3 ms·

> having meticulous documentation for 25+ gift cards doesn't make you look more like a normal person. If gift cards are suspicious and cannot be reliably secur

> having meticulous documentation for 25+ gift cards doesn't make you look more like a normal person. If gift cards are suspicious and cannot be reliably secured, then why are they even sold?

tptacek 4y ago
My guess is that gift card usage is bimodal: 1. The large set of gift card transactions that involve just one or two gift cards being used in a long period of time by a single person, which don't set off fraud flags. 2. The other large set of bulk gift card uses, which are overwhelmingly fraudulent. So the answer would then be: they're sold for case (1), and policed for case (2). Don't do case (2).
- alymaly 4y ago
  It seems to me that it is completely random in nature. The main reason I heard from tech support was that the cards were of different denominations. That is, I took only cards of 100 dollars would be all right. I just talked to a colleague, about which I wrote, she used the same denomination cards to buy a phone (she did not do it on purpose, but it just happened that all the cards were $ 100)
pwinnski 4y ago
A gift card is not suspicious. A few gift cards, all originally purchased around the same time, are also not suspicious. People do receive multiple cards for special occasions, after all. 25-40 gift cards, purchased in several different countries over an extended period of time, that is what's suspicious. In the first two cases, the most likely explanation is that the cards are gifts. I mean, it could be that I bought them myself, which would also be fine, but most likely I've just had a birthday or someone said thank you in a monetary way. In the third case, the most likely explanation is that I'm a scammer, and have exploited ignorant people, convincing them to buy me gift cards, and I'm finally cashing them all in. It isn't gift cards that are intrinsically suspicious. It's the pattern of behavior. If OP is indeed as innocent as they claims to be--and I see no reason to believe otherwise--then they are very much an edge case, with a very unusual pattern of behavior. That is the issue, not the cards themselves.
- logicalmonster 4y ago
  So if 25 gift cards is suspicious, then are 24 gift cards not suspicious? And if 25 gift cards is the limit, then why can't this information be published so people understand what the rules are? A system can't work if people don't know what the rules are.
  - pwinnski 4y ago
    Like any and all anti-fraud measures, clarity is the enemy. In any system, as soon as the rules are published, scammers will do everything they can to commit malfeasance while technically not breaking any rules. You say the system can't work if people don't know what the rules are, but in fact, any system where all of the rules are known exactly is doomed to fail because bad actors exploit the rules. It would be easy to demonstrate how publishing a rule that says "23 gift cards within 36 hours triggers our systems" would obviously and necessarily lead to scammers redeeming 22 gift cards every 36 hours, right? So in fact, there's some kind trigger, and it might change based on time of day, it might change per origin country, it might change based on account age, who knows? Anti-scam and anti-spam measures succeed primarily by being flexible and vague. In this case, and in many cases, humans who looked at the full pattern of behavior (a full pattern we have only the OP's description of part of) also decided that this was likely fraudulent. That human factor is always going to be important, because some people just do unpredictably weird things sometimes. This is not about Apple and gift cards, this is ANY system that doesn't plan to turn into a scam-filled wasteland. A system can't work if everybody knows exactly how to avoid triggering automatic fraud detection.
    - logicalmonster 4y ago
      Just for the sake of argument, let's say that it's necessary to have some set of unpublished algorithmic rules that are very rarely tripped by honest, normal usage in order to curb fraud. What happens to the handful of individuals who are not committing fraud, but were just doing uncommon things and accidentally tripped some unpublished anti-fraud measure? You agree that this isn't ok to just let them hang, right? What's the strategy for helping those people? Certainly, you're not suggesting that it's just ok to essentially say "Fuck you" to the random person who was algorithmically unlucky and essentially have a mega-corporation take a few thousand dollars of their paid for software? I would say that if you're an entity that employs these kinds of vague, unpublished rules, that there must be a fast, real, and human recourse for talking to somebody to get the problem seriously addressed or you're behaving no better than a criminal entity.

> having meticulous documentation for 25+ gift cards doesn't make you look more like a normal person. If gift cards are suspicious and cannot be reliably secured, then why are they even sold?

tptacek 4y ago

My guess is that gift card usage is bimodal: 1. The large set of gift card transactions that involve just one or two gift cards being used in a long period of time by a single person, which don't set off fraud flags. 2. The other large set of bulk gift card uses, which are overwhelmingly fraudulent. So the answer would then be: they're sold for case (1), and policed for case (2). Don't do case (2).

alymaly 4y ago
It seems to me that it is completely random in nature. The main reason I heard from tech support was that the cards were of different denominations. That is, I took only cards of 100 dollars would be all right. I just talked to a colleague, about which I wrote, she used the same denomination cards to buy a phone (she did not do it on purpose, but it just happened that all the cards were $ 100)

pwinnski 4y ago

A gift card is not suspicious. A few gift cards, all originally purchased around the same time, are also not suspicious. People do receive multiple cards for special occasions, after all. 25-40 gift cards, purchased in several different countries over an extended period of time, that is what's suspicious. In the first two cases, the most likely explanation is that the cards are gifts. I mean, it could be that I bought them myself, which would also be fine, but most likely I've just had a birthday or someone said thank you in a monetary way. In the third case, the most likely explanation is that I'm a scammer, and have exploited ignorant people, convincing them to buy me gift cards, and I'm finally cashing them all in. It isn't gift cards that are intrinsically suspicious. It's the pattern of behavior. If OP is indeed as innocent as they claims to be--and I see no reason to believe otherwise--then they are very much an edge case, with a very unusual pattern of behavior. That is the issue, not the cards themselves.

logicalmonster 4y ago
So if 25 gift cards is suspicious, then are 24 gift cards not suspicious? And if 25 gift cards is the limit, then why can't this information be published so people understand what the rules are? A system can't work if people don't know what the rules are.
- pwinnski 4y ago
  Like any and all anti-fraud measures, clarity is the enemy. In any system, as soon as the rules are published, scammers will do everything they can to commit malfeasance while technically not breaking any rules. You say the system can't work if people don't know what the rules are, but in fact, any system where all of the rules are known exactly is doomed to fail because bad actors exploit the rules. It would be easy to demonstrate how publishing a rule that says "23 gift cards within 36 hours triggers our systems" would obviously and necessarily lead to scammers redeeming 22 gift cards every 36 hours, right? So in fact, there's some kind trigger, and it might change based on time of day, it might change per origin country, it might change based on account age, who knows? Anti-scam and anti-spam measures succeed primarily by being flexible and vague. In this case, and in many cases, humans who looked at the full pattern of behavior (a full pattern we have only the OP's description of part of) also decided that this was likely fraudulent. That human factor is always going to be important, because some people just do unpredictably weird things sometimes. This is not about Apple and gift cards, this is ANY system that doesn't plan to turn into a scam-filled wasteland. A system can't work if everybody knows exactly how to avoid triggering automatic fraud detection.
  - logicalmonster 4y ago
    Just for the sake of argument, let's say that it's necessary to have some set of unpublished algorithmic rules that are very rarely tripped by honest, normal usage in order to curb fraud. What happens to the handful of individuals who are not committing fraud, but were just doing uncommon things and accidentally tripped some unpublished anti-fraud measure? You agree that this isn't ok to just let them hang, right? What's the strategy for helping those people? Certainly, you're not suggesting that it's just ok to essentially say "Fuck you" to the random person who was algorithmically unlucky and essentially have a mega-corporation take a few thousand dollars of their paid for software? I would say that if you're an entity that employs these kinds of vague, unpublished rules, that there must be a fast, real, and human recourse for talking to somebody to get the problem seriously addressed or you're behaving no better than a criminal entity.