6 ms·

IP based "fraud" detection is fucking annoying. I live in the UK and want to have stuff shipped to family in the US. I've had vendors of all sizes turn away my

IP based "fraud" detection is fucking annoying. I live in the UK and want to have stuff shipped to family in the US. I've had vendors of all sizes turn away my business because either they didn't like my IP or wouldn't let international addresses order at all. Amazon(.com) has literally earned themselves thousands in additional sales because they happily accepted my UK payment to a US address without fuss or hassle. You might say this is a niche situation but money is money, and I've had lot's of small vendors lose out because they were "US only!" I now also have a "flower guy" because they're the only one in the city who will do international flower orders... PS - Specific example, NewEgg, wanted to buy a several hundred dollar laptop - couldn't. Used Amazon instead.

mrb 14y ago
Why do you think it is "IP based"? It sounds more like traditional fraud checks requiring the billing and shipping address to be located in the same country.
- jacalata 14y ago
  probably because of this quote: On the internet, everything is measurable, and fraudsters leave behind tracks they’re not even aware of. What IP address is the user coming from? edit: oh, you probably mean 'why do you think (random business) refusal is IP based'.
- matt_serelli 14y ago
  His example of NewEgg is a bad one. They straight up say they don't ship international orders on their FAQ page.
rwmj 14y ago
I hope that's not what the article is suggesting. The way I read it, it's more like what Google and Facebook do: very sophisticated tracking of multiple factors (your IP, geolocation, browser identity, second-factor, etc) to find out if it's really "you" logging in, or someone who's just got your password. The problems are: (1) This will never work for a single vendor (unless it's a massive vendor like Amazon, and they're already doing it). It's something the bank has to do so it can tie together all the information about you. (2) Banks have proven to be totally useless at online security in the past, and I don't see that changing any time soon. (3) Google-style security can be a bit annoying when you really are logging in from an internet cafe in a foreign country.
- tommccabe 14y ago
  Threatmetrix assigns a fraud risk/score based on multiple factors, including the geolocation, IP, & browser. Additionally (to your point #1), they anonymize data across their customers and alert if a device has been flagged in a fraudulent transaction elsewhere. On top of their own customers, they partner with Cybersource so there is quite a network of data behind their fraud analysis. (I don't work for Threatmetrix- but I do use their product as provided via Cybersource.)
  - brandonb 14y ago
    Hey Tom -- I'd love to see if we could help with fraud even above and beyond what Cybersource/TM do. Feel free to e-mail me: brandon@siftscience.com!
- brandonb 14y ago
  That's exactly it. It's important to look at a whole bunch of factors. For example, fraudsters tend to go directly to the payments page, whereas good users will browse around the site before making a purchase. There are tons of little signals like that which allow you to distinguish legitimate users from the fraudsters. We don't do things like two-factor auth -- in general, we believe in minimizing friction. It's a better user experience, and if you can prevent fraud without burdening the user, why not? We have more information with some examples of signals our system uses here: https://siftscience.com/large-scale-machine-learning https://siftscience.com/large-scale-machine-learning
  - paulsutter 14y ago
    Isn't the first rule of fraud detection not to talk about rules you use to detect fraud? ;)
    - solistice 14y ago
      It is. If you spill the beans that you are checkin staying on site and browsing before buying, and it'll take a week till there's a tool for simulating that.
eksith 14y ago
It's not IP based, it's billing address based. Amazon has a UK presence so it's only natural they accept payments from there. But it's very myopic to insist all other vendors do the same since many don't have the resources to pursue fraud cases overseas. They barely manage to get through locally. I used to work at a fashion house that didn't ship outside the U.S. simply due to our AVS not being able to valiate addresses outside the 50 states. Losing thousands of dollars to fraud during a bleak economy isn't how people stay in business.
- UnoriginalGuy 14y ago
  I wasn't talking about shipping stuff outside of the US. Amazon UK has nothing to do with the transaction. It is all through Amazon (US/.Com).
  - eksith 14y ago
    I wasn't either. I'm talking about the billing address, which for most vendors must be in the U.S. for their AVS to work. Edit: Let me clarify further... U.S. Businesses rent services here that let their AVS take advantage of anti-fraud measures. Many of these services don't even bother looking at the shipping address, but do look at the billing to make sure the card number matches the account holder information. These services often times have no information on overseas card holders so they have no means to verify whether the actual card holder made the purchase. Now you also have some vendors who make sure the billing address == shipping address as that's a cheap way to prevent fraud (or at least reduce it). That's not what I was talking about.
    - UnoriginalGuy 14y ago
      What you're saying makes no sense. If someone uses a stolen credit card with a working address then the AVS has done nothing to mitigate the fraud, if they use a non-working address then it bounces up-stream and the AVS has done nothing, and if there is no fraud then the AVS has done nothing... So explain to me exactly what the AVS's point is? And how it saves companies money? Isn't it up to the bank to decide what is and is not a valid address for usage with the card? All you're doing is hitting real customers (including international ones).
SageRaven 14y ago
I totally agree with you. I use dirt-cheap VPS servers to tunnel web traffic over SSH socks proxies. Why? For fun. Because I can. To thwart ISP packet inspection and Google profiling my IP. To screw up IP-based ad targeting. Whatever. I often sign up for a new VPS service while relaying from another one. I will often make it through the entire sign-up process, going through the PayPal info and everything, only to be told something like, "Your new account has been suspended due to suspicion of fraud." This only happens when I'm using a proxy. So they must be doing geo-IP lookups and flagging IP space that is a certain variance from your billing address. I don't know how many VPS providers have lost my business due to this practice.
- EGreg 14y ago
  Well they are probably doing it to avoid headaches later. Maybe your business would be innocuous, but others doing the same thing might have some dirtier business in mind later.
  - deleted 14y ago
    [deleted]
- deleted 14y ago
  [deleted]
- lmz 14y ago
  Having dealt with this on the VPS provider end, sadly most orders which come in from hosting company IP ranges (not residential) are fraudulent.
  - im3w1l 14y ago
    'It seems like you are accessing our site using a proxy; we will therefore only accept payments in bitcoin to reduce chargeback risk.'
nwh 14y ago
I had to move services running on my VPS because their "fraud detector" would portscan it and find an "open proxy". It's the stupidest thing ever implemented in a payment system.
ratherbefuddled 14y ago
Smart fraud detection will use IP as one of a hundred or so checks. I know of at least one service in the UK that would OK your transaction if it could match your billing info to those US addresses through previous purchases with any of a number of different retailers. The goals the larger retailers have here are to reduce the number of manual approvals (things like phone follow ups) needed without compromising the fraud rate, not to turn down transactions, so there's a lot of competition for more intelligent detection.
seany 14y ago
Neweggs policies on card related issues are insane imho. I've actually had my account banned because my wife used my CC to buy something on her newegg account once. The next time I went to make a purchase my account was banned because the CC i wanted to use was listed in another account. It's worth noting that they didn't have any problems processing `her` order which is where you would want that kind of action to actually happen!
- trafficlight 14y ago
  I've never had this problem. I've used the same CC on multiple accounts for the past few years.
- akcreek 14y ago
  I run an ecommerce site and we sell about 50% in the US and 50% overseas and have a lot of fraud attempts pretty much daily (more outside of the US, but plenty in the US). A couple months ago I built some simple checks that dramatically reduced our handling time of fraud cases. The checks include: 1. Has the credit card been used by any other account holder? 2. Has the shipping address been used by any other account holder? 3. Has the phone number been used by any other account holder? 4. Has the billing address been used by any other account holder? If any of those are true a warning or info notice is shown depending on the situation. For example, if the shipping address is used by multiple accounts an info notice is shown as there are plenty of times the same address would be used by multiple accounts (freight forwarder, sending parts to a repair shop, etc...). It reminds the order processor to check it out and verify the order is legit. If the billing, credit card or phone number match it throws a warning as that is far less likely to happen legitimately - which is what you experienced. We don't automatically decline like Newegg did to you, but we do investigate the order thoroughly and if we aren't comfortable with it we will decline or require funds be sent via a verified papal account or wire transfer. We use a lot of other methods for checking fraud; IP, AVS, etc... but these really simple checks have been really helpful because we get hit by the same people over and over again. They try the same card with multiple accounts or use the same shipping address on multiple accounts, etc... If an order has been marked as fraud and any of those checks above hit then the new order is automatically marked as fraud too.

mrb 14y ago

Why do you think it is "IP based"? It sounds more like traditional fraud checks requiring the billing and shipping address to be located in the same country.

jacalata 14y ago
probably because of this quote: On the internet, everything is measurable, and fraudsters leave behind tracks they’re not even aware of. What IP address is the user coming from? edit: oh, you probably mean 'why do you think (random business) refusal is IP based'.
matt_serelli 14y ago
His example of NewEgg is a bad one. They straight up say they don't ship international orders on their FAQ page.

rwmj 14y ago

I hope that's not what the article is suggesting. The way I read it, it's more like what Google and Facebook do: very sophisticated tracking of multiple factors (your IP, geolocation, browser identity, second-factor, etc) to find out if it's really "you" logging in, or someone who's just got your password. The problems are: (1) This will never work for a single vendor (unless it's a massive vendor like Amazon, and they're already doing it). It's something the bank has to do so it can tie together all the information about you. (2) Banks have proven to be totally useless at online security in the past, and I don't see that changing any time soon. (3) Google-style security can be a bit annoying when you really are logging in from an internet cafe in a foreign country.

tommccabe 14y ago
Threatmetrix assigns a fraud risk/score based on multiple factors, including the geolocation, IP, & browser. Additionally (to your point #1), they anonymize data across their customers and alert if a device has been flagged in a fraudulent transaction elsewhere. On top of their own customers, they partner with Cybersource so there is quite a network of data behind their fraud analysis. (I don't work for Threatmetrix- but I do use their product as provided via Cybersource.)
- brandonb 14y ago
  Hey Tom -- I'd love to see if we could help with fraud even above and beyond what Cybersource/TM do. Feel free to e-mail me: brandon@siftscience.com!
brandonb 14y ago
That's exactly it. It's important to look at a whole bunch of factors. For example, fraudsters tend to go directly to the payments page, whereas good users will browse around the site before making a purchase. There are tons of little signals like that which allow you to distinguish legitimate users from the fraudsters. We don't do things like two-factor auth -- in general, we believe in minimizing friction. It's a better user experience, and if you can prevent fraud without burdening the user, why not? We have more information with some examples of signals our system uses here: https://siftscience.com/large-scale-machine-learning https://siftscience.com/large-scale-machine-learning
- paulsutter 14y ago
  Isn't the first rule of fraud detection not to talk about rules you use to detect fraud? ;)
  - solistice 14y ago
    It is. If you spill the beans that you are checkin staying on site and browsing before buying, and it'll take a week till there's a tool for simulating that.

eksith 14y ago

It's not IP based, it's billing address based. Amazon has a UK presence so it's only natural they accept payments from there. But it's very myopic to insist all other vendors do the same since many don't have the resources to pursue fraud cases overseas. They barely manage to get through locally. I used to work at a fashion house that didn't ship outside the U.S. simply due to our AVS not being able to valiate addresses outside the 50 states. Losing thousands of dollars to fraud during a bleak economy isn't how people stay in business.

UnoriginalGuy 14y ago
I wasn't talking about shipping stuff outside of the US. Amazon UK has nothing to do with the transaction. It is all through Amazon (US/.Com).
- eksith 14y ago
  I wasn't either. I'm talking about the billing address, which for most vendors must be in the U.S. for their AVS to work. Edit: Let me clarify further... U.S. Businesses rent services here that let their AVS take advantage of anti-fraud measures. Many of these services don't even bother looking at the shipping address, but do look at the billing to make sure the card number matches the account holder information. These services often times have no information on overseas card holders so they have no means to verify whether the actual card holder made the purchase. Now you also have some vendors who make sure the billing address == shipping address as that's a cheap way to prevent fraud (or at least reduce it). That's not what I was talking about.
  - UnoriginalGuy 14y ago
    What you're saying makes no sense. If someone uses a stolen credit card with a working address then the AVS has done nothing to mitigate the fraud, if they use a non-working address then it bounces up-stream and the AVS has done nothing, and if there is no fraud then the AVS has done nothing... So explain to me exactly what the AVS's point is? And how it saves companies money? Isn't it up to the bank to decide what is and is not a valid address for usage with the card? All you're doing is hitting real customers (including international ones).

SageRaven 14y ago

I totally agree with you. I use dirt-cheap VPS servers to tunnel web traffic over SSH socks proxies. Why? For fun. Because I can. To thwart ISP packet inspection and Google profiling my IP. To screw up IP-based ad targeting. Whatever. I often sign up for a new VPS service while relaying from another one. I will often make it through the entire sign-up process, going through the PayPal info and everything, only to be told something like, "Your new account has been suspended due to suspicion of fraud." This only happens when I'm using a proxy. So they must be doing geo-IP lookups and flagging IP space that is a certain variance from your billing address. I don't know how many VPS providers have lost my business due to this practice.

EGreg 14y ago
Well they are probably doing it to avoid headaches later. Maybe your business would be innocuous, but others doing the same thing might have some dirtier business in mind later.
- deleted 14y ago
  [deleted]
deleted 14y ago
[deleted]
lmz 14y ago
Having dealt with this on the VPS provider end, sadly most orders which come in from hosting company IP ranges (not residential) are fraudulent.
- im3w1l 14y ago
  'It seems like you are accessing our site using a proxy; we will therefore only accept payments in bitcoin to reduce chargeback risk.'

nwh 14y ago

I had to move services running on my VPS because their "fraud detector" would portscan it and find an "open proxy". It's the stupidest thing ever implemented in a payment system.

ratherbefuddled 14y ago

Smart fraud detection will use IP as one of a hundred or so checks. I know of at least one service in the UK that would OK your transaction if it could match your billing info to those US addresses through previous purchases with any of a number of different retailers. The goals the larger retailers have here are to reduce the number of manual approvals (things like phone follow ups) needed without compromising the fraud rate, not to turn down transactions, so there's a lot of competition for more intelligent detection.

seany 14y ago

Neweggs policies on card related issues are insane imho. I've actually had my account banned because my wife used my CC to buy something on her newegg account once. The next time I went to make a purchase my account was banned because the CC i wanted to use was listed in another account. It's worth noting that they didn't have any problems processing `her` order which is where you would want that kind of action to actually happen!

trafficlight 14y ago
I've never had this problem. I've used the same CC on multiple accounts for the past few years.
akcreek 14y ago
I run an ecommerce site and we sell about 50% in the US and 50% overseas and have a lot of fraud attempts pretty much daily (more outside of the US, but plenty in the US). A couple months ago I built some simple checks that dramatically reduced our handling time of fraud cases. The checks include: 1. Has the credit card been used by any other account holder? 2. Has the shipping address been used by any other account holder? 3. Has the phone number been used by any other account holder? 4. Has the billing address been used by any other account holder? If any of those are true a warning or info notice is shown depending on the situation. For example, if the shipping address is used by multiple accounts an info notice is shown as there are plenty of times the same address would be used by multiple accounts (freight forwarder, sending parts to a repair shop, etc...). It reminds the order processor to check it out and verify the order is legit. If the billing, credit card or phone number match it throws a warning as that is far less likely to happen legitimately - which is what you experienced. We don't automatically decline like Newegg did to you, but we do investigate the order thoroughly and if we aren't comfortable with it we will decline or require funds be sent via a verified papal account or wire transfer. We use a lot of other methods for checking fraud; IP, AVS, etc... but these really simple checks have been really helpful because we get hit by the same people over and over again. They try the same card with multiple accounts or use the same shipping address on multiple accounts, etc... If an order has been marked as fraud and any of those checks above hit then the new order is automatically marked as fraud too.