3 ms·

Broadly, and with caveats, Amazon could somewhat trivially prevent much of this by requiring authorization from the customer who originally uses a shipping addr

Broadly, and with caveats, Amazon could somewhat trivially prevent much of this by requiring authorization from the customer who originally uses a shipping address, before allowing someone else to use it.

rp1 5y ago
What happens if you move? Can the new occupant of your previous residence no longer use Amazon?
- unclebucknasty 5y ago
  >What happens if you move? Heh. I knew that'd be the first question. Yeah, that's one of the caveats. The auth email or SMS to the previous owner would allow them to indicate they moved. That would probably handle most cases quickly. But, if no response in x time, it could default to allow and/or if the new owner wants to be proactive, they can send proof of residence. A little bit of a PITA, but doesn't add much to the PITA moving already is. And, moving is pretty infrequent. There's also billing address validation, as that frequently matches shipping address anyway. This kind of validation would also help with other scams.
- zhte415 5y ago
  When ordering online, I, not from Amazon as I don't use it, quite regularly get a 60 second timeout requesting a payment be confirmed in my bank's app. VisionPlus or one of the many other systems that may be employed in the chain of payment are configurable for many many such triggers or rules, change of address IIRC is a pretty basic one.
lotsofpulp 5y ago
It seems even more trivial for the payment card network to require 2FA so that a card number alone is insufficient to authorize a transaction. I know BestBuy.com is able to do SMS 2FA with my Bank of America Visa credit cards.
- unclebucknasty 5y ago
  Well, sure, if you can render stolen cards useless, then a host of problems go away. Maybe that will happen at scale if more card issuers decide the inconvenience/friction to legitimate card users makes it worthwhile per the level of fraud they're seeing. But, the solution to the address problem here assumes the current state of things. And, there are other issues involving addresses that strictly validating the credit card wouldn't solve (like unsolicited package and brushing scams), as well as things I'm sure we've yet to consider. In general, it would probably be a good thing for people to have better control of who can send what to their address.
- hrududu 5y ago
  2FA (in particular, the 3DS protocol) actually has a significant conversion problem, so it's not free.

rp1 5y ago

What happens if you move? Can the new occupant of your previous residence no longer use Amazon?

unclebucknasty 5y ago
>What happens if you move? Heh. I knew that'd be the first question. Yeah, that's one of the caveats. The auth email or SMS to the previous owner would allow them to indicate they moved. That would probably handle most cases quickly. But, if no response in x time, it could default to allow and/or if the new owner wants to be proactive, they can send proof of residence. A little bit of a PITA, but doesn't add much to the PITA moving already is. And, moving is pretty infrequent. There's also billing address validation, as that frequently matches shipping address anyway. This kind of validation would also help with other scams.
zhte415 5y ago
When ordering online, I, not from Amazon as I don't use it, quite regularly get a 60 second timeout requesting a payment be confirmed in my bank's app. VisionPlus or one of the many other systems that may be employed in the chain of payment are configurable for many many such triggers or rules, change of address IIRC is a pretty basic one.

lotsofpulp 5y ago

It seems even more trivial for the payment card network to require 2FA so that a card number alone is insufficient to authorize a transaction. I know BestBuy.com is able to do SMS 2FA with my Bank of America Visa credit cards.

unclebucknasty 5y ago
Well, sure, if you can render stolen cards useless, then a host of problems go away. Maybe that will happen at scale if more card issuers decide the inconvenience/friction to legitimate card users makes it worthwhile per the level of fraud they're seeing. But, the solution to the address problem here assumes the current state of things. And, there are other issues involving addresses that strictly validating the credit card wouldn't solve (like unsolicited package and brushing scams), as well as things I'm sure we've yet to consider. In general, it would probably be a good thing for people to have better control of who can send what to their address.
hrududu 5y ago
2FA (in particular, the 3DS protocol) actually has a significant conversion problem, so it's not free.