3 ms·

We're planning to use the shipping address returned from Paypal as-is (and not querying from our side), mostly for stripping the funnel to it's bare minimum -is

by sdrinf 16y ago

We're planning to use the shipping address returned from Paypal as-is (and not querying from our side), mostly for stripping the funnel to it's bare minimum -is that kosher? Definitely signed-for. Other than Nigeria (which I'm quite keen on blacklisting, as a whole), any particular countries which we should be careful about?

jacquesm 16y ago
> We're planning to use the shipping address returned from Paypal as-is (and not querying from our side), mostly for stripping the funnel to it's bare minimum -is that kosher? Yes, it's kosher, but there are a number of checks you can't do like that (such as doing geo verification of the IP, email verification). Those go a long way in screening out fraudulent charges. Presumably paypal has already done a bunch of that, but if the shipping address paypal gives you does not match the geolocation of the IP and residential information of the account holder (not always the same as the shipping address!) within reason that would be a great reason not to ship. > any particular countries which we should be careful about? Yes, but that's going to make me a lot of enemies here ;) Until you have the fraud angle worked out and have ways to monitor and predict risky transactions I would stick to the US initially, the roll out in Europe, one country at a time, after that Japan, and I'd leave it like that for a long time to come. This is not because I do not like people from other countries (rather the opposite), but because combating fraud is a percentage game and one fraudulent transaction can eat up the profits of 10 or more good ones if you're in to physical goods (depending on your margin of course), as well as cause you to be banned, which is a risk not worth taking.
jasonkester 16y ago
Kosher, but make sure you're extremely clear that you intend to do that before charging the card. I, for instance, live 4,800 miles from the billing address that PayPal and my credit cards have on file for me. If you don't plan to ship things to where I'm actually at, I'd prefer to know about it before wasting my time on your site.
cstross 16y ago
I'm somewhat out-of-date, but Russia, Romania, and Bulgaria used to be problematic (and might still be, for all I know). There was a scam whereby some of the more enterprising crooks would buy goods using stolen CC credentials and have them shipped to a Bulgarian address ... but put "Germany" at the bottom instead of "Bulgaria"; the Bundespost being highly efficient would then spot the mistake and forward the package! So you might want to do city/country consistency checks. Again, look out for PO boxes. This is going back years, and probably doesn't affect you if you're only using Paypal verified addresses, but when handling credit cards one useful thing to do was velocity checking: if two consecutive purchases come in, check the physical addresses associated with each transaction and block the transactions if the card would have had to go supersonic to get between them. You might be able to do something similar if you can dereference IP blocks geographically (e.g. purchase #1 on card foo comes in from a net in France and purchase #2 on card foo comes in from a network in Paraguay five minutes later). You can do this lazily (i.e. only trigger the check when you've got the second request).

by sdrinf 16y ago

jacquesm 16y ago

> We're planning to use the shipping address returned from Paypal as-is (and not querying from our side), mostly for stripping the funnel to it's bare minimum -is that kosher? Yes, it's kosher, but there are a number of checks you can't do like that (such as doing geo verification of the IP, email verification). Those go a long way in screening out fraudulent charges. Presumably paypal has already done a bunch of that, but if the shipping address paypal gives you does not match the geolocation of the IP and residential information of the account holder (not always the same as the shipping address!) within reason that would be a great reason not to ship. > any particular countries which we should be careful about? Yes, but that's going to make me a lot of enemies here ;) Until you have the fraud angle worked out and have ways to monitor and predict risky transactions I would stick to the US initially, the roll out in Europe, one country at a time, after that Japan, and I'd leave it like that for a long time to come. This is not because I do not like people from other countries (rather the opposite), but because combating fraud is a percentage game and one fraudulent transaction can eat up the profits of 10 or more good ones if you're in to physical goods (depending on your margin of course), as well as cause you to be banned, which is a risk not worth taking.

jasonkester 16y ago

Kosher, but make sure you're extremely clear that you intend to do that before charging the card. I, for instance, live 4,800 miles from the billing address that PayPal and my credit cards have on file for me. If you don't plan to ship things to where I'm actually at, I'd prefer to know about it before wasting my time on your site.

cstross 16y ago

I'm somewhat out-of-date, but Russia, Romania, and Bulgaria used to be problematic (and might still be, for all I know). There was a scam whereby some of the more enterprising crooks would buy goods using stolen CC credentials and have them shipped to a Bulgarian address ... but put "Germany" at the bottom instead of "Bulgaria"; the Bundespost being highly efficient would then spot the mistake and forward the package! So you might want to do city/country consistency checks. Again, look out for PO boxes. This is going back years, and probably doesn't affect you if you're only using Paypal verified addresses, but when handling credit cards one useful thing to do was velocity checking: if two consecutive purchases come in, check the physical addresses associated with each transaction and block the transactions if the card would have had to go supersonic to get between them. You might be able to do something similar if you can dereference IP blocks geographically (e.g. purchase #1 on card foo comes in from a net in France and purchase #2 on card foo comes in from a network in Paraguay five minutes later). You can do this lazily (i.e. only trigger the check when you've got the second request).