6 ms·

Hey, OP here! I work at Sift Science, who provided all the facts for this article. It's been crazy to see how far fraudsters will go to create fake accounts. W

Hey, OP here! I work at Sift Science, who provided all the facts for this article. It's been crazy to see how far fraudsters will go to create fake accounts. We've seen people in the Phillipines use Twilio accounts, for example, to fool SMS verification and look like a U.S. user. People scripting the creation of thousands of accounts. People distributing malware via Chrome extensions to take over legitimate users' accounts. Are any of you out there are dealing with malicious user behavior -- fraudsters, spammers, account takeover, etc.? I'd be happy to answer questions!

pixelcort 14y ago
How do you handle false positives? Or is that the responsibility of the site using your service?
ChuckMcM 14y ago
Nice to see your work out where it can do some good! One of the most amazing things about running a search engine was getting a look at what bad people look for (like php exploits or out of date Wordpress themes). I keep wondering if there is an opportunity for a 'fraudster alert' service like the Realtime Black Hole lists where members could share IP addresses from which has originated fraudulent or hostile traffic, seems like it would make suppression easier.
- dangrossman 14y ago
  This is one of the benefits of MaxMind MinFraud, another fraud risk evaluation service. Not only do they tell you the risk of each signup/purchase (on a 1-100 scale), but any other MinFraud customer can flag someone and every other company that recently evaluated the same person gets notified of the increased risk.
  - Evbn 14y ago
    Cool, can I use this service to get my enemies' transactions refused?
    - mootothemax 14y ago
      Surely by flagging them yourself, you wouldn't be accepting their transactions and so first and foremost hurting your own business?
      - dlss 14y ago
        Of course, that's true only if Utility(profit) > Utility(enemy's pain). I wonder if services like these count as consumer credit services (and hence are governed by all sorts of fairness laws)
    - dangrossman 14y ago
      Theoretically, but there are a few issues: * You're defrauding a fraud management service, which will catch on pretty soon when zero risk transactions get flagged by you as fraud, and close the account for abuse. * Doing what you asked is illegal in several ways, and tied to your real identity -- MinFraud costs money, and being a fraud management service, paying with a prepaid debit card, connecting over a proxy, and verifying your account with a SIP phone will all be detected and flagged -- getting an account not traceable to you is quite hard.
      - 001sky 14y ago
        Not if you can't tell the needle from the haystack. A "legit" company can mask data in many ways. The issue is the broad-brush-stroke generalizations. Some people find them pretty offensive. This is the same Sh!t banks use to deny poor, black people credit and healt companies use to deny sick people coverage. The people running these biz ideas fighting alledged XYZ (~corruption) do so out of the motive/incentive of there own personal greed and self interest, not the public good. Don't kid yourself.
- brandonb 14y ago
  Definitely! In fact, if you look at our site, one of the features we offer is real-time alerts: https://siftscience.com https://siftscience.com We combine data across all of our customers, so that if we find a fraudster on one site, we can alert every other site where the person has an account. I think there's a lot to learn by having sites aggregate all their knowledge about bad actors.
  - Cogito 14y ago
    I was interested in how you look at security and information privacy, particularly as an important part of your strategy is to aggregate data between services. When designing the service what sort of considerations did you make in this regard? Secondly, as I was reading your privacy policy I noted that your condition on non-collection of data is for users to not use any products or services that "utilize the Service". That is all well and good, but you only "encourage [your] customers to describe their use of the Service and other technologies that collect user information in privacy notices that are displayed to users." [1] If one of your customers chose not to disclose the fact that they are using your service what recourse does a user have? Is there any 'opt-out' option that lets me choose to not be tracked by you (with the understandable restriction I _can't_ use your customer's services)?? [1] https://siftscience.com/privacy https://siftscience.com/privacy
barmstrong 14y ago
Just wanted to say, Brandon is super knowledgeable in this area - great guy and resource.
Toshio 14y ago
Can we expect a Chrome plug-in that does fake opinion analysis on HN?
mootothemax 14y ago
Do you also look at - or have a chance to look at - timezones as reported by the user's browser, or as selected by the user? One of my services, TweetingMachine, used to have a massive problem with spammers going out of their way to abuse it. However, before a user can schedule a tweet, they have to select their timezone. Problem solved! There are three or four specific timezones always chosen by the bad guys, and every ten minutes a script ran through the database banning users whose timezones fell into this list. The surprisingly thing for me was that given the effort of constantly trying to get past my other detection scripts, the spammers either never worked out what was happening, or simply didn't choose a different timezone. In hindsight, it's quite a cute test, and one that it looks like few of the bad guys bother to adjust (i.e. the time their browser reports via JS) or are aware of.
- Evbn 14y ago
  This is why legitimate Nigerians and Chinese are banned from half the Internet.
  - mootothemax 14y ago
    It's not ideal, but past a certain point, as a saas operator you're caught between a rock and a hard place. The best I've been able to come up with is a "do you think this is a mistake" button, which spammers tend to not click. Still not nice to know that I'm treating people like second-class Internet citizens. At the same time, my available time is extremely limited, so lessor or two evils - for me - it is.
    - derleth 14y ago
      > lessor or two evils I'm going to guess this is an autocorrect error.
      - mootothemax 14y ago
        Hehe, thanks, you're right :-)
      - 14y ago
bootload 14y ago
"... create a digital profile of who will likely perpetrate online fraud, ..." How do you deal with false positives?

pixelcort 14y ago

How do you handle false positives? Or is that the responsibility of the site using your service?

ChuckMcM 14y ago

Nice to see your work out where it can do some good! One of the most amazing things about running a search engine was getting a look at what bad people look for (like php exploits or out of date Wordpress themes). I keep wondering if there is an opportunity for a 'fraudster alert' service like the Realtime Black Hole lists where members could share IP addresses from which has originated fraudulent or hostile traffic, seems like it would make suppression easier.

dangrossman 14y ago
This is one of the benefits of MaxMind MinFraud, another fraud risk evaluation service. Not only do they tell you the risk of each signup/purchase (on a 1-100 scale), but any other MinFraud customer can flag someone and every other company that recently evaluated the same person gets notified of the increased risk.
- Evbn 14y ago
  Cool, can I use this service to get my enemies' transactions refused?
  - mootothemax 14y ago
    Surely by flagging them yourself, you wouldn't be accepting their transactions and so first and foremost hurting your own business?
    - dlss 14y ago
      Of course, that's true only if Utility(profit) > Utility(enemy's pain). I wonder if services like these count as consumer credit services (and hence are governed by all sorts of fairness laws)
  - dangrossman 14y ago
    Theoretically, but there are a few issues: * You're defrauding a fraud management service, which will catch on pretty soon when zero risk transactions get flagged by you as fraud, and close the account for abuse. * Doing what you asked is illegal in several ways, and tied to your real identity -- MinFraud costs money, and being a fraud management service, paying with a prepaid debit card, connecting over a proxy, and verifying your account with a SIP phone will all be detected and flagged -- getting an account not traceable to you is quite hard.
    - 001sky 14y ago
      Not if you can't tell the needle from the haystack. A "legit" company can mask data in many ways. The issue is the broad-brush-stroke generalizations. Some people find them pretty offensive. This is the same Sh!t banks use to deny poor, black people credit and healt companies use to deny sick people coverage. The people running these biz ideas fighting alledged XYZ (~corruption) do so out of the motive/incentive of there own personal greed and self interest, not the public good. Don't kid yourself.
brandonb 14y ago
Definitely! In fact, if you look at our site, one of the features we offer is real-time alerts: https://siftscience.com https://siftscience.com We combine data across all of our customers, so that if we find a fraudster on one site, we can alert every other site where the person has an account. I think there's a lot to learn by having sites aggregate all their knowledge about bad actors.
- Cogito 14y ago
  I was interested in how you look at security and information privacy, particularly as an important part of your strategy is to aggregate data between services. When designing the service what sort of considerations did you make in this regard? Secondly, as I was reading your privacy policy I noted that your condition on non-collection of data is for users to not use any products or services that "utilize the Service". That is all well and good, but you only "encourage [your] customers to describe their use of the Service and other technologies that collect user information in privacy notices that are displayed to users." [1] If one of your customers chose not to disclose the fact that they are using your service what recourse does a user have? Is there any 'opt-out' option that lets me choose to not be tracked by you (with the understandable restriction I _can't_ use your customer's services)?? [1] https://siftscience.com/privacy https://siftscience.com/privacy

barmstrong 14y ago

Just wanted to say, Brandon is super knowledgeable in this area - great guy and resource.

Toshio 14y ago

Can we expect a Chrome plug-in that does fake opinion analysis on HN?

mootothemax 14y ago

Do you also look at - or have a chance to look at - timezones as reported by the user's browser, or as selected by the user? One of my services, TweetingMachine, used to have a massive problem with spammers going out of their way to abuse it. However, before a user can schedule a tweet, they have to select their timezone. Problem solved! There are three or four specific timezones always chosen by the bad guys, and every ten minutes a script ran through the database banning users whose timezones fell into this list. The surprisingly thing for me was that given the effort of constantly trying to get past my other detection scripts, the spammers either never worked out what was happening, or simply didn't choose a different timezone. In hindsight, it's quite a cute test, and one that it looks like few of the bad guys bother to adjust (i.e. the time their browser reports via JS) or are aware of.

Evbn 14y ago
This is why legitimate Nigerians and Chinese are banned from half the Internet.
- mootothemax 14y ago
  It's not ideal, but past a certain point, as a saas operator you're caught between a rock and a hard place. The best I've been able to come up with is a "do you think this is a mistake" button, which spammers tend to not click. Still not nice to know that I'm treating people like second-class Internet citizens. At the same time, my available time is extremely limited, so lessor or two evils - for me - it is.
  - derleth 14y ago
    > lessor or two evils I'm going to guess this is an autocorrect error.
    - mootothemax 14y ago
      Hehe, thanks, you're right :-)
    - 14y ago

bootload 14y ago

"... create a digital profile of who will likely perpetrate online fraud, ..." How do you deal with false positives?