13 ms·

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone nu

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under all circumstances. -- Mobile phones are never lost or stolen and their batteries never run down. -- Mobile phone numbers last forever. -- An email address uniquely identifies a person. -- Every person has an email address and they only have one email address. -- Every person is always able to receive email under all circumstances. -- Email addresses last forever. -- People never travel to foreign countries. -- A person's IP address always determines where they are located. -- Geolocated IP addresses are always accurate. -- Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end. -- The IP address for a customer will never change during a given session (i.e. LEO satellite internet does not exist). -- If the IP address for a customer changes "too quickly", that indicates fraud (i.e. LEO satellite internet does not exist). -- Your customer will never connect to you through a VPN. -- If your customer connects to you through a VPN, they are doing something fraudulent, rather than trying to get around your geolocation brain damage.

ugh123 3y ago
Programmers make these assumptions? How about product/program managers?
- lucasyvas 3y ago
  I would say it's both.
cj 3y ago
The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discovered that VOIP phone numbers on a resume is extremely highly correlated with the applicant lying about where they live. If it weren’t for this screening step, I literally wouldn’t be able to hire anyone because the volume of fraud is so incredibly high that it drowns out legitimate candidates. I wish there were a way to detect fraud while never having a false positive. But the reality is that a lot of the heuristics you listed are indeed strongly correlated with fraud. It sucks, but it’s also not realistic to optimize for the 1% of false positives at the expense of the 99%.
- MrRolleyes 3y ago
  [dead]
- thwarted 3y ago
  Tragedy of the Commons Ruins Everything Around Me.
- LoganDark 3y ago
  > US-only remote roles. The entire premise of remote is that it shouldn't matter where you work from, as long as you get the work done. This is extremely, incredibly harmful. I hope you know that.
  - ragestorm 3y ago
    You still need to provide accurate data for location, mainly due to taxes. I'm also getting from the post that there's an implication that they are receiving outside the us applicants.
  - deleted 3y ago
    [deleted]
  - cj 3y ago
    To be clear, “US Only” means “eligible to work in the US”. The candidates that I’m calling fraudulent are answering “Yes” to a question on our applicant form asking if they’re eligible to work in the US. There’s absolutely nothing wrong with a US company wanting to hire US employees. (FWIW I also hire contract developers outside the US… have nothing against outsourcing, but I prefer to do so knowingly rather than being conned)
    - janosdebugs 3y ago
      > The candidates that I’m calling fraudulent are answering “Yes” to a question on our applicant form asking if they’re eligible to work in the US. The dumb thing is that a lot (and I do mean a lot) of hiring platforms ask this question even when the job is advertized as not being in the US. It's hard to take seriously anymore.
quags 3y ago
All these can be the wrong assumptions for sure. Working in a space with some fraud though I can tell you the majority of users verify fine and there ate only the few percentage that don’t for any number of reasons some what you have given above. For smaller vendors though things to consider are - a charge back can come up to 6 months later. A loss of that is not only a loss of funds but a charge back fee - too many charge backs could affect the merchant account with the potential of a loss of being able to run your business and this can extend to PayPal or anything merchants run charges through. - Fees may go up like interchange fees on running credit cards if an account is deemed higher risk. - blacklisting from visa or Mastercard or merchant accounts in general is not unheard of. Loosing access to running credit cards would be the end of many businesses. So mom and pop shops need to be aware of fraud and ensure it is low or taken care of. You can’t just accept every order and hope for the best. Fraud does exists and when only a few percentage of users meet your list of incorrect fraud assumptions it’s easy to see why they are used at least for extra verification. One good thing for merchants for those who accept crypto like Bitcoin is all the risk moves to the sender not the merchant. There are no charge backs - so merchants who take crypto should be able to be a bit more lenient on payments and verification.
- ajb 3y ago
  The problem is that it's not acceptable for online providers to converge on making life miserable for "a few percent" of people. This is a market failure: to save the cost of a few bucks, huge costs are imposed on these individuals. The answer is to have some mechanism whereby people who run into these issues can pay (once) the small cost of being validated in an alternative way (like, actually talking to a human and explaining what's going on, which is how these issues got solved in meatspace originally)
  - smeej 3y ago
    But humans are the easiest to con. I've worked in fraud prevention professionally for years and adding a human verification layer to the equation would make me vastly less likely to believe a suspicious applicant was legitimate.
  - 3y ago
jey 3y ago
Why would LEO satellite internet cause frequent change of IP addresses? Shouldn't all that moving-satellite stuff be handled on a lower level of the OSI Model (probably Layer 2: Data Link), and the IP stuff at Layer 3 isn't affected?
- dreamcompiler 3y ago
  With Starlink, the downlink location determines your externally-visible IP address and that can change every 90 seconds or so based on where the closest satellite to you is at the moment. I'm in New Mexico and I frequenly see ads on web pages directing me to shops in Denver or Dallas because those are the downlink locations for me. You can see the issue better on this visualization: https://starlink.sx/ https://starlink.sx/
  - jey 3y ago
    OK that's strange but makes sense, so it's the publicly-routable IP after "network address translation" (NAT) that keeps changing.
  - olyjohn 3y ago
    I think there must be something going on here. Changing your IP address would screw with all sorts of things. You never be able to do online gaming. Video streaming would stop working every time your IP changed. Anything that streams would just die and not recover for a while.
    - iggldiggl 3y ago
      > Video streaming would stop working every time your IP changed. Anything that streams would just die and not recover for a while. Not if the client has buffered enough data, allowing it to reconnect in background while playback continues.
indrora 3y ago
I'll add another to that list: -- People will never have a physical mailing address that contains "funny" numbers like "000", "420", "69420", or "80085".
- dukeyukey 3y ago
  Or that some towns may have... unusual substrings (Scunthorpe, Shitterton, Fingringhoe, and the ever-famous Fucking in Austria, now renamed to Fugging).
- margalabargala 3y ago
  I used to live in Baltimore, where there are numbered streets that include ½ symbol streets, and worse, house numbers including ½ numbered houses.
  - MerelyMortal 3y ago
    I believe Galveston, TX has lettered half streets, example: 123 A ½ St
    - deleted 3y ago
      [deleted]
  - ProllyInfamous 3y ago
    How does one enter "½" into a webform?
- dghlsakjg 3y ago
  I once had a friend that lived at, no shit, 1337 High.
- lisper 3y ago
  What’s funny about 420?
  - dr_kiszonka 3y ago
tracerbulletx 3y ago
It has nothing to do with wrong assumptions, it has everything to do with the statistical similarity to fraudulent transactions and acceptable failure rates.
- creer 3y ago
  Or laziness? "Quick and dirty" is so tempting.
  - mike_d 3y ago
    You have no idea how much justification it takes to reject orders. It is not done lightly.
    - creer 3y ago
      I'm aware. There is also such a thing as "choosing one's battles", sure. You can't make a crusade of every little detail. But you must raise the issue. Proposed way to do it: One argument I have used in the past on the job is that 0.5% here, 0.5% there, after 40 corners have been cut, does add up. It's enough to transform a project from "quick and dirty" to "customer support headache" and "bad press".
withinboredom 3y ago
> Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end. My Google Maps language (on my PC) is STILL in Portuguese, but I only happened to be visiting Portugal (for 3 days) when they did the subdomain switch... Every time I change it back to English, it changes the language back the next time I visit the site. It's super frustrating.
- corbezzoli 3y ago
  Make sure you’re not visiting with a bookmark that includes the specific language code. I had a similar issue with some history item that would annoyingly point me to the previous version of a page. Only to realize that I was opening a permalink to it.
qingcharles 3y ago
I tried to place some online bets for a friend who is in prison. But the betting sites don't allow you to use an ethernet cable to connect to your router o_O (unless you also enable wifi.. except my desktop doesn't have wifi) https://helpcenter.il.betrivers.com/hc/en-us/articles/360049311073-Do-I-need-to-be-connected-to-the-internet-via-WiFi-to-be-located-Can-I-be-connected-to-the-internet-via-a-cable- https://helpcenter.il.betrivers.com/hc/en-us/articles/360049...
- lotsofpulp 3y ago
  What is the heuristic they are checking for here? That problematic actors overwhelmingly will be unable to show an active wifi adapter?
  - dehrmann 3y ago
    I'm guessing that's bots in data centers.
  - sanswork 3y ago
    Almost everyone uses wifi for everything now. If you're using Ethernet there is a very high probability you are actually a proxy/vpn exit on a rack in some random residential location.
    - olyjohn 3y ago
      Well that's a shitty filter because now criminals will use wifi or fake using wifi. And then they will get right through. It's not that hard to fake. Security Theater.
      - sanswork 3y ago
        You're filtering for people using vpns to access your site from a country other than the one they are claiming. They likely aren't criminal operations just users operating outside the bounds of your service. They aren't going to have the ability to do anything but sign up for a vpn service so it works quite well for stopping them.
quickthrower2 3y ago
- Twilio etc. cam deliver SMS to any network - The networks Twilio etc. can’t deliver to are small and don’t have millions of users
nickt 3y ago
— everyone has a USA taxpayer ID
- MerelyMortal 3y ago
  or even 'All American citizens have a USA taxpayer ID'
998244353 3y ago
> Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end. This one is only tangentially related to fraud prevention. But I've never really understood this. Is the Accept-Language header really so inaccurate?
- Huppie 3y ago
  > Is the Accept-Language header really so inaccurate? I'd say so yeah. Many many old people here (in a country where English isn't the primary language) use 'misconfigured' browsers. It's getting better nowadays I suppose with new installers defaulting to our native language but (even though I tend to prefer the English version myself) I think it's a good default. I do prefer an easy way to change it though (or a quick confirmation on the first visit.)
seanhunter 3y ago
I'm calling BS on this list. Pretty much noone makes any of these assumptions. The thing with many of these (eg VoIP, Google Voice, VPN etc) is that the population who use these for legitimate purposes is too small for most devs to care about given the cost of fraud from people who are using these things nefariously. Both type I and type II errors are important but they mostly only care about type II errors because type I errors just piss off a small number of good people whereas type II errors cost them money and if they go unabated will get them shut down by payment processors, banks, regulators etc.

ugh123 3y ago

Programmers make these assumptions? How about product/program managers?

lucasyvas 3y ago
I would say it's both.

cj 3y ago

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discovered that VOIP phone numbers on a resume is extremely highly correlated with the applicant lying about where they live. If it weren’t for this screening step, I literally wouldn’t be able to hire anyone because the volume of fraud is so incredibly high that it drowns out legitimate candidates. I wish there were a way to detect fraud while never having a false positive. But the reality is that a lot of the heuristics you listed are indeed strongly correlated with fraud. It sucks, but it’s also not realistic to optimize for the 1% of false positives at the expense of the 99%.

MrRolleyes 3y ago
[dead]
thwarted 3y ago
Tragedy of the Commons Ruins Everything Around Me.
LoganDark 3y ago
> US-only remote roles. The entire premise of remote is that it shouldn't matter where you work from, as long as you get the work done. This is extremely, incredibly harmful. I hope you know that.
- ragestorm 3y ago
  You still need to provide accurate data for location, mainly due to taxes. I'm also getting from the post that there's an implication that they are receiving outside the us applicants.
- deleted 3y ago
  [deleted]
- cj 3y ago
  To be clear, “US Only” means “eligible to work in the US”. The candidates that I’m calling fraudulent are answering “Yes” to a question on our applicant form asking if they’re eligible to work in the US. There’s absolutely nothing wrong with a US company wanting to hire US employees. (FWIW I also hire contract developers outside the US… have nothing against outsourcing, but I prefer to do so knowingly rather than being conned)
  - janosdebugs 3y ago
    > The candidates that I’m calling fraudulent are answering “Yes” to a question on our applicant form asking if they’re eligible to work in the US. The dumb thing is that a lot (and I do mean a lot) of hiring platforms ask this question even when the job is advertized as not being in the US. It's hard to take seriously anymore.

quags 3y ago

All these can be the wrong assumptions for sure. Working in a space with some fraud though I can tell you the majority of users verify fine and there ate only the few percentage that don’t for any number of reasons some what you have given above. For smaller vendors though things to consider are - a charge back can come up to 6 months later. A loss of that is not only a loss of funds but a charge back fee - too many charge backs could affect the merchant account with the potential of a loss of being able to run your business and this can extend to PayPal or anything merchants run charges through. - Fees may go up like interchange fees on running credit cards if an account is deemed higher risk. - blacklisting from visa or Mastercard or merchant accounts in general is not unheard of. Loosing access to running credit cards would be the end of many businesses. So mom and pop shops need to be aware of fraud and ensure it is low or taken care of. You can’t just accept every order and hope for the best. Fraud does exists and when only a few percentage of users meet your list of incorrect fraud assumptions it’s easy to see why they are used at least for extra verification. One good thing for merchants for those who accept crypto like Bitcoin is all the risk moves to the sender not the merchant. There are no charge backs - so merchants who take crypto should be able to be a bit more lenient on payments and verification.

ajb 3y ago
The problem is that it's not acceptable for online providers to converge on making life miserable for "a few percent" of people. This is a market failure: to save the cost of a few bucks, huge costs are imposed on these individuals. The answer is to have some mechanism whereby people who run into these issues can pay (once) the small cost of being validated in an alternative way (like, actually talking to a human and explaining what's going on, which is how these issues got solved in meatspace originally)
- smeej 3y ago
  But humans are the easiest to con. I've worked in fraud prevention professionally for years and adding a human verification layer to the equation would make me vastly less likely to believe a suspicious applicant was legitimate.
- 3y ago

jey 3y ago

Why would LEO satellite internet cause frequent change of IP addresses? Shouldn't all that moving-satellite stuff be handled on a lower level of the OSI Model (probably Layer 2: Data Link), and the IP stuff at Layer 3 isn't affected?

dreamcompiler 3y ago
With Starlink, the downlink location determines your externally-visible IP address and that can change every 90 seconds or so based on where the closest satellite to you is at the moment. I'm in New Mexico and I frequenly see ads on web pages directing me to shops in Denver or Dallas because those are the downlink locations for me. You can see the issue better on this visualization: https://starlink.sx/ https://starlink.sx/
- jey 3y ago
  OK that's strange but makes sense, so it's the publicly-routable IP after "network address translation" (NAT) that keeps changing.
- olyjohn 3y ago
  I think there must be something going on here. Changing your IP address would screw with all sorts of things. You never be able to do online gaming. Video streaming would stop working every time your IP changed. Anything that streams would just die and not recover for a while.
  - iggldiggl 3y ago
    > Video streaming would stop working every time your IP changed. Anything that streams would just die and not recover for a while. Not if the client has buffered enough data, allowing it to reconnect in background while playback continues.

indrora 3y ago

I'll add another to that list: -- People will never have a physical mailing address that contains "funny" numbers like "000", "420", "69420", or "80085".

dukeyukey 3y ago
Or that some towns may have... unusual substrings (Scunthorpe, Shitterton, Fingringhoe, and the ever-famous Fucking in Austria, now renamed to Fugging).
margalabargala 3y ago
I used to live in Baltimore, where there are numbered streets that include ½ symbol streets, and worse, house numbers including ½ numbered houses.
- MerelyMortal 3y ago
  I believe Galveston, TX has lettered half streets, example: 123 A ½ St
  - deleted 3y ago
    [deleted]
- ProllyInfamous 3y ago
  How does one enter "½" into a webform?
dghlsakjg 3y ago
I once had a friend that lived at, no shit, 1337 High.
lisper 3y ago
What’s funny about 420?
- dr_kiszonka 3y ago

tracerbulletx 3y ago

It has nothing to do with wrong assumptions, it has everything to do with the statistical similarity to fraudulent transactions and acceptable failure rates.

creer 3y ago
Or laziness? "Quick and dirty" is so tempting.
- mike_d 3y ago
  You have no idea how much justification it takes to reject orders. It is not done lightly.
  - creer 3y ago
    I'm aware. There is also such a thing as "choosing one's battles", sure. You can't make a crusade of every little detail. But you must raise the issue. Proposed way to do it: One argument I have used in the past on the job is that 0.5% here, 0.5% there, after 40 corners have been cut, does add up. It's enough to transform a project from "quick and dirty" to "customer support headache" and "bad press".

withinboredom 3y ago

> Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end. My Google Maps language (on my PC) is STILL in Portuguese, but I only happened to be visiting Portugal (for 3 days) when they did the subdomain switch... Every time I change it back to English, it changes the language back the next time I visit the site. It's super frustrating.

corbezzoli 3y ago
Make sure you’re not visiting with a bookmark that includes the specific language code. I had a similar issue with some history item that would annoyingly point me to the previous version of a page. Only to realize that I was opening a permalink to it.

qingcharles 3y ago

I tried to place some online bets for a friend who is in prison. But the betting sites don't allow you to use an ethernet cable to connect to your router o_O (unless you also enable wifi.. except my desktop doesn't have wifi) https://helpcenter.il.betrivers.com/hc/en-us/articles/360049311073-Do-I-need-to-be-connected-to-the-internet-via-WiFi-to-be-located-Can-I-be-connected-to-the-internet-via-a-cable- https://helpcenter.il.betrivers.com/hc/en-us/articles/360049...

lotsofpulp 3y ago
What is the heuristic they are checking for here? That problematic actors overwhelmingly will be unable to show an active wifi adapter?
- dehrmann 3y ago
  I'm guessing that's bots in data centers.
- sanswork 3y ago
  Almost everyone uses wifi for everything now. If you're using Ethernet there is a very high probability you are actually a proxy/vpn exit on a rack in some random residential location.
  - olyjohn 3y ago
    Well that's a shitty filter because now criminals will use wifi or fake using wifi. And then they will get right through. It's not that hard to fake. Security Theater.
    - sanswork 3y ago
      You're filtering for people using vpns to access your site from a country other than the one they are claiming. They likely aren't criminal operations just users operating outside the bounds of your service. They aren't going to have the ability to do anything but sign up for a vpn service so it works quite well for stopping them.

quickthrower2 3y ago

- Twilio etc. cam deliver SMS to any network - The networks Twilio etc. can’t deliver to are small and don’t have millions of users

nickt 3y ago

— everyone has a USA taxpayer ID

MerelyMortal 3y ago
or even 'All American citizens have a USA taxpayer ID'

998244353 3y ago

> Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end. This one is only tangentially related to fraud prevention. But I've never really understood this. Is the Accept-Language header really so inaccurate?

Huppie 3y ago
> Is the Accept-Language header really so inaccurate? I'd say so yeah. Many many old people here (in a country where English isn't the primary language) use 'misconfigured' browsers. It's getting better nowadays I suppose with new installers defaulting to our native language but (even though I tend to prefer the English version myself) I think it's a good default. I do prefer an easy way to change it though (or a quick confirmation on the first visit.)

seanhunter 3y ago

I'm calling BS on this list. Pretty much noone makes any of these assumptions. The thing with many of these (eg VoIP, Google Voice, VPN etc) is that the population who use these for legitimate purposes is too small for most devs to care about given the cost of fraud from people who are using these things nefariously. Both type I and type II errors are important but they mostly only care about type II errors because type I errors just piss off a small number of good people whereas type II errors cost them money and if they go unabated will get them shut down by payment processors, banks, regulators etc.