4 ms·

So if 25 gift cards is suspicious, then are 24 gift cards not suspicious? And if 25 gift cards is the limit, then why can't this information be published so pe

So if 25 gift cards is suspicious, then are 24 gift cards not suspicious? And if 25 gift cards is the limit, then why can't this information be published so people understand what the rules are? A system can't work if people don't know what the rules are.

pwinnski 4y ago
Like any and all anti-fraud measures, clarity is the enemy. In any system, as soon as the rules are published, scammers will do everything they can to commit malfeasance while technically not breaking any rules. You say the system can't work if people don't know what the rules are, but in fact, any system where all of the rules are known exactly is doomed to fail because bad actors exploit the rules. It would be easy to demonstrate how publishing a rule that says "23 gift cards within 36 hours triggers our systems" would obviously and necessarily lead to scammers redeeming 22 gift cards every 36 hours, right? So in fact, there's some kind trigger, and it might change based on time of day, it might change per origin country, it might change based on account age, who knows? Anti-scam and anti-spam measures succeed primarily by being flexible and vague. In this case, and in many cases, humans who looked at the full pattern of behavior (a full pattern we have only the OP's description of part of) also decided that this was likely fraudulent. That human factor is always going to be important, because some people just do unpredictably weird things sometimes. This is not about Apple and gift cards, this is ANY system that doesn't plan to turn into a scam-filled wasteland. A system can't work if everybody knows exactly how to avoid triggering automatic fraud detection.
- logicalmonster 4y ago
  Just for the sake of argument, let's say that it's necessary to have some set of unpublished algorithmic rules that are very rarely tripped by honest, normal usage in order to curb fraud. What happens to the handful of individuals who are not committing fraud, but were just doing uncommon things and accidentally tripped some unpublished anti-fraud measure? You agree that this isn't ok to just let them hang, right? What's the strategy for helping those people? Certainly, you're not suggesting that it's just ok to essentially say "Fuck you" to the random person who was algorithmically unlucky and essentially have a mega-corporation take a few thousand dollars of their paid for software? I would say that if you're an entity that employs these kinds of vague, unpublished rules, that there must be a fast, real, and human recourse for talking to somebody to get the problem seriously addressed or you're behaving no better than a criminal entity.
  - pwinnski 4y ago
    The above was hardly my first comment on this thread, so no, I'm not saying that. However, OP has talked to humans, and apparently those humans--with access to more info than we have here--believe OP to be a scammer. (Or don't care enough to act.) Since I don't have access to that information, I feel bad for OP, and hope there's a higher level of humans he can talk to, but insinuating that Apple is a criminal entity seems a bit much.
    - logicalmonster 4y ago
      > However, OP has talked to humans, and apparently those humans--with access to more info than we have here--believe OP to be a scammer. (Or don't care enough to act.) Not every human has equal knowledge, training, and authority to resolve problems. Since I have no clue of the inner-workings of Apple's support centers, I can only give reasonable speculation. How do call centers in big corporations generally work? The employees (or contractors) are low-ranking members and without much leeway or authority to do anything other than what they're trained to do. They're usually professional enough and probably want to help people, but they're typically only trained and authorized to assist with common tasks they basically have a "script" for: maybe telling you when your order is going to ship or helping you reserve an appointment for a repair, common things like that. If your customer service request fits within the box of common tasks that they're trained and authorized to help with, you're likely good. But if your request is uncommon and they haven't been trained to help you with that, then even this human contact is useless. Maybe they're specifically trained that when they see the word "fraud" on an account profile, that they can't do anything else, and don't even know that a false positive can exist. It's very easy to see how even with human contact, a circumstance might have been engineered where an unlucky person can slip through the cracks. > but insinuating that Apple is a criminal entity seems a bit much. If it's the case that a corporation uses an algorithms that they know could lead to false positives that steals peoples' money, and doesn't provide genuine human support (meaning actual managers and supervisors with authority and training to really investigate a case, not a low-ranking call-center employee with no training or ability to help) then yeah I'd say that they're behaving like a criminal entity. The caveat here is that I don't know the real details of this case, and I don't know how Apple's customer service staff are trained and operate.

pwinnski 4y ago

Like any and all anti-fraud measures, clarity is the enemy. In any system, as soon as the rules are published, scammers will do everything they can to commit malfeasance while technically not breaking any rules. You say the system can't work if people don't know what the rules are, but in fact, any system where all of the rules are known exactly is doomed to fail because bad actors exploit the rules. It would be easy to demonstrate how publishing a rule that says "23 gift cards within 36 hours triggers our systems" would obviously and necessarily lead to scammers redeeming 22 gift cards every 36 hours, right? So in fact, there's some kind trigger, and it might change based on time of day, it might change per origin country, it might change based on account age, who knows? Anti-scam and anti-spam measures succeed primarily by being flexible and vague. In this case, and in many cases, humans who looked at the full pattern of behavior (a full pattern we have only the OP's description of part of) also decided that this was likely fraudulent. That human factor is always going to be important, because some people just do unpredictably weird things sometimes. This is not about Apple and gift cards, this is ANY system that doesn't plan to turn into a scam-filled wasteland. A system can't work if everybody knows exactly how to avoid triggering automatic fraud detection.

logicalmonster 4y ago
Just for the sake of argument, let's say that it's necessary to have some set of unpublished algorithmic rules that are very rarely tripped by honest, normal usage in order to curb fraud. What happens to the handful of individuals who are not committing fraud, but were just doing uncommon things and accidentally tripped some unpublished anti-fraud measure? You agree that this isn't ok to just let them hang, right? What's the strategy for helping those people? Certainly, you're not suggesting that it's just ok to essentially say "Fuck you" to the random person who was algorithmically unlucky and essentially have a mega-corporation take a few thousand dollars of their paid for software? I would say that if you're an entity that employs these kinds of vague, unpublished rules, that there must be a fast, real, and human recourse for talking to somebody to get the problem seriously addressed or you're behaving no better than a criminal entity.
- pwinnski 4y ago
  The above was hardly my first comment on this thread, so no, I'm not saying that. However, OP has talked to humans, and apparently those humans--with access to more info than we have here--believe OP to be a scammer. (Or don't care enough to act.) Since I don't have access to that information, I feel bad for OP, and hope there's a higher level of humans he can talk to, but insinuating that Apple is a criminal entity seems a bit much.
  - logicalmonster 4y ago
    > However, OP has talked to humans, and apparently those humans--with access to more info than we have here--believe OP to be a scammer. (Or don't care enough to act.) Not every human has equal knowledge, training, and authority to resolve problems. Since I have no clue of the inner-workings of Apple's support centers, I can only give reasonable speculation. How do call centers in big corporations generally work? The employees (or contractors) are low-ranking members and without much leeway or authority to do anything other than what they're trained to do. They're usually professional enough and probably want to help people, but they're typically only trained and authorized to assist with common tasks they basically have a "script" for: maybe telling you when your order is going to ship or helping you reserve an appointment for a repair, common things like that. If your customer service request fits within the box of common tasks that they're trained and authorized to help with, you're likely good. But if your request is uncommon and they haven't been trained to help you with that, then even this human contact is useless. Maybe they're specifically trained that when they see the word "fraud" on an account profile, that they can't do anything else, and don't even know that a false positive can exist. It's very easy to see how even with human contact, a circumstance might have been engineered where an unlucky person can slip through the cracks. > but insinuating that Apple is a criminal entity seems a bit much. If it's the case that a corporation uses an algorithms that they know could lead to false positives that steals peoples' money, and doesn't provide genuine human support (meaning actual managers and supervisors with authority and training to really investigate a case, not a low-ranking call-center employee with no training or ability to help) then yeah I'd say that they're behaving like a criminal entity. The caveat here is that I don't know the real details of this case, and I don't know how Apple's customer service staff are trained and operate.