4 ms·

>When DoNotPay’s system got that ping, an algorithm the team spent six months building looked at the code request to see if the purchase was for a free trial. D

by ikeboy 7y ago

>When DoNotPay’s system got that ping, an algorithm the team spent six months building looked at the code request to see if the purchase was for a free trial. Determining that it was, the system approved my transaction. When I tried to use it to buy a $48 pair of Thinx period-proof underwear on that company’s website, it was declined. You can't use this card to make real purchases. if (chargeamount>0){ decline()}

Nightshaxx 7y ago
Half lf the time I see "AI" or "complex algorithm we spent 2 decades on", it's literally just that.
- judge2020 7y ago
  Still technically "artificial" and a form of "intelligence"!
rahimnathwani 7y ago
I've seen a charge amount of 0.01 for a free trial. I'm pretty sure it was just a pre-auth, i.e. they didn't follow up and actually complete the charge.
- iancarroll 7y ago
  This is presumably an actually hard problem despite the comments. A pre-auth allows the acquiring merchant to capture that authorization and charge you. Sometimes these can be for $1 or more, depending on how aggressive the service is. Pre-authorizations are subtracted from your available credit/balance. If the card approves the pre-auth, they are (presumably, AFAIK) on the hook for that $1 if the merchant captures the pre-auth. If many (unpaying?) users start charging you $1...
  - rahimnathwani 7y ago
    A reasonable heuristic might be: - if less than 0.05, approve (as no merchant would actually charge a transaction for that amount, as they'd spend more than 5 cents on fees) - if more than 5 cents but less than 1 USD, approve it only if the merchant is already known to offer free trials You could be fancier: - match on amount+merchantID combo, not just merchantID - learn a model to deal with previously-unseen merchants
  - londons_explore 7y ago
    I'd guess they allow small pre-auths (up to $3 say), and then keep a blacklist of merchants who actually capture the charge. Merchants on the blacklist have all charges denied. Any 'free trial' who actually captures a dollar from their clients will cause lots of chargebacks from their customers, so would go out of business quickly... (A chargeback costs a business ~$15 in fees)
- r00fus 7y ago
  Was it against a bank (ie, debit) account? If so, it's a pre-note test, fairly standard in the industry to ensure a direct-debit or direct-credit can be assumed safe. This unit tests both the debit (of e.g. $.01) and a credit of the same amount against the target. They can also vary the amount, then ask the recipient to report the amount posted (so you can prevent additional fraud that way - attacker may have your bank account/routing details but no login to your statement/transaction listing).
  - rahimnathwani 7y ago
    No, it was against a UK-issued MasterCard. It was definitely processed through the MC network, and not via Direct Debit (the closest UK equivalent to pulling funds via ACH). I know this because the vendor didnt have my bank account number, because Direct Debits are processed in batch (not instantly), and because the app associated with the account showed it as a card transaction.

by ikeboy 7y ago

Nightshaxx 7y ago

Half lf the time I see "AI" or "complex algorithm we spent 2 decades on", it's literally just that.

judge2020 7y ago
Still technically "artificial" and a form of "intelligence"!

rahimnathwani 7y ago

I've seen a charge amount of 0.01 for a free trial. I'm pretty sure it was just a pre-auth, i.e. they didn't follow up and actually complete the charge.

iancarroll 7y ago
This is presumably an actually hard problem despite the comments. A pre-auth allows the acquiring merchant to capture that authorization and charge you. Sometimes these can be for $1 or more, depending on how aggressive the service is. Pre-authorizations are subtracted from your available credit/balance. If the card approves the pre-auth, they are (presumably, AFAIK) on the hook for that $1 if the merchant captures the pre-auth. If many (unpaying?) users start charging you $1...
- rahimnathwani 7y ago
  A reasonable heuristic might be: - if less than 0.05, approve (as no merchant would actually charge a transaction for that amount, as they'd spend more than 5 cents on fees) - if more than 5 cents but less than 1 USD, approve it only if the merchant is already known to offer free trials You could be fancier: - match on amount+merchantID combo, not just merchantID - learn a model to deal with previously-unseen merchants
- londons_explore 7y ago
  I'd guess they allow small pre-auths (up to $3 say), and then keep a blacklist of merchants who actually capture the charge. Merchants on the blacklist have all charges denied. Any 'free trial' who actually captures a dollar from their clients will cause lots of chargebacks from their customers, so would go out of business quickly... (A chargeback costs a business ~$15 in fees)
r00fus 7y ago
Was it against a bank (ie, debit) account? If so, it's a pre-note test, fairly standard in the industry to ensure a direct-debit or direct-credit can be assumed safe. This unit tests both the debit (of e.g. $.01) and a credit of the same amount against the target. They can also vary the amount, then ask the recipient to report the amount posted (so you can prevent additional fraud that way - attacker may have your bank account/routing details but no login to your statement/transaction listing).
- rahimnathwani 7y ago
  No, it was against a UK-issued MasterCard. It was definitely processed through the MC network, and not via Direct Debit (the closest UK equivalent to pulling funds via ACH). I know this because the vendor didnt have my bank account number, because Direct Debits are processed in batch (not instantly), and because the app associated with the account showed it as a card transaction.