5 ms·
Isn't the first rule of fraud detection not to talk about rules you use to detect fraud? ;)
by paulsutter 14y ago
Isn't the first rule of fraud detection not to talk about rules you use to detect fraud? ;)
- solistice 14y agoIt is. If you spill the beans that you are checkin staying on site and browsing before buying, and it'll take a week till there's a tool for simulating that.
- pfredrich 14y agoIt's a trap.
- segmondy 14y agoThere is no security through obscurity only illusions of it.
- dalore 14y agoIt's analysing behaviour for patterns. If you let out what patterns you're looking for then those patterns change.
- sheri 14y agoWouldn't the patterns change after the fraudsters realize they are not working?
- wtracy 14y agoWill people please stop saying that in this context? Merchant-side fraud prevention schemes are not security. They are heuristics for reducing the number of bad transactions that the vendor has to handle. Algorithms should be air-tight. Yes, the best way to ensure that they are is to make them public. Heuristics by definition are not airtight. The best way to get utility from them is to keep their nature hidden from parties trying to abuse the system.
- solistice 14y agoI'm not saying something like that will hold forever. It might take 2 months to figure out that sites check for that, and 2 weeks (/days) to code it up. If you make the information on your heuristic public, those 2 months just drop out straight.
- enjo 14y agoA long time ago we decreased fraud by a significant amount simply by putting a little message on our payment form that we detected fraud. Stolen numbers and identities are really valuable to fraudsters, they tend to prey on merchants they think they can get it by.