3 ms·
Someone who has been in this field for far too long here: I like the initiative and I think this is a step for deterring credit card fraud. However, if someone
by joshmn 6y ago
Someone who has been in this field for far too long here:
I like the initiative and I think this is a step for deterring credit card fraud. However, if someone wants your product bad enough, it's trivial — at an incremental cost — to buy a credit card with login.
Yes, while these issuers have security to prevent logging in/logging in from an unknown device/ip/user agent/hwid, we can all attest that for every secured account, there are plenty that aren't. Even with alerts, OPT, device recognition and notifications, that doesn't deter someone from going to a shop, searching by BIN, by brand, by zip, by email, by password, etc. to narrow down what they want to buy.
If you're the only provider with XyzGood, and someone wants XyzGood bad enough, this won't stop them.
- Alupis 6y agoEcommerce fraud is overwhelmingly "Carding", where someone is testing stolen cards to see if they are valid, and have large available balances. The other most common type of fraud is buying goods with stolen cards, intending to resale the goods on Craigslist or similar. For both of those cases, this idea would be an immense help. You perform your own "High Risk" criteria checking on all orders, and those flagged as being potentially High Risk, would then receive this extra verification step. It's pretty rare for someone to steal or buy stolen cards to order products they actually want to keep.
- cglace 6y agoWe see UpUp as a piece of our overall fraud strategy. We lend $35,000 vehicles to renters without meeting them in person. Often we are up against very determined bad actors. What we have found is that if you make a fraudsters job a little bit harder they will move onto the easier target.
- Alupis 6y agoOverwhelmingly true. Even something as simple as sending an email or a phone call to "verify the shipping address" is enough to smoke out actual fraud vs. a real customer. But... that takes time and resources from customer service, and isn't as fool-proof as having access to the actual bank/card account.
- splonk 6y agoThe saying we had when I worked on this was that we weren't trying to stop fraud, we were just trying to be a slightly harder target than eBay.
- driverdan 6y agoIf someone wants to break into car bad enough glass windows won't stop them. If someone wants to break into a bank bad enough a safe won't stop them. If someone wants to break into a house bad enough locks won't stop them. etc This is an unreasonable argument for trying to secure something. Every step that makes something harder to steal is an improvement in security and increases the cost of theft.