4 ms·

I don’t want to minimize the pain people experience here, but it’s worth calling out just how hard this problem is for retailers and issuers. Gift cards are th

by tiffanyh 10mo ago

I don’t want to minimize the pain people experience here, but it’s worth calling out just how hard this problem is for retailers and issuers. Gift cards are the #1 fraud vector in payments ... because it lets stolen cards be converted into a cash-like equivalent with zero traceability. So fraud/risk system are highly sensitive to gift cards. It's not an excuse, but I see in this thread people minimizing the problem at hand - so I just wanted to call that out.

toomuchtodo 10mo ago
It would be a suboptimal UX potentially (vs live funds on a physical gift card), but Apple could tie the gift card to an Apple ID at purchase with a QR code or something similar, and then permit gifting through the existing Apple ecosystem primitives. Apple could then enforce stronger controls as the value is transferred internally on their internal ledger. In financial services, its all about tradeoffs. The optimal amount of fraud is non-zero (2022) - https://news.ycombinator.com/item?id=38905889 https://news.ycombinator.com/item?id=38905889 - January 2024 ($day_job is financial services, a component of my work is fraud mitigation)
- ryandrake 10mo ago
  I remember that article. It's wild the extent to which "anti-fraud" has captured companies, destroyed their UX, and seemingly directs all their actions. And when you criticize it, they blame KYC/AML and cry and act as though they have no agency. A very small tail is wagging the dog!
  - toomuchtodo 10mo ago
    Tail size is fraud budget (loss) and appetite (loss+mitigation costs). The math is straightforward to determine how much fraud you're willing to eat on an annual basis. They still have customers and revenue, right? So not terribly wild imho.
citrin_ru 10mo ago
How it's zero traceability if Apple can see: 1. credit card used to by a gift card 2. who exactly redeemed a gift card. It can be traced, the problem that they block accounts (probably using on FP prone algorithm) even if a gift card was not purchased using a stolen credit card.
- eduction 10mo ago
  Apple only sees the credit card if you buy from them, if you buy from a retailer they don’t get that info. To be clear, this is their problem, not the customers. Still, I’m curious what the scammer did in this case. If a retail worker just stole the card number it would merely be used up, not flagged as fraud. Maybe someone in the supply chain obtained the number and reported it lost/stolen? And used that to obtain a new card no one would complain about once it was used? Vs the original number which would result in a customer complaint. Idk.
- kube-system 10mo ago
  1. Apple can't see the credit card of anyone who bought a gift card from any third-party retailer 2. The normal use case for a gift card is that it is transferred to a person different than the original purchaser. Launderers also do this.
pixl97 10mo ago
Then they are free to stop offering gift cards.
- browningstreet 10mo ago
  Or/and, as an alternative, per the man from Singapore, stop using 3rd parties to distribute gift card codes.
  - ValentineC 10mo ago
    So… Apple's left hand isn't talking to their right hand, seeing as how they're the ones partnering with distributors like Blackhawk to sell their gift cards.
- xpe 10mo ago
  > Then they are free to stop offering gift cards. That's easy to say. [1] [2] [3] But reality is harder than that; keep in mind: - Fraud is complex (many moving parts, many pathways) - Fraud is adversarial (whack a mole, but worse) - Fraud and revenue are two sides of the same coin [4] P.S. The commenter doesn't state who "they" refers to: maybe issuers, maybe retailers, maybe both? [1]: A drive for simplicity is important, in moderation. But here the quote seems to not appreciate the complex reality. [2]: The response pattern "Then they are free to [foo]" is often part of a rhetorical technique to shift blame and/or responsibility to another party. [3]: See also the "nirvana fallacy" (i.e. "if you can't do it perfectly, you shouldn't do it at all.") See https://thelogicofscience.com/2016/06/20/the-nirvana-fallacy-an-imperfect-solution-is-often-better-than-no-solution/ https://thelogicofscience.com/2016/06/20/the-nirvana-fallacy... [4]: You can easily imagine a business where lowering customer friction increases both revenue and fraud. What is the ratio between them? How does it change over time?
usefulcat 10mo ago
> it’s worth calling out just how hard this problem is for retailers and issuers. I'm having a hard time finding much sympathy. They could always, oh I don't know.. maybe just not sell gift cards? Or have a much lower maximum amount? I mean yeah, you could take the view that technically the blame really lies with the people trying to use gift cards for theft, but that's not going to be productive.
kelnos 10mo ago
I'm not sympathetic to this point at all. As Patrick McKenzie says, "the optimal amount of fraud is non-zero"[0]. Yes, fraud causes problems for retailers and issuers. But in cases like this one, the result of overreactions and incorrect handling of fraud is severe, mostly-intractable problems for customers. Customers who end up having very little or no recourse. McKenzie's point is more about how businesses need to accept a certain level of fraud because trying to stamp all of it out will be more expensive and more damaging than allowing some of it. But I'd go further than that: companies should be required to accept some amount of fraud in order to avoid harming their legitimate customers. It should be just another cost of doing business. [0] https://www.bitsaboutmoney.com/archive/optimal-amount-of-fraud/ https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...
wat10000 10mo ago
And yet they continue to sell these cards. Why? It's simple: they're essentially free money. The worst case for them is that the recipient of the card uses the full amount of the card. In that case, the issuer "only" makes the full profit on those sales. Often they do better: the card is used partially or not at all, then lost or forgotten about. You can see how lucrative they are by looking at promotions. You can often find deals where you can buy a $100 card for $90, or similar. Why would you sell a dollar for 90 cents? Because you know that on average you're selling quite a bit less than a dollar. As for the fraud risk... do they even care? When gift cards are used for crime, the issuer doesn't suffer. Maybe they have to deal with upset customers, but that's hardly new. Most of the time, the gift card is bought legitimately, given to criminals, resold, used by the secondary buyer, and the only one who suffers is the unfortunate scam victim who bought it. It would be so easy to make gift cards more secure. Modern technology can do a lot better than an alphanumeric code under a sticky cover. The fact that they don't bother should tell you everything you need to know about how important fraud is for them.
- zahlman 10mo ago
  > Why would you sell a dollar for 90 cents? Because you know that on average you're selling quite a bit less than a dollar. There's more to it than covering the risk of fraud. It's more about optionality. The gift card only allows for buying things at one place — so you're restricted in what you can buy, can't deposit it at a bank, can't comparison shop etc. I don't get the sense that money being left on the card is a serious issue for the sort of person who goes hunting for deals like this. They'll eventually spend more than the card's value and have the last of it apply partially to some purchase. Also the discount rates I've seen have been more like buying the $100 card for $95 or $97. Except perhaps where the gift card retailer is offering it directly as part of a cross-promotion deal with the target retailer.
  - BobaFloutist 10mo ago
    You usually save at least 10% on giftcards at Costco, and often 20%.
- quesera 10mo ago
deleted 10mo ago
[deleted]
SAI_Peregrinus 10mo ago
Workaround I've experienced in practice: some stores only allow purchasing gift cards with cash. This doesn't allow online-only gift card purchases, so it's not a full solution, just a workaround.
- ValentineC 10mo ago
  Another way gift cards have been used is as a means of transferring "wealth" to anonymous scammers. Dumb people were being scammed in Singapore, until the financial regulator here clamped down on gift cards altogether. It used to be trivial to buy Apple, Google, and Steam gift cards in Singapore convenience stores. They're no longer being sold anywhere. I'm not sure how requiring gift cards to be bought with cash would help prevent that
asadotzler 10mo ago
You seem to be positing that retailers have not option but to issue gift cards and then deal with massive fraud. That's silly. How about not offering gift cards in the first place if you cannot manage the associated fraud without fucking over your customers?
aranelsurion 10mo ago
Why not just ban the user from using gift cards then, instead of banning their entire account between 30 different products under the same company umbrella? They don’t need to fix insecurity of gift cards, they just need better access controls. Yet they have no incentive right now to tackle that.

toomuchtodo 10mo ago

It would be a suboptimal UX potentially (vs live funds on a physical gift card), but Apple could tie the gift card to an Apple ID at purchase with a QR code or something similar, and then permit gifting through the existing Apple ecosystem primitives. Apple could then enforce stronger controls as the value is transferred internally on their internal ledger. In financial services, its all about tradeoffs. The optimal amount of fraud is non-zero (2022) - https://news.ycombinator.com/item?id=38905889 https://news.ycombinator.com/item?id=38905889 - January 2024 ($day_job is financial services, a component of my work is fraud mitigation)

ryandrake 10mo ago
I remember that article. It's wild the extent to which "anti-fraud" has captured companies, destroyed their UX, and seemingly directs all their actions. And when you criticize it, they blame KYC/AML and cry and act as though they have no agency. A very small tail is wagging the dog!
- toomuchtodo 10mo ago
  Tail size is fraud budget (loss) and appetite (loss+mitigation costs). The math is straightforward to determine how much fraud you're willing to eat on an annual basis. They still have customers and revenue, right? So not terribly wild imho.

citrin_ru 10mo ago

How it's zero traceability if Apple can see: 1. credit card used to by a gift card 2. who exactly redeemed a gift card. It can be traced, the problem that they block accounts (probably using on FP prone algorithm) even if a gift card was not purchased using a stolen credit card.

eduction 10mo ago
Apple only sees the credit card if you buy from them, if you buy from a retailer they don’t get that info. To be clear, this is their problem, not the customers. Still, I’m curious what the scammer did in this case. If a retail worker just stole the card number it would merely be used up, not flagged as fraud. Maybe someone in the supply chain obtained the number and reported it lost/stolen? And used that to obtain a new card no one would complain about once it was used? Vs the original number which would result in a customer complaint. Idk.
kube-system 10mo ago
1. Apple can't see the credit card of anyone who bought a gift card from any third-party retailer 2. The normal use case for a gift card is that it is transferred to a person different than the original purchaser. Launderers also do this.

pixl97 10mo ago

Then they are free to stop offering gift cards.

browningstreet 10mo ago
Or/and, as an alternative, per the man from Singapore, stop using 3rd parties to distribute gift card codes.
- ValentineC 10mo ago
  So… Apple's left hand isn't talking to their right hand, seeing as how they're the ones partnering with distributors like Blackhawk to sell their gift cards.
xpe 10mo ago
> Then they are free to stop offering gift cards. That's easy to say. [1] [2] [3] But reality is harder than that; keep in mind: - Fraud is complex (many moving parts, many pathways) - Fraud is adversarial (whack a mole, but worse) - Fraud and revenue are two sides of the same coin [4] P.S. The commenter doesn't state who "they" refers to: maybe issuers, maybe retailers, maybe both? [1]: A drive for simplicity is important, in moderation. But here the quote seems to not appreciate the complex reality. [2]: The response pattern "Then they are free to [foo]" is often part of a rhetorical technique to shift blame and/or responsibility to another party. [3]: See also the "nirvana fallacy" (i.e. "if you can't do it perfectly, you shouldn't do it at all.") See https://thelogicofscience.com/2016/06/20/the-nirvana-fallacy-an-imperfect-solution-is-often-better-than-no-solution/ https://thelogicofscience.com/2016/06/20/the-nirvana-fallacy... [4]: You can easily imagine a business where lowering customer friction increases both revenue and fraud. What is the ratio between them? How does it change over time?

usefulcat 10mo ago

> it’s worth calling out just how hard this problem is for retailers and issuers. I'm having a hard time finding much sympathy. They could always, oh I don't know.. maybe just not sell gift cards? Or have a much lower maximum amount? I mean yeah, you could take the view that technically the blame really lies with the people trying to use gift cards for theft, but that's not going to be productive.

kelnos 10mo ago

I'm not sympathetic to this point at all. As Patrick McKenzie says, "the optimal amount of fraud is non-zero"[0]. Yes, fraud causes problems for retailers and issuers. But in cases like this one, the result of overreactions and incorrect handling of fraud is severe, mostly-intractable problems for customers. Customers who end up having very little or no recourse. McKenzie's point is more about how businesses need to accept a certain level of fraud because trying to stamp all of it out will be more expensive and more damaging than allowing some of it. But I'd go further than that: companies should be required to accept some amount of fraud in order to avoid harming their legitimate customers. It should be just another cost of doing business. [0] https://www.bitsaboutmoney.com/archive/optimal-amount-of-fraud/ https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...

wat10000 10mo ago

And yet they continue to sell these cards. Why? It's simple: they're essentially free money. The worst case for them is that the recipient of the card uses the full amount of the card. In that case, the issuer "only" makes the full profit on those sales. Often they do better: the card is used partially or not at all, then lost or forgotten about. You can see how lucrative they are by looking at promotions. You can often find deals where you can buy a $100 card for $90, or similar. Why would you sell a dollar for 90 cents? Because you know that on average you're selling quite a bit less than a dollar. As for the fraud risk... do they even care? When gift cards are used for crime, the issuer doesn't suffer. Maybe they have to deal with upset customers, but that's hardly new. Most of the time, the gift card is bought legitimately, given to criminals, resold, used by the secondary buyer, and the only one who suffers is the unfortunate scam victim who bought it. It would be so easy to make gift cards more secure. Modern technology can do a lot better than an alphanumeric code under a sticky cover. The fact that they don't bother should tell you everything you need to know about how important fraud is for them.

zahlman 10mo ago
> Why would you sell a dollar for 90 cents? Because you know that on average you're selling quite a bit less than a dollar. There's more to it than covering the risk of fraud. It's more about optionality. The gift card only allows for buying things at one place — so you're restricted in what you can buy, can't deposit it at a bank, can't comparison shop etc. I don't get the sense that money being left on the card is a serious issue for the sort of person who goes hunting for deals like this. They'll eventually spend more than the card's value and have the last of it apply partially to some purchase. Also the discount rates I've seen have been more like buying the $100 card for $95 or $97. Except perhaps where the gift card retailer is offering it directly as part of a cross-promotion deal with the target retailer.
- BobaFloutist 10mo ago
  You usually save at least 10% on giftcards at Costco, and often 20%.
quesera 10mo ago

deleted 10mo ago

[deleted]

SAI_Peregrinus 10mo ago

Workaround I've experienced in practice: some stores only allow purchasing gift cards with cash. This doesn't allow online-only gift card purchases, so it's not a full solution, just a workaround.

ValentineC 10mo ago
Another way gift cards have been used is as a means of transferring "wealth" to anonymous scammers. Dumb people were being scammed in Singapore, until the financial regulator here clamped down on gift cards altogether. It used to be trivial to buy Apple, Google, and Steam gift cards in Singapore convenience stores. They're no longer being sold anywhere. I'm not sure how requiring gift cards to be bought with cash would help prevent that

asadotzler 10mo ago

You seem to be positing that retailers have not option but to issue gift cards and then deal with massive fraud. That's silly. How about not offering gift cards in the first place if you cannot manage the associated fraud without fucking over your customers?

aranelsurion 10mo ago

Why not just ban the user from using gift cards then, instead of banning their entire account between 30 different products under the same company umbrella? They don’t need to fix insecurity of gift cards, they just need better access controls. Yet they have no incentive right now to tackle that.