15 ms·

Facebook Let Kids Rack Up Charges on Parents' Credit Cards

CaveTech 8y ago
None of this is unique to Facebook - it plagues the entire industry. I would even argue that games companies are far more complicit in this scheme than any service provider.
- senectus1 8y ago
  true, but Facebook is an order of magnitude larger, more integrated and more powerful than the others. They need to Drawn and Quartered publicly to clean them up. Each of these articles adds up to something very scary. I expect Amazon is due to a truth telling as well.
- baxtr 8y ago
  I think this is a lot about “transferring insight”. Like this: if FB knowingly duped kids and their parents, where else have they knowingly duped people? Elections? Data? Etc
- socialist_coder 8y ago
  The game devs are not the ones caching your CC and letting kids reuse it without proof they have parental permission. Come on, not even close in terms of who is at more fault here.
quickthrower2 8y ago
We so need credit card tech that puts the card holder in control. Like a 2fa message to accept every single charge no matter how small.
yeuxverte 8y ago
Is anyone surprised that 11 year-old Johnny "didn't realize" he was spending money? Sounds like parents looking to blame anybody but themselves.
- loteck 8y ago
  Source documents are linked throughout the story.
- Yetanfou 8y ago
  That's odd, the article I read did contain specific instances of parents retracting the steps of their spendthrifty offspring which confirmed there was no indication of actual money being spent, e.g.: “I saw all these $19 charges from Facebook,” she said. “It added up to nearly $1,000.” She asked her son why he would do that. But he was flabbergasted by the charges too. So Bohannon asked her son to play the game so she could watch what he was doing wrong. As he played, he occasionally clicked on a corner of the screen that gave him more abilities, such as magical items, or new ninja attacks for his character. It didn’t ask if he wanted to pay for it, or let him know that his mom’s credit card was being charged. “There was no indication he was spending money,” Bohannon said. “So, 20 minutes later, I rechecked my credit card statement online. And sure enough, there was another $19.99 charge from Facebook.”
  - gknoy 8y ago
    Holy cow, that's frightening. Mobile games with in-app payments are clear about "These cost gems {or some other bought-with-real-money mcguffin)", but refilling those gems nearly always makes it clear that you're going to have to pay.
    - socialist_coder 8y ago
      Facebook payments platform was always far behind Apple & Google Play in terms of transparency.
deleted 8y ago
[deleted]
loteck 8y ago
Why is this submission marked as a dupe?
- sctb 8y ago
  https://news.ycombinator.com/item?id=18937640 https://news.ycombinator.com/item?id=18937640
  - DamnInteresting 8y ago
    Hmm, that's an earlier story from the same site announcing that the documents are expected to be released, whereas this link is about what the released documents actually revealed. They are related links, but not quite the same.
    - tareqak 8y ago
      I agree. This post is a follow-up, not a duplicate.
    - dang 8y ago
      Ok, we'll de-dupe it.
      - loteck 8y ago
        With all due respect, I think his was plainly obvious to someone who even glanced at the submitted story, and shouldn't have had to been explained to mods.
        dang 8y ago
        Different things are obvious to different people!
chemmail 8y ago
It's like facebook are all those evil corporations you see in movies.
enterx 8y ago
facebook as a platform provider is guilty as charged. there is a special form enforced for storing credit card information. Where was QSA? Credit card providers and game providers should also take their part in responsibility for storing credit card information. I do not get how is this still possible with 3D secure protocol out there?
deleted 8y ago
[deleted]
ShroudedNight 8y ago
1. Company is on the record as being aware of unauthorized use of parents' credit cards. 1a. Company is aware of channels particularly prone to unauthorized use of credit cards (with Ninja games being presented as the archetype). 2. Company creates a method for verifying the authority of purchase (and confirms that it works) 3. Company intentionally does not implement verification method, thus explicitly profiting from known fraud. Now, I'm very much not a lawyer, but this strikes me as the sort of behavior we would seek criminal penalties for. Has there been any indication that this has been forwarded to the relevant parties for investigation / prosecution?
- billfruit 8y ago
  The catch is FB requires that users be 13+, and someone younger than that using FB is a violation of their terms. Some if not most of these kids may be younger than that.
  - perl4ever 8y ago
    It seems reminiscent of marketing tobacco/nicotine to minors. It's easy to say "well, it's not our fault people are breaking the law/contract" up until it comes out that internal documents show the company was targeting such people. I don't completely understand why people maintain that something could be innocent while ignoring the evidence that it wasn't.
- mirimir 8y ago
  Well, in TFA: > The records are part of a class-action lawsuit focused on how Facebook targeted children in an effort to expand revenue for online games, such as Angry Birds, PetVille and Ninja Saga. They have a strong case, I think. Indeed, the facts are so egregious that punitive (treble) damages are possible. So even if class counsel take ~30%, the class could get ~100% recovery. How much? Well, basically it'd be [number of children]*[amount charged per child]. Maybe a few $billion?
- TylerE 8y ago
  Maybe parents should have a separate login for their kids that doesn't have the CC info saved? Leaving that saved in the browser is awful close to authorization since there are reasonable, low-effort steps that could be followed by a non-technical user to prevent it from happening. It's like leaving your card on the kitchen counter and being upset when they order pizza.
mindgam3 8y ago
The issue is Facebook denying refund requests after children were suckered in to make large in-game payments using their parents' stored credit cards. It's not just that this whole scenario is slimy. It's that Facebook was fully aware of it, had a nice in-house term for it ("friendly fraud"), and not only chose not to approve refunds but also chose not to implement the most basic measures to prevent it. [edit: as a commenter pointed out, the term “friendly fraud” predated Facebook] This is symptomatic of a corporate culture that is toxic to to the core. The money quotes are in the 2 paragraphs below: "In 2011, Tara Stewart, a risk analyst for Facebook, studied the issue and suggested that the company begin requiring users to enter the first six digits of a credit card used for payments on certain games. Stewart ran a survey of Facebook users and found that many parents were not aware that Facebook stored their payment information after entering it one time. They also found that the kids weren’t aware of what they were doing. “It doesn’t necessarily look like ‘real’ money to a minor,” Stewart wrote. She ran a test to see if the entering the cards first six-digits would reduce these unwanted charges and the results were encouraging. She also said it would “make sense to start refunding for blatant FF-minor.” The abbreviation “FF” stood for “Friendly Fraud,” the term Facebook used to refer to these fraudulent purchases which were made without malicious intent. Despite this obvious solution, Facebook decided that it would harm revenue and elected to continue fighting refund requests for the foreseeable future, the documents show."
- deleted 8y ago
  [deleted]
  - deleted 8y ago
    [deleted]
- endofcapital 8y ago
  I'm not sure which class at business school is teaching everyone that "If you can get away with it do it! Have zero shame!" because it's probably time to remove that one from the Harvard curriculum.
  - ben_jones 8y ago
SkeptinenSpede5 8y ago
Why we like to ourselves.. facebook lied period. Please stop fooling your self
vacocake 8y ago
Why we don't call it as it should be called ? Fraud as it is. Friendly fraud is also Facebook's fake acccounts
Balgair 8y ago
So, FB not only did this scummy act once, they did it many many times, never tried to remedy it, and never tried to alter the 'pathway' for this to occur, but they had this happen so often that they came up with a nick-name for it? Like, I knew they were evil, but I didn't think they were stupid too [0]. [0] https://en.wikipedia.org/wiki/Stringer_Bell#Season_three https://en.wikipedia.org/wiki/Stringer_Bell#Season_three
officemonkey 8y ago
If Facebook knowingly refused to refund improper transactions, THEY are the ones committing fraud. Plain, old, "screw you, Facebook user" fraud.
benologist 8y ago
Steam / Valve did this for quite a few years until they were taken to court in Australia for their unfair practices. A judge said their refund policy was criminal and intended to deny refunds and fined them a couple million dollars for an estimated 20,000 times. Steam drastically changed their refund policy and evaded fallout everywhere else, but it's probably going to be substantial for Facebook. https://www.pcmag.com/news/350574/valve-fined-3m-in-australia-over-steam-refunds https://www.pcmag.com/news/350574/valve-fined-3m-in-australi...
- elefanten 8y ago
  These two cases seem pretty different to me. Steam wasn't in compliance with Australian refund laws and got in trouble for it. But the Steam case had nothing to do with minors (mostly very young children) making inadvertent purchases.
  - benologist 8y ago
    The similarity is the intent to refuse lawful refunds, and probably the scale. Steam never optimized to refuse more refunds though.
  - tinus_hn 8y ago
    The same thing happened with Apple in the US: https://www.macworld.com/article/2087844/apple-ftc-settle-over-in-app-purchases-by-minors.html https://www.macworld.com/article/2087844/apple-ftc-settle-ov...
DanielDent 8y ago
"Friendly fraud" is not a Facebook-invented term. It's a term used and understood by card issuers, acquirers, and merchants. Friendly fraud encompasses: - Dissatisfied customers who don't find refuge in a refund policy/process - Customers who are embarrassed by their purchases. This situation is commonly triggered when a significant other reads a credit card statement. - Customers who spend beyond their means, and then look for a "solution" when the statement comes due I find it weird the way Facebook seems to be using the term here. These are charges that were never contemplated by the cardholder. There is no "buyer's remorse" dimension. Friendly fraud is specifically about charges that are agreed by the card holder, but they later change their mind and pretend otherwise.
- jakelazaroff 8y ago
  I don't think Facebook is accidentally misusing the term. They want to redirect sympathy from the cardholders to themselves by framing the situation as if it were just a case of "buyer's remorse", when really they've intentionally built the system to incur these mistaken charges.
  - billfruit 8y ago
    Most probably Facebook didn't make the games themselves. And I thought one had to be at least 13 years to use Facebook, but probably some parents are allowed younger kids access.
    - SethTro 8y ago
      Average age of angry bird user was 5 the article says
      - thaumasiotes 8y ago
        Really? I thought the presence of the brand was bigger (back in the day) than that would allow for. An average age of 5 puts a pretty sharp limit on the number of 30-year-olds who can play. They're not going to be balanced out by one -20-year-old each.
tschellenbach 8y ago
Personally I think most of the reporting on Facebook is written to drive clicks and ad revenue. It's usually exaggerating the problems. This story is truly messed up though.
tuckermi 8y ago
The article references this URL: https://ecf.cand.uscourts.gov/cgi-bin/HistDocQry.pl?616030812309732-L_1_0-1 https://ecf.cand.uscourts.gov/cgi-bin/HistDocQry.pl?61603081... However, that is not accessible without an account and possibly payment for the document. Is this content part of the public domain. If so, can/has it been posted elsewhere? Edit: I should add that I do see some of the documents reproduced and referenced from elsewhere in the article (e.g. https://www.documentcloud.org/documents/5694620-Exhibit-OO-Redacted.html#document/p3/a477371 https://www.documentcloud.org/documents/5694620-Exhibit-OO-R...), however I didn't see any way to access the full collection.
- dlgeek 8y ago
  https://www.courtlistener.com/recap/ https://www.courtlistener.com/recap/ https://free.law/recap/ https://free.law/recap/
deleted 8y ago
[deleted]
rdiddly 8y ago
It's okay guys, the security of your credit card information is important to them! Also, it's a big responsibility, and they "need to do better." https://www.google.com/search?hl=en&q=zuckerberg+"we+need+to+do+better" https://www.google.com/search?hl=en&q=zuckerberg+"we+need+to...
ravenstine 8y ago
Facebook could be run by the Russian mob and people would continue to use it(and Instagram and WhatsApp).
- Rufnxurjd 8y ago
  Telegram is prolly run by the mob tbqh
microcolonel 8y ago
Just don't save payment card information in your Facebook account which you share with an irresponsible minor. If you primarily blame Facebook for this problem, you are failing as a parent. The fact that it is technically possible for Facebook to validate some purchases and prevent some instances of this problem does not make it Facebook's responsibility not to do something practically equivalent to handing your wallet to a toddler at a carnival.
- NeedMoreTea 8y ago
  Ah yes, blame the parents. A 9% chargeback rate on payments identified from minors is an awful lot of careless parents. The real fraud rate would be a lot higher as plenty might write it off to experience come credit card bill. Quite often these things are remarkably difficult to cancel too (no idea if that applies to Facebook). The fact is many of these ongoing payments, and the use of separate game currencies rather than simple $1.99 are deliberately unclear, even to fully clued up adults. That's rather the whole point of them.
  - microcolonel 8y ago
    > The fact is many of these ongoing payments, and the use of separate game currencies rather than simple $1.99 are deliberately unclear, even to fully clued up adults. That's rather the whole point of them. Well, so are amusement park tickets. That doesn't mean you are absolved of responsibility for controlling your cash when you go to an amusement park.
    - empath75 8y ago
      If your toddler tried to use your credit card at an amusement park to buy $500 worth of cotton candy I imagine the person at the counter would not process it.
      - justtopost 8y ago
        That is a perfect illustration. Facebook is the cornerstore that will sell your kid 500 in toys and comic books, only to upsell them a pack of camels from my checkout display. It's cool, we already have your daddys credit card from last time, and he said we could use if for his future transactions. And because you are clearly a young child, lacking agency, I will bill him. Yet I will refuse to refund it when dad comes in later. Did I mention I am selling access to your data, also webcams!? Its goddamn terrifying we let it get this far.
dlandis 8y ago
If true, this seems to be one of the more clear cut recent examples of unethical policies devised by Facebook employees. I suspect certain other policies and programs can be mentally justified, but when it comes to very obvious things like this I would think it would have a bigger impact on whether top employees including engineers would be willing to continue working there. Everyone has their own personal line beyond which they’ll just decide to move one. I have already read about some people moving on lately but don’t know if it’s a trend yet.
- golemotron 8y ago
  " by Facebook employees" The buck stops where?
  - darkpuma 8y ago
    A fish rots from the head. But is it just the head that's rotten? No, soon the whole fish is rotten; that's the point. So yes, Zuck is rotten. And consequently we should expect to find systemic rot through the organization at all but the very lowest levels (the groundskeepers and maintenance guys are probably clean)
TheLuddite 8y ago
If my child takes the money that I left on the desk, goes to the shop, buys candies and eats them...can I go to the bank and ask them to give back my crisp bills? Or maybe go to the candy store and whine there?
- socialist_coder 8y ago
  Let me give you an analogy that actually fits the truth: You went to the candy store with your child and paid via CC. The candy store saved your CC by default, and due to deceptive UX, made it difficult to figure out that you needed to opt-out of the saved CC. The next day, your child was walking past the candy store and the candy seller runs outside and says, "hey kid, you want this candy? its super good and you can have it for 5 dollars! just take it, its yours!" kid takes candy, you get charged $5. and in reality, even the "you can have it for 5 dollars" part is generous. facebook did not require the game developers to make it obvious when things cost real money or not.
- detaro 8y ago
  In many jurisdictions that's not a valid contract, so yes, the store has to reverse it.
minikites 8y ago
It's interesting watching Silicon Valley discover the purpose of government regulations from first principles.
- justtopost 8y ago
  Nothing old applies to us! Until we invent it here! Again. Its magical.
megous 8y ago
So they can just return money to all the wronged people now? Or did they already? How about people outside of US? I mean there would have to be some criteria for deciding who to return money to, but I'm sure they can come up with something less arbitrary than the original decision making that's hinted at in the article.
beezischillin 8y ago
I explicitly make spending money online harder for myself as a protection from things like this. (Well, primarily I also don't play any games with micro-transactions for one because they're universally a rip-off designed to exploit addictive personalities. Games based around these shady tactics should never have been tolerated, let alone allowed to become the standard to such a degree where even real AAA $60 video games are now infested with this. It's disgusting.) Very few things and services have my payment information saved -- usually just Apple and PayPal have it saved. I never save credit or debit card details to the keychain so the browser doesn't auto-complete it. I always go out of my way to set payment confirmation dialogues to always appear. Whenever I subscribe to something, I use PayPal or the App Store subscription feature. In case it's a yearly recurring subscription, I always go out of my way to cancel auto renewal. If nothing else, I delete the authorisation from PayPal for automatic renewal. I always go and double-check if some place saved my credit card details or not and if they have then I delete them. While not completely fool-proof, these steps have made it easier to more carefully manage my online spendings and not to suckered into parting with my money.
- dylan604 8y ago
  I have the same habits. Every month, I have to enter my payment info for phone,car,etc. They always have that little check box for "save payment info for later". Nope. To the point that my car payment is now done over the phone each month because they changed their website to force you to enter a payment (checking/routing). At the rate sites are getting hacked, I will not enter any more information that required to make it work. As with my auto company, if it requires more info than I want to provide, then I don't use it.
  - Chris_Chambers 8y ago
    How does doing it over the phone help? Now the call center employee can write down your details and rob you later, as can anyone who reviews a recording of the call. Your risk increases every month you call and reveal your payment details to yet another stranger.
pbalau 8y ago
It's obviously fbs fault that you can't educate your kids or even control them. Fb did not put a phone in your kid's hands to shut him/her up, you did.
InclinedPlane 8y ago
> But the company had discovered that more than 9 percent of the money it made from children was being clawed back by the credit card companies. > In comparison, the average chargeback rate for businesses is 0.5 percent, according to the Merchant Risk Council, a nonprofit that helps businesses manage risk. > A chargeback rate of 1 percent is considered high, and credit card companies such as Visa and Mastercard will put businesses on probation programs for rates consistently that high. > The Federal Trade Commission said in an unrelated fraud case in 2016 that a 2 percent chargeback rate was a “red flag” of a “deceptive” business. Nine percent chargeback rate. That's just absolutely nuts.
- CuriousSkeptic 8y ago
  That explains why the security is so lax. The card companies are complicit in the scheme.
socialist_coder 8y ago
Well, if I had any small amount of trust in FB / Zuckerberg to do the right thing, I just lost it. These are some super shady and deceptive business practices.
SilverSlash 8y ago
Well, the solution is simple -- don't give your kids your credit cards...
tareqak 8y ago
1) If an individual app developer did something like what Facebook did here, then there is a better than good chance that they would be successfully prosecuted with a crime. Why is the criminal justice system so much more lenient on corporations? If it is just money, then we have to accept that arbitrariness can be bought and paid for by those who can afford it. There are a few voices here that advocate for less prison sentences with whom which I agree with, but white collar crime like the kind in the article isn't punished to the same level of severity when the organization at large is at fault. It seems that the incentives for certain kinds of problematic behavior change when your at scale. 2) If you allow this sort of behavior long enough, then it definitely seeps into the culture, the decision-making of management, and the interactions of all those who work there (full-time, part-time, contractors all included). If bad apples can spoil the bunch, then will certain people refuse to interact, do business with, or hire former Facebook employees? Is there / will there be a "blue shield" for Facebook as there is for law enforcement?
mmmmmmmmm 8y ago
Seems like there are three points of failure here: 1. Dumbfuck kids who don't realize they're spending money. 2. Scummy games that deliberately obfuscate the fact that you're spending real money. 3. Facebook not requiring any sort of verification to spend money via a game. Remove any one of these three and the problem doesn't exist. Facebook certainly seems to be at greatest fault here, but it's amazing how much the game developers have managed to escape scrutiny.
deleted 8y ago
[deleted]
npunt 8y ago
Note at the time (2011-2012) there was almost assuredly a lot of incentive at FB to look the other way regarding this kind of fraud, since they were preparing to go public (May 2012). When going public you want to get the best price on your IPO, so I imagine the order from higher up was to push revenue higher and look the other way on these types of issues. FB's stock dropped 40% in the months after going public, so that incentive to not do anything to impact revenue remained as FB dug themselves out of that hole. It may have even been amplified because internal employees were in lockout period watching the stock drop and wanting to cash out at a good price, and probably were (psychologically) price anchored on the IPO price.
- eeeeeeeeeeeee 8y ago
  Yep, I think this just shows how the push for ever increasing revenue creates a disgusting environment. Almost every single bad Facebook decision can be traced to them trying to cut corners for increased valuation.
deytempo 8y ago
And this guy (Zucker) was talking running for US president? Whhhoooah
dwighttk 8y ago
Who is giving Facebook their credit card? Why?
- mikejb 8y ago
  Parent gave the CC to Facebook in order to make one purchase. It isn't always transparent that this payment option is then stored indefinitely, and can be charged on user input without re-evaluating that the charge was initiated by the holder of the CC. This is not necessarily a bad thing, and can be viewed as a convenience-feature. But it has downsides, which Facebook not only seems to be aware of, but seems to welcome.
Proven 8y ago
That can happen only because the parents allowed it before FB did it.
pesenti 8y ago
A friendly fraud implies that the refund was actually made to the customer (https://en.wikipedia.org/wiki/Friendly_fraud https://en.wikipedia.org/wiki/Friendly_fraud). The article states: "“Friendly fraud” is the term Facebook used when children spent money on games without their parents’ permission." That's incorrect and completely reverses the meaning of the internal FB memo. “Friendly Fraud – what it is, why it’s challenging, and why you shouldn’t try to block it.” (Disclaimer: I work at Facebook but wasn't there at the time.)
golemiprague 8y ago
It's not only facebook, all platforms have difficult way of managing kids spending. You have to put "payment method" which is saved and invoked automatically, or you don't and then have to fill it up every time you want to buy something and then remove it. They should do an email and confirmation system, when a kid buy something it sends an email to the parent who can confirm it or not, that's all.
_cs2017_ 8y ago
Uhh what the actual fk, the article reversed the meaning of FB emails. FB encouraged devs to NOT fight the "friendly fraud". "Friendly fraud" is an industry term (just google it). It is when a customer who received goods then calls VISA and asks to refund their purchase. Anyway. FB told devs "let parents get their money back, don't fight it". But this article says FB told devs "keep committing fraud", which would be just about the opposite. Obviously, FB should have taken measures to prevent kids from using their parent cards without permission. But just because FB behaved badly, does not mean it's ok for revealnews.org to spread dirty lies.
EngineerBetter 8y ago
When are you all going to delete your Facebook accounts? I got 9 friends to install Signal yesterday to help them away from WhatsApp. I'd love to see widespread campaign to encourage people to ditch these parasites we're addicted to.
mosselman 8y ago
Sad to see that so many smart people in our industry lend themselves to work for Facebook. There are great tech innovations that come out of Facebook, but that doesn't weigh up to the damage they are doing to society. Sam Harris has released two great podcasts that discuss how Facebook, and other companies like them, choose to earn money from, amongst other things, radicalising and polarising people in our societies: https://samharris.org/podcasts/146-digital-capitalism/ https://samharris.org/podcasts/146-digital-capitalism/ https://samharris.org/podcasts/145-information-war/ https://samharris.org/podcasts/145-information-war/ and to some extent: https://samharris.org/podcasts/144-conquering-hate/ https://samharris.org/podcasts/144-conquering-hate/ I recommend these highly.
Dowwie 8y ago
The modern in-game transactions remind me of simpler exploits from years ago: 900 number phone games. Back in the 80s, children were bombarded with advertisement of phone based games using a 900 number prefix. 900 numbers are unique in that they charge a fee for use. A child who wanted to play the RoboCop phone game would simply pick up a phone and dial the number. Shortly after, they would get to press numbers on the keypad to choose their own adventures. The games were addictive and expensive. [1] Eventually, enough parents were ripped off and they fought the system, convincing legislators and regulators to stop the exploitation. This put a complete stop to 900 number games. [1] https://guff.com/15-bizarre-1-900-numbers-from-the-80s-and-90s https://guff.com/15-bizarre-1-900-numbers-from-the-80s-and-9...
JimBrimble35 8y ago
Probably an unpopular statement, but man does this happen a lot with fortnite. They even have a section in their help pages specifically for unauthorized purchases by family members. Also, they don't seem to care at all about who's payment method is associated with an account. You even get kids taking pictures of their parent's credit cards and passing them around.
andygcook 8y ago
This type of predatory behavior has been happening for a long time. When I was about 9 years old, my brother and I bought Link's Awakening on Gameboy. On the back of the booklet that comes with the game was a line that read, "Need Help? Call this number" with an 900 phone number listed. We had access to the home phone and wanted to beat the game. So of course, we called the number a few times to get hints on how to beat hards parts of the game. This was before the internet where you could just lookup a walkthrough online. You can imagine my mother's shock when she received a $200+ charge on her phone bill for a phone number she had never heard of. Apparently the cost of the call was about $5/minute. We got yelled at and we weren't allowed to call the number anymore after that. I'm proud to say we still beat the game though.
- aacook 8y ago
  I still feel guilty about it every time we recount this story. I remember exactly where I was (on the top bunk) when mom shared the bill with me. I think she had me dial into the number to show her how it worked. To their credit, Nintendo did disclose there was a cost to the service but as I'm sure kids ignore notifications these days, I blindly pressed 7 or whatever because I wanted to get through the next level so badly. It didn't seem like real money. I can't remember if mom made me do excess chores to pay off the debt but I'm guessing she did. I should pay her back the $200 with interest.

None of this is unique to Facebook - it plagues the entire industry. I would even argue that games companies are far more complicit in this scheme than any service provider.

senectus1 8y ago
true, but Facebook is an order of magnitude larger, more integrated and more powerful than the others. They need to Drawn and Quartered publicly to clean them up. Each of these articles adds up to something very scary. I expect Amazon is due to a truth telling as well.
baxtr 8y ago
I think this is a lot about “transferring insight”. Like this: if FB knowingly duped kids and their parents, where else have they knowingly duped people? Elections? Data? Etc
socialist_coder 8y ago
The game devs are not the ones caching your CC and letting kids reuse it without proof they have parental permission. Come on, not even close in terms of who is at more fault here.

quickthrower2 8y ago

We so need credit card tech that puts the card holder in control. Like a 2fa message to accept every single charge no matter how small.

yeuxverte 8y ago

Is anyone surprised that 11 year-old Johnny "didn't realize" he was spending money? Sounds like parents looking to blame anybody but themselves.

loteck 8y ago
Source documents are linked throughout the story.
Yetanfou 8y ago
That's odd, the article I read did contain specific instances of parents retracting the steps of their spendthrifty offspring which confirmed there was no indication of actual money being spent, e.g.: “I saw all these $19 charges from Facebook,” she said. “It added up to nearly $1,000.” She asked her son why he would do that. But he was flabbergasted by the charges too. So Bohannon asked her son to play the game so she could watch what he was doing wrong. As he played, he occasionally clicked on a corner of the screen that gave him more abilities, such as magical items, or new ninja attacks for his character. It didn’t ask if he wanted to pay for it, or let him know that his mom’s credit card was being charged. “There was no indication he was spending money,” Bohannon said. “So, 20 minutes later, I rechecked my credit card statement online. And sure enough, there was another $19.99 charge from Facebook.”
- gknoy 8y ago
  Holy cow, that's frightening. Mobile games with in-app payments are clear about "These cost gems {or some other bought-with-real-money mcguffin)", but refilling those gems nearly always makes it clear that you're going to have to pay.
  - socialist_coder 8y ago
    Facebook payments platform was always far behind Apple & Google Play in terms of transparency.

deleted 8y ago

[deleted]

loteck 8y ago

Why is this submission marked as a dupe?

sctb 8y ago
https://news.ycombinator.com/item?id=18937640 https://news.ycombinator.com/item?id=18937640
- DamnInteresting 8y ago
  Hmm, that's an earlier story from the same site announcing that the documents are expected to be released, whereas this link is about what the released documents actually revealed. They are related links, but not quite the same.
  - tareqak 8y ago
    I agree. This post is a follow-up, not a duplicate.
  - dang 8y ago
    Ok, we'll de-dupe it.
    - loteck 8y ago
      With all due respect, I think his was plainly obvious to someone who even glanced at the submitted story, and shouldn't have had to been explained to mods.
      - dang 8y ago
        Different things are obvious to different people!

chemmail 8y ago

It's like facebook are all those evil corporations you see in movies.

enterx 8y ago

facebook as a platform provider is guilty as charged. there is a special form enforced for storing credit card information. Where was QSA? Credit card providers and game providers should also take their part in responsibility for storing credit card information. I do not get how is this still possible with 3D secure protocol out there?

deleted 8y ago

[deleted]

ShroudedNight 8y ago

1. Company is on the record as being aware of unauthorized use of parents' credit cards. 1a. Company is aware of channels particularly prone to unauthorized use of credit cards (with Ninja games being presented as the archetype). 2. Company creates a method for verifying the authority of purchase (and confirms that it works) 3. Company intentionally does not implement verification method, thus explicitly profiting from known fraud. Now, I'm very much not a lawyer, but this strikes me as the sort of behavior we would seek criminal penalties for. Has there been any indication that this has been forwarded to the relevant parties for investigation / prosecution?

billfruit 8y ago
The catch is FB requires that users be 13+, and someone younger than that using FB is a violation of their terms. Some if not most of these kids may be younger than that.
- perl4ever 8y ago
  It seems reminiscent of marketing tobacco/nicotine to minors. It's easy to say "well, it's not our fault people are breaking the law/contract" up until it comes out that internal documents show the company was targeting such people. I don't completely understand why people maintain that something could be innocent while ignoring the evidence that it wasn't.
mirimir 8y ago
Well, in TFA: > The records are part of a class-action lawsuit focused on how Facebook targeted children in an effort to expand revenue for online games, such as Angry Birds, PetVille and Ninja Saga. They have a strong case, I think. Indeed, the facts are so egregious that punitive (treble) damages are possible. So even if class counsel take ~30%, the class could get ~100% recovery. How much? Well, basically it'd be [number of children]*[amount charged per child]. Maybe a few $billion?
TylerE 8y ago
Maybe parents should have a separate login for their kids that doesn't have the CC info saved? Leaving that saved in the browser is awful close to authorization since there are reasonable, low-effort steps that could be followed by a non-technical user to prevent it from happening. It's like leaving your card on the kitchen counter and being upset when they order pizza.

mindgam3 8y ago

The issue is Facebook denying refund requests after children were suckered in to make large in-game payments using their parents' stored credit cards. It's not just that this whole scenario is slimy. It's that Facebook was fully aware of it, had a nice in-house term for it ("friendly fraud"), and not only chose not to approve refunds but also chose not to implement the most basic measures to prevent it. [edit: as a commenter pointed out, the term “friendly fraud” predated Facebook] This is symptomatic of a corporate culture that is toxic to to the core. The money quotes are in the 2 paragraphs below: "In 2011, Tara Stewart, a risk analyst for Facebook, studied the issue and suggested that the company begin requiring users to enter the first six digits of a credit card used for payments on certain games. Stewart ran a survey of Facebook users and found that many parents were not aware that Facebook stored their payment information after entering it one time. They also found that the kids weren’t aware of what they were doing. “It doesn’t necessarily look like ‘real’ money to a minor,” Stewart wrote. She ran a test to see if the entering the cards first six-digits would reduce these unwanted charges and the results were encouraging. She also said it would “make sense to start refunding for blatant FF-minor.” The abbreviation “FF” stood for “Friendly Fraud,” the term Facebook used to refer to these fraudulent purchases which were made without malicious intent. Despite this obvious solution, Facebook decided that it would harm revenue and elected to continue fighting refund requests for the foreseeable future, the documents show."

deleted 8y ago
[deleted]
- deleted 8y ago
  [deleted]
endofcapital 8y ago
I'm not sure which class at business school is teaching everyone that "If you can get away with it do it! Have zero shame!" because it's probably time to remove that one from the Harvard curriculum.
- ben_jones 8y ago

SkeptinenSpede5 8y ago

Why we like to ourselves.. facebook lied period. Please stop fooling your self

vacocake 8y ago

Why we don't call it as it should be called ? Fraud as it is. Friendly fraud is also Facebook's fake acccounts

Balgair 8y ago

So, FB not only did this scummy act once, they did it many many times, never tried to remedy it, and never tried to alter the 'pathway' for this to occur, but they had this happen so often that they came up with a nick-name for it? Like, I knew they were evil, but I didn't think they were stupid too [0]. [0] https://en.wikipedia.org/wiki/Stringer_Bell#Season_three https://en.wikipedia.org/wiki/Stringer_Bell#Season_three

officemonkey 8y ago

If Facebook knowingly refused to refund improper transactions, THEY are the ones committing fraud. Plain, old, "screw you, Facebook user" fraud.

benologist 8y ago

Steam / Valve did this for quite a few years until they were taken to court in Australia for their unfair practices. A judge said their refund policy was criminal and intended to deny refunds and fined them a couple million dollars for an estimated 20,000 times. Steam drastically changed their refund policy and evaded fallout everywhere else, but it's probably going to be substantial for Facebook. https://www.pcmag.com/news/350574/valve-fined-3m-in-australia-over-steam-refunds https://www.pcmag.com/news/350574/valve-fined-3m-in-australi...

elefanten 8y ago
These two cases seem pretty different to me. Steam wasn't in compliance with Australian refund laws and got in trouble for it. But the Steam case had nothing to do with minors (mostly very young children) making inadvertent purchases.
- benologist 8y ago
  The similarity is the intent to refuse lawful refunds, and probably the scale. Steam never optimized to refuse more refunds though.
- tinus_hn 8y ago
  The same thing happened with Apple in the US: https://www.macworld.com/article/2087844/apple-ftc-settle-over-in-app-purchases-by-minors.html https://www.macworld.com/article/2087844/apple-ftc-settle-ov...

DanielDent 8y ago

"Friendly fraud" is not a Facebook-invented term. It's a term used and understood by card issuers, acquirers, and merchants. Friendly fraud encompasses: - Dissatisfied customers who don't find refuge in a refund policy/process - Customers who are embarrassed by their purchases. This situation is commonly triggered when a significant other reads a credit card statement. - Customers who spend beyond their means, and then look for a "solution" when the statement comes due I find it weird the way Facebook seems to be using the term here. These are charges that were never contemplated by the cardholder. There is no "buyer's remorse" dimension. Friendly fraud is specifically about charges that are agreed by the card holder, but they later change their mind and pretend otherwise.

jakelazaroff 8y ago
I don't think Facebook is accidentally misusing the term. They want to redirect sympathy from the cardholders to themselves by framing the situation as if it were just a case of "buyer's remorse", when really they've intentionally built the system to incur these mistaken charges.
- billfruit 8y ago
  Most probably Facebook didn't make the games themselves. And I thought one had to be at least 13 years to use Facebook, but probably some parents are allowed younger kids access.
  - SethTro 8y ago
    Average age of angry bird user was 5 the article says
    - thaumasiotes 8y ago
      Really? I thought the presence of the brand was bigger (back in the day) than that would allow for. An average age of 5 puts a pretty sharp limit on the number of 30-year-olds who can play. They're not going to be balanced out by one -20-year-old each.

tschellenbach 8y ago

Personally I think most of the reporting on Facebook is written to drive clicks and ad revenue. It's usually exaggerating the problems. This story is truly messed up though.

tuckermi 8y ago

The article references this URL: https://ecf.cand.uscourts.gov/cgi-bin/HistDocQry.pl?616030812309732-L_1_0-1 https://ecf.cand.uscourts.gov/cgi-bin/HistDocQry.pl?61603081... However, that is not accessible without an account and possibly payment for the document. Is this content part of the public domain. If so, can/has it been posted elsewhere? Edit: I should add that I do see some of the documents reproduced and referenced from elsewhere in the article (e.g. https://www.documentcloud.org/documents/5694620-Exhibit-OO-Redacted.html#document/p3/a477371 https://www.documentcloud.org/documents/5694620-Exhibit-OO-R...), however I didn't see any way to access the full collection.

dlgeek 8y ago
https://www.courtlistener.com/recap/ https://www.courtlistener.com/recap/ https://free.law/recap/ https://free.law/recap/

deleted 8y ago

[deleted]

rdiddly 8y ago

It's okay guys, the security of your credit card information is important to them! Also, it's a big responsibility, and they "need to do better." https://www.google.com/search?hl=en&q=zuckerberg+"we+need+to+do+better" https://www.google.com/search?hl=en&q=zuckerberg+"we+need+to...

ravenstine 8y ago

Facebook could be run by the Russian mob and people would continue to use it(and Instagram and WhatsApp).

Rufnxurjd 8y ago
Telegram is prolly run by the mob tbqh

microcolonel 8y ago

Just don't save payment card information in your Facebook account which you share with an irresponsible minor. If you primarily blame Facebook for this problem, you are failing as a parent. The fact that it is technically possible for Facebook to validate some purchases and prevent some instances of this problem does not make it Facebook's responsibility not to do something practically equivalent to handing your wallet to a toddler at a carnival.

NeedMoreTea 8y ago
Ah yes, blame the parents. A 9% chargeback rate on payments identified from minors is an awful lot of careless parents. The real fraud rate would be a lot higher as plenty might write it off to experience come credit card bill. Quite often these things are remarkably difficult to cancel too (no idea if that applies to Facebook). The fact is many of these ongoing payments, and the use of separate game currencies rather than simple $1.99 are deliberately unclear, even to fully clued up adults. That's rather the whole point of them.
- microcolonel 8y ago
  > The fact is many of these ongoing payments, and the use of separate game currencies rather than simple $1.99 are deliberately unclear, even to fully clued up adults. That's rather the whole point of them. Well, so are amusement park tickets. That doesn't mean you are absolved of responsibility for controlling your cash when you go to an amusement park.
  - empath75 8y ago
    If your toddler tried to use your credit card at an amusement park to buy $500 worth of cotton candy I imagine the person at the counter would not process it.
    - justtopost 8y ago
      That is a perfect illustration. Facebook is the cornerstore that will sell your kid 500 in toys and comic books, only to upsell them a pack of camels from my checkout display. It's cool, we already have your daddys credit card from last time, and he said we could use if for his future transactions. And because you are clearly a young child, lacking agency, I will bill him. Yet I will refuse to refund it when dad comes in later. Did I mention I am selling access to your data, also webcams!? Its goddamn terrifying we let it get this far.

dlandis 8y ago

If true, this seems to be one of the more clear cut recent examples of unethical policies devised by Facebook employees. I suspect certain other policies and programs can be mentally justified, but when it comes to very obvious things like this I would think it would have a bigger impact on whether top employees including engineers would be willing to continue working there. Everyone has their own personal line beyond which they’ll just decide to move one. I have already read about some people moving on lately but don’t know if it’s a trend yet.

golemotron 8y ago
" by Facebook employees" The buck stops where?
- darkpuma 8y ago
  A fish rots from the head. But is it just the head that's rotten? No, soon the whole fish is rotten; that's the point. So yes, Zuck is rotten. And consequently we should expect to find systemic rot through the organization at all but the very lowest levels (the groundskeepers and maintenance guys are probably clean)

TheLuddite 8y ago

If my child takes the money that I left on the desk, goes to the shop, buys candies and eats them...can I go to the bank and ask them to give back my crisp bills? Or maybe go to the candy store and whine there?

socialist_coder 8y ago
Let me give you an analogy that actually fits the truth: You went to the candy store with your child and paid via CC. The candy store saved your CC by default, and due to deceptive UX, made it difficult to figure out that you needed to opt-out of the saved CC. The next day, your child was walking past the candy store and the candy seller runs outside and says, "hey kid, you want this candy? its super good and you can have it for 5 dollars! just take it, its yours!" kid takes candy, you get charged $5. and in reality, even the "you can have it for 5 dollars" part is generous. facebook did not require the game developers to make it obvious when things cost real money or not.
detaro 8y ago
In many jurisdictions that's not a valid contract, so yes, the store has to reverse it.

minikites 8y ago

It's interesting watching Silicon Valley discover the purpose of government regulations from first principles.

justtopost 8y ago
Nothing old applies to us! Until we invent it here! Again. Its magical.

megous 8y ago

So they can just return money to all the wronged people now? Or did they already? How about people outside of US? I mean there would have to be some criteria for deciding who to return money to, but I'm sure they can come up with something less arbitrary than the original decision making that's hinted at in the article.

beezischillin 8y ago

I explicitly make spending money online harder for myself as a protection from things like this. (Well, primarily I also don't play any games with micro-transactions for one because they're universally a rip-off designed to exploit addictive personalities. Games based around these shady tactics should never have been tolerated, let alone allowed to become the standard to such a degree where even real AAA $60 video games are now infested with this. It's disgusting.) Very few things and services have my payment information saved -- usually just Apple and PayPal have it saved. I never save credit or debit card details to the keychain so the browser doesn't auto-complete it. I always go out of my way to set payment confirmation dialogues to always appear. Whenever I subscribe to something, I use PayPal or the App Store subscription feature. In case it's a yearly recurring subscription, I always go out of my way to cancel auto renewal. If nothing else, I delete the authorisation from PayPal for automatic renewal. I always go and double-check if some place saved my credit card details or not and if they have then I delete them. While not completely fool-proof, these steps have made it easier to more carefully manage my online spendings and not to suckered into parting with my money.

dylan604 8y ago
I have the same habits. Every month, I have to enter my payment info for phone,car,etc. They always have that little check box for "save payment info for later". Nope. To the point that my car payment is now done over the phone each month because they changed their website to force you to enter a payment (checking/routing). At the rate sites are getting hacked, I will not enter any more information that required to make it work. As with my auto company, if it requires more info than I want to provide, then I don't use it.
- Chris_Chambers 8y ago
  How does doing it over the phone help? Now the call center employee can write down your details and rob you later, as can anyone who reviews a recording of the call. Your risk increases every month you call and reveal your payment details to yet another stranger.

pbalau 8y ago

It's obviously fbs fault that you can't educate your kids or even control them. Fb did not put a phone in your kid's hands to shut him/her up, you did.

InclinedPlane 8y ago

> But the company had discovered that more than 9 percent of the money it made from children was being clawed back by the credit card companies. > In comparison, the average chargeback rate for businesses is 0.5 percent, according to the Merchant Risk Council, a nonprofit that helps businesses manage risk. > A chargeback rate of 1 percent is considered high, and credit card companies such as Visa and Mastercard will put businesses on probation programs for rates consistently that high. > The Federal Trade Commission said in an unrelated fraud case in 2016 that a 2 percent chargeback rate was a “red flag” of a “deceptive” business. Nine percent chargeback rate. That's just absolutely nuts.

CuriousSkeptic 8y ago
That explains why the security is so lax. The card companies are complicit in the scheme.

socialist_coder 8y ago

Well, if I had any small amount of trust in FB / Zuckerberg to do the right thing, I just lost it. These are some super shady and deceptive business practices.

SilverSlash 8y ago

Well, the solution is simple -- don't give your kids your credit cards...

tareqak 8y ago

1) If an individual app developer did something like what Facebook did here, then there is a better than good chance that they would be successfully prosecuted with a crime. Why is the criminal justice system so much more lenient on corporations? If it is just money, then we have to accept that arbitrariness can be bought and paid for by those who can afford it. There are a few voices here that advocate for less prison sentences with whom which I agree with, but white collar crime like the kind in the article isn't punished to the same level of severity when the organization at large is at fault. It seems that the incentives for certain kinds of problematic behavior change when your at scale. 2) If you allow this sort of behavior long enough, then it definitely seeps into the culture, the decision-making of management, and the interactions of all those who work there (full-time, part-time, contractors all included). If bad apples can spoil the bunch, then will certain people refuse to interact, do business with, or hire former Facebook employees? Is there / will there be a "blue shield" for Facebook as there is for law enforcement?

mmmmmmmmm 8y ago

Seems like there are three points of failure here: 1. Dumbfuck kids who don't realize they're spending money. 2. Scummy games that deliberately obfuscate the fact that you're spending real money. 3. Facebook not requiring any sort of verification to spend money via a game. Remove any one of these three and the problem doesn't exist. Facebook certainly seems to be at greatest fault here, but it's amazing how much the game developers have managed to escape scrutiny.

deleted 8y ago

[deleted]

npunt 8y ago

Note at the time (2011-2012) there was almost assuredly a lot of incentive at FB to look the other way regarding this kind of fraud, since they were preparing to go public (May 2012). When going public you want to get the best price on your IPO, so I imagine the order from higher up was to push revenue higher and look the other way on these types of issues. FB's stock dropped 40% in the months after going public, so that incentive to not do anything to impact revenue remained as FB dug themselves out of that hole. It may have even been amplified because internal employees were in lockout period watching the stock drop and wanting to cash out at a good price, and probably were (psychologically) price anchored on the IPO price.

eeeeeeeeeeeee 8y ago
Yep, I think this just shows how the push for ever increasing revenue creates a disgusting environment. Almost every single bad Facebook decision can be traced to them trying to cut corners for increased valuation.

deytempo 8y ago

And this guy (Zucker) was talking running for US president? Whhhoooah

dwighttk 8y ago

Who is giving Facebook their credit card? Why?

mikejb 8y ago
Parent gave the CC to Facebook in order to make one purchase. It isn't always transparent that this payment option is then stored indefinitely, and can be charged on user input without re-evaluating that the charge was initiated by the holder of the CC. This is not necessarily a bad thing, and can be viewed as a convenience-feature. But it has downsides, which Facebook not only seems to be aware of, but seems to welcome.

Proven 8y ago

That can happen only because the parents allowed it before FB did it.

pesenti 8y ago

A friendly fraud implies that the refund was actually made to the customer (https://en.wikipedia.org/wiki/Friendly_fraud https://en.wikipedia.org/wiki/Friendly_fraud). The article states: "“Friendly fraud” is the term Facebook used when children spent money on games without their parents’ permission." That's incorrect and completely reverses the meaning of the internal FB memo. “Friendly Fraud – what it is, why it’s challenging, and why you shouldn’t try to block it.” (Disclaimer: I work at Facebook but wasn't there at the time.)

golemiprague 8y ago

It's not only facebook, all platforms have difficult way of managing kids spending. You have to put "payment method" which is saved and invoked automatically, or you don't and then have to fill it up every time you want to buy something and then remove it. They should do an email and confirmation system, when a kid buy something it sends an email to the parent who can confirm it or not, that's all.

_cs2017_ 8y ago

Uhh what the actual fk, the article reversed the meaning of FB emails. FB encouraged devs to NOT fight the "friendly fraud". "Friendly fraud" is an industry term (just google it). It is when a customer who received goods then calls VISA and asks to refund their purchase. Anyway. FB told devs "let parents get their money back, don't fight it". But this article says FB told devs "keep committing fraud", which would be just about the opposite. Obviously, FB should have taken measures to prevent kids from using their parent cards without permission. But just because FB behaved badly, does not mean it's ok for revealnews.org to spread dirty lies.

EngineerBetter 8y ago

When are you all going to delete your Facebook accounts? I got 9 friends to install Signal yesterday to help them away from WhatsApp. I'd love to see widespread campaign to encourage people to ditch these parasites we're addicted to.

mosselman 8y ago

Sad to see that so many smart people in our industry lend themselves to work for Facebook. There are great tech innovations that come out of Facebook, but that doesn't weigh up to the damage they are doing to society. Sam Harris has released two great podcasts that discuss how Facebook, and other companies like them, choose to earn money from, amongst other things, radicalising and polarising people in our societies: https://samharris.org/podcasts/146-digital-capitalism/ https://samharris.org/podcasts/146-digital-capitalism/ https://samharris.org/podcasts/145-information-war/ https://samharris.org/podcasts/145-information-war/ and to some extent: https://samharris.org/podcasts/144-conquering-hate/ https://samharris.org/podcasts/144-conquering-hate/ I recommend these highly.

Dowwie 8y ago

The modern in-game transactions remind me of simpler exploits from years ago: 900 number phone games. Back in the 80s, children were bombarded with advertisement of phone based games using a 900 number prefix. 900 numbers are unique in that they charge a fee for use. A child who wanted to play the RoboCop phone game would simply pick up a phone and dial the number. Shortly after, they would get to press numbers on the keypad to choose their own adventures. The games were addictive and expensive. [1] Eventually, enough parents were ripped off and they fought the system, convincing legislators and regulators to stop the exploitation. This put a complete stop to 900 number games. [1] https://guff.com/15-bizarre-1-900-numbers-from-the-80s-and-90s https://guff.com/15-bizarre-1-900-numbers-from-the-80s-and-9...

JimBrimble35 8y ago

Probably an unpopular statement, but man does this happen a lot with fortnite. They even have a section in their help pages specifically for unauthorized purchases by family members. Also, they don't seem to care at all about who's payment method is associated with an account. You even get kids taking pictures of their parent's credit cards and passing them around.

andygcook 8y ago

This type of predatory behavior has been happening for a long time. When I was about 9 years old, my brother and I bought Link's Awakening on Gameboy. On the back of the booklet that comes with the game was a line that read, "Need Help? Call this number" with an 900 phone number listed. We had access to the home phone and wanted to beat the game. So of course, we called the number a few times to get hints on how to beat hards parts of the game. This was before the internet where you could just lookup a walkthrough online. You can imagine my mother's shock when she received a $200+ charge on her phone bill for a phone number she had never heard of. Apparently the cost of the call was about $5/minute. We got yelled at and we weren't allowed to call the number anymore after that. I'm proud to say we still beat the game though.

aacook 8y ago
I still feel guilty about it every time we recount this story. I remember exactly where I was (on the top bunk) when mom shared the bill with me. I think she had me dial into the number to show her how it worked. To their credit, Nintendo did disclose there was a cost to the service but as I'm sure kids ignore notifications these days, I blindly pressed 7 or whatever because I wanted to get through the next level so badly. It didn't seem like real money. I can't remember if mom made me do excess chores to pay off the debt but I'm guessing she did. I should pay her back the $200 with interest.