6 ms·

Bots aren't just trying credential stuffing. They are: - committing clickfraud to game ad and referral revenue systems - posting fake or spam reviews and comm

Bots aren't just trying credential stuffing. They are: - committing clickfraud to game ad and referral revenue systems - posting fake or spam reviews and comments - generating fake behavioral signals to help bypass CAPTCHAs to help create accounts on other sites that can post spam comments - validating stolen credit card details - screwing with your metrics collection if you can't identify them as bots All of that is enough reason for sites to use bot detection and blocking technology. The fact that the same tech also has some utility against accidental or malicious traffic-based DoS is also a bonus.

fragmede 5y ago
> -validating stolen credit card details To be clear, "validating" is an industry euphemism for stealing, just for a different purpose. How do you validate the card is live? Run a real transaction through it and mark it based on the result. But what do you run for this real transaction? Well, whatever you want. Typically it'll be something to avoid suspicion as much as possible, but the thief gets to pick what they test it with, so why not pick something that they'll personally benefit from? There are so many online games with purchasable currency these days, it's hard to choose.
- defer 5y ago
  Not exactly. Some people are in the business of gathering and selling valid credit cards. They won't cash out on them or buy items. Instead, they'll collect cards from a source (skimming, hacking, whatever), validate them by adding them to a website that does an authorization (those $1 checks that never get committed). They can then sell them wholesale for a premium compared to non-verified cards.
  - vidarh 5y ago
    You'd think so, but I've personally had to find ways of blocking people who were buying premium services for an online service to validate cards.
    - dxdm 5y ago
      Doing tiny transactions to validate cards is a thing. I've seen this happen, it's a known problem, and that at other times it's larger transactions does not make it go away.
    - defer 5y ago
      Oh, for sure. It's definitely not either/or. I've worked in fraud prevention software in the past and our clients would definitely see both. I've been away from that world for a while but remember that more serious operations will separate the cashing out part (either money or goods) from their acquiring / validating operation because the former carries more risk. There's also an interesting episode of the darknet diaries podcast (https://darknetdiaries.com/episode/85/ https://darknetdiaries.com/episode/85/) about card cloning which I found interesting.
- Maxion 5y ago
  If you're trying to fight financial crime it's important to not simplify behavior seen in the wild. Like the other commented noted, there is a very clear difference in behaviour between those validating cards and those using cards in order to steal.
- Mordisquitos 5y ago
  > How do you validate the card is live? Run a real transaction through it and mark it based on the result. Not necessarily. Some online services, particularly shops that do home delivery, may give their customers the possibility of adding a card to their wallet and perform a verification as part of the process. As a result, it becomes possible to validate a stolen card number without performing an actual transaction.
- ensiferum 5y ago
  My bank called as they had red flagged a suspicious charge on on my credit card. The sum was $0. The bank rep told me that this often flies under the radar and doesn't show up in some records and it indeed did not show up in my transaction history that i could see online in my banking details. But yeah the point was exactly the same. The fraudsters testing whether the charge goes through and the card is alive/valid.
  - todd8 5y ago
    Did you verify that it really was the bank calling and not a scammer? I get calls and texts from “credit card fraud departments”, “banks”, “service warranty departments”, “Amazon billing”, “Microsoft security”, “Social Security Administration”, “IRS”, and others frequently; 95% are scammers. The most amusing to me are the ones from “Microsoft” to alert me that they have detected malware on my computer.
    - ensiferum 5y ago
      Yes actually I think my bank sent me a message and asked me to call them. But either case it was all legitimate and my card was renewed.
rndgermandude 5y ago
All very valid reasons (except to a degree the "screwing with metrics" one). There a lot of websites which do not really face any of the aforementioned issues, simply because they do not sell you anything, are not an ad network or run referral programs, do not even have user-generated content, etc. And even the sites that do, it's usually a rather small part of the "surface" that needs such protections e.g. the actual API call to make a checkout or post a comment. And yet if you dare browse the web with TOR or a VPN or sometimes just happen to be on a small ISP[0][1] then you're being punished immediately. You solve your cloudflare-supplied captcha because you may be a bot (you're not, and the dangerous bots will not be defeated by this anyway, but some humans will be), and then you get an error from the website itself because it runs a secondary bot detection thing. And you weren't even anywhere near anything "dangerous" like a checkout page. [0] My parents use a regional small ISP (but locally very popular) that serves around 50K customers. My parents also use a regional bank (a Volksbank, and those are members of a national association that provides all kinds of services). Suddenly that bank would not even let them see the bank's front page. After some back and forth on the phone support line it turned out the bank had recently deployed some "advanced" bot detection, one that had a whitelist of residential-ISP-associated AS/IP ranges, and of course whoever compiled and maintained that list had forgot to include that small local ISP. For that regional bank it meant they had just shut out a very significant number of their customers (and potential customers just trying to look up what the bank offers), as there was very likely a huge overlap of people using that regional ISP and that regional bank (both are regional, after all). It also was something they couldn't fix themselves, as the "online banking" stuff was not in-house but was run by the national association (which probably used some bot-detection as a service provider). It took the bank (or rather, the national association) a few weeks to fix. Mind you, the last few years that bank has been heavily marketing a cheaper "online only" account, only online banking, online support, and access to the self-serve ATMs and banking terminals, but no face-to-face or even ear-to-ear human interaction. Try contacting "online support" about "the website outright refuses me" when the "online support" is only available on that website. Kudos is you're smart enough to switch to their mobile app, as your phone uses a different ISP, unless you forget to turn off wifi. That's the advice my parents got from the phone support (they sill have an account type that not online-only). [1] When I recently visited my parents, from the wifi [same ISP as in 0] I couldn't open the website of a bakery too look up if and when they would be open on a Sunday. Some error message about "this website is not available in your network" (English text, for a German bakery... suspicious :P). I could open it via my mobile, tho. I could open it from my regular ISP when back home (in another city) again. Mind you, that website is purely informational and has no "interactive" features let alone let's you buy anything. It's just static text and some pictures.

fragmede 5y ago

> -validating stolen credit card details To be clear, "validating" is an industry euphemism for stealing, just for a different purpose. How do you validate the card is live? Run a real transaction through it and mark it based on the result. But what do you run for this real transaction? Well, whatever you want. Typically it'll be something to avoid suspicion as much as possible, but the thief gets to pick what they test it with, so why not pick something that they'll personally benefit from? There are so many online games with purchasable currency these days, it's hard to choose.

defer 5y ago
Not exactly. Some people are in the business of gathering and selling valid credit cards. They won't cash out on them or buy items. Instead, they'll collect cards from a source (skimming, hacking, whatever), validate them by adding them to a website that does an authorization (those $1 checks that never get committed). They can then sell them wholesale for a premium compared to non-verified cards.
- vidarh 5y ago
  You'd think so, but I've personally had to find ways of blocking people who were buying premium services for an online service to validate cards.
  - dxdm 5y ago
    Doing tiny transactions to validate cards is a thing. I've seen this happen, it's a known problem, and that at other times it's larger transactions does not make it go away.
  - defer 5y ago
    Oh, for sure. It's definitely not either/or. I've worked in fraud prevention software in the past and our clients would definitely see both. I've been away from that world for a while but remember that more serious operations will separate the cashing out part (either money or goods) from their acquiring / validating operation because the former carries more risk. There's also an interesting episode of the darknet diaries podcast (https://darknetdiaries.com/episode/85/ https://darknetdiaries.com/episode/85/) about card cloning which I found interesting.
Maxion 5y ago
If you're trying to fight financial crime it's important to not simplify behavior seen in the wild. Like the other commented noted, there is a very clear difference in behaviour between those validating cards and those using cards in order to steal.
Mordisquitos 5y ago
> How do you validate the card is live? Run a real transaction through it and mark it based on the result. Not necessarily. Some online services, particularly shops that do home delivery, may give their customers the possibility of adding a card to their wallet and perform a verification as part of the process. As a result, it becomes possible to validate a stolen card number without performing an actual transaction.
ensiferum 5y ago
My bank called as they had red flagged a suspicious charge on on my credit card. The sum was $0. The bank rep told me that this often flies under the radar and doesn't show up in some records and it indeed did not show up in my transaction history that i could see online in my banking details. But yeah the point was exactly the same. The fraudsters testing whether the charge goes through and the card is alive/valid.
- todd8 5y ago
  Did you verify that it really was the bank calling and not a scammer? I get calls and texts from “credit card fraud departments”, “banks”, “service warranty departments”, “Amazon billing”, “Microsoft security”, “Social Security Administration”, “IRS”, and others frequently; 95% are scammers. The most amusing to me are the ones from “Microsoft” to alert me that they have detected malware on my computer.
  - ensiferum 5y ago
    Yes actually I think my bank sent me a message and asked me to call them. But either case it was all legitimate and my card was renewed.

rndgermandude 5y ago

All very valid reasons (except to a degree the "screwing with metrics" one). There a lot of websites which do not really face any of the aforementioned issues, simply because they do not sell you anything, are not an ad network or run referral programs, do not even have user-generated content, etc. And even the sites that do, it's usually a rather small part of the "surface" that needs such protections e.g. the actual API call to make a checkout or post a comment. And yet if you dare browse the web with TOR or a VPN or sometimes just happen to be on a small ISP[0][1] then you're being punished immediately. You solve your cloudflare-supplied captcha because you may be a bot (you're not, and the dangerous bots will not be defeated by this anyway, but some humans will be), and then you get an error from the website itself because it runs a secondary bot detection thing. And you weren't even anywhere near anything "dangerous" like a checkout page. [0] My parents use a regional small ISP (but locally very popular) that serves around 50K customers. My parents also use a regional bank (a Volksbank, and those are members of a national association that provides all kinds of services). Suddenly that bank would not even let them see the bank's front page. After some back and forth on the phone support line it turned out the bank had recently deployed some "advanced" bot detection, one that had a whitelist of residential-ISP-associated AS/IP ranges, and of course whoever compiled and maintained that list had forgot to include that small local ISP. For that regional bank it meant they had just shut out a very significant number of their customers (and potential customers just trying to look up what the bank offers), as there was very likely a huge overlap of people using that regional ISP and that regional bank (both are regional, after all). It also was something they couldn't fix themselves, as the "online banking" stuff was not in-house but was run by the national association (which probably used some bot-detection as a service provider). It took the bank (or rather, the national association) a few weeks to fix. Mind you, the last few years that bank has been heavily marketing a cheaper "online only" account, only online banking, online support, and access to the self-serve ATMs and banking terminals, but no face-to-face or even ear-to-ear human interaction. Try contacting "online support" about "the website outright refuses me" when the "online support" is only available on that website. Kudos is you're smart enough to switch to their mobile app, as your phone uses a different ISP, unless you forget to turn off wifi. That's the advice my parents got from the phone support (they sill have an account type that not online-only). [1] When I recently visited my parents, from the wifi [same ISP as in 0] I couldn't open the website of a bakery too look up if and when they would be open on a Sunday. Some error message about "this website is not available in your network" (English text, for a German bakery... suspicious :P). I could open it via my mobile, tho. I could open it from my regular ISP when back home (in another city) again. Mind you, that website is purely informational and has no "interactive" features let alone let's you buy anything. It's just static text and some pictures.