'd expect that we'd get alot more complaints from customers that their cards are being rejected.
- hrktb 9y agoWould a customer complain to you because of a paypal doesn’t cater to them ? In particular, credit card setings are multi-step and all done on the paypal site, I wouldn’t imagine going back to some merchant site to complain about that process.
- arbuge 9y agoI would imagine that at least some would, given that they're interested enough in the product to initiate the checkout process. In the absence of any hard data on this, I'm writing it off as nectodal.
- wslh 8y ago> In the absence of any hard data on this, I'm writing it off as nectodal. The Internet is full of this stories from people with good karma. Just look for it on Internet. Probably you are from one of the few countries where the experience is different.
- hannibalhorn 9y agoLiving abroad and using a forwarder ... I buy almost exclusively from Amazon just because I know it'll be easy. Pretty much anywhere else, it seems to be a 50/50 chance that they'll just cancel the order, half the time without so much as a notification.
- krispbyte 9y agoEquifax. But we know how that worked out. Could a Blockchain/DHT solution work for this? Normalize and hash the data and send it to the network to check its karma. If there's no karma then it's a new customer, otherwise the karma tells if it's a good/bad customer. Then after they buy you add or reduce a karma point. Would there be a way for someone to reverse/bruteforce the hashes to figure out people information?
- lxmorj 9y agoMD5 Hash of concatenated CC# & street address for all orders. Post to a database 90 days after the order shows no signs of fraud. Use existence in the DB (weighted by number of instances) as a probability of not-fraud. My guess is Shopify, Stripe, etc are doing something like that when they send "this might be fraud, you should review" alerts.