7 ms·

Beware Discount Steam Keys

33 points by elisee 14y ago

crazygringo 14y ago
Can someone who understands how chargebacks work please explain: 1) If this such an obvious case of massive fraud, isn't there any kind of protection for the seller? If they provide proof that the product keys were delivered to the customers, how can customers still arbitrarily have their requested chargebacks accepted? 2) Are chargeback fees always on the order of $22? That seems unbelievably high. Is this just a way that credit card operators take advantage of businesses, because they don't have much other choice? I totally understand penalizing businesses for excessive chargeback levels, when it's "widespread" and due to the business's own products. But I don't understand why credit card companies aren't going to work with businesses in case of chargeback fraud, instead of working against them. Do they really have so much monopoly power that they have no incentive to?
- Negitivefrags 14y ago
  I work on an online game also. In the case of virtual goods, you will never have a chargeback side with the seller. Never. You are at the complete mercy of every customer. All you can do is ban the account after there has been a chargeback. We get reasons like "I need to pay my rent so I want the money back" or "I played the game for a few days and I don't want to play anymore". You can supply email evidence like that as part of the chargeback claim. You will still be decided against. For virtual goods, the credit card system is just broken. Chargeback fees tend to be around $15, but you also lose the cost of the purchase.
  - tantalor 14y ago
    Isn't this fraud? If you have evidence that customers are ripping you off, why not report to law enforcement?
    - elisee 14y ago
      I don't think it would be economically viable for most independent developers or small companies to spend time and money that could be used for productive stuff to deal with a few individual chargebacks every now and then, with no guarantee that you'll make your money back anyway. Plus what happens when you lose? When it's on a massive scale like in TFA, they will probably work with law enforcement but 1) will they find the responsible? 2) even if they do, would the payment processor agreements with the various banks cover getting the chargeback fees cancelled? I don't know but it doesn't seem a given.
      - tantalor 14y ago
        You raise a good point about the cost of pursuing these cases. From my naive understanding, this type of fraud would have both criminal and civil penalties. For the criminal component, determining jurisdiction might be an issue, so there ought to be a federal agency to report cases to. The civil components might be "sold" to specialized firms, e.g., debt collectors. The point is to disincentive fraudsters and recompense victims.
  - gamblor956 14y ago
    If you can provide evidence that the charge was legitimate, the CC processor will undo the reversal of the charge (which means the charge will be placed back on the customer's bill). YMMV outside of the US, but the CC processors have lost enough court cases in the US on this point to settle the issue.
    - elisee 14y ago
      At least PayPal doesn't cover digital purchases at all for sellers. It would basically be your word against the credit card holder anyway since there is no physical proof so I can understand why they can't. Anyone could make up some proof. The root problem is with the banks: it's their system that is being used fraudulently and they should be the ones paying for it so that they have an incentive to improve it.
      - gamblor956 14y ago
        Paypal does cover digital purchases for US sellers. I know this for a fact because I have used Paypal as a merchant of digital goods and been in this situation. Paypal's service was exemplary; I simply provided a receipt of the transaction, the customer's IP address, and logs showing that the same IP address downloaded the software. Paypal never charged back the transaction and handled the dispute for me with the customer's bank. If the customer's bank refused to undo the chargeback, then Paypal swalled the loss on my behalf. Anyone could make up some proof. Well, yes. But people generally don't go through the trouble of making up proof for relatively small transactions (<$100, from the merchant's perspective). It's simply not worth the time and effort to fake up proof for something less than a $100 unless the work would take a minute or two more than simply collecting the evidence supporting the transaction.
        elisee 14y ago
        Was this recent? Did you sign up for a particular PayPal service? I use the basic Express Checkout myself so maybe some of their more expensive plans cover that? Anyway, from my own recent experience and what I heard from several indie devs, even after providing server logs & screenshots, PayPal can't do anything (and I'm not blaming them, I'm sure they do fight the charge if at all possible) EDIT: Oh, just saw you wrote "US seller". I'm not in the US so that might have something to do with it maybe.
- tantalor 14y ago
  The product keys were delivered to the purchaser (i.e., perpetrator of fraud), not the account holder (i.e., victim of fraud).
- davidandgoliath 14y ago
  It's up to merchants to ensure fraud is prevented, that is: refund anything sketchy before it becomes a chargeback. As for them being that high: $22 does seem excessive considering the purchase price of natural selections but I've seen higher.
  - seanc722 14y ago
    22$ for a 25$ game? So they lose out on the 25$ sale and get charged 22$. I feel like this amount is a little excessive.
    - ennuihenry 14y ago
      The merchant bank probably has a default chargeback fee that Unknown Worlds agreed to when they signed up with them. For instance, Balanced Payments (https://www.balancedpayments.com/docs/overview?language=bash#pricing-and-fees https://www.balancedpayments.com/docs/overview?language=bash...) has a $15 chargeback fee. It's incumbent on the business to review the fees before signing up.
- elisee 14y ago
  1) From my understanding, the purchases were made en masse using stolen credit card info, and the game keys were then sold (maybe several times?) until they ended up in front of everyday customers looking to save a bit of money by buying one from a shady website. The people who requested chargebacks are people who had their credit card info stolen and didn't make the purchase. From their point of view, it's completely legitimate to ask for a refund. 2) Chargebacks are in the $15-30 range I think. PayPal and similar services will fight a chargeback for you against the bank, but digital purchases are not protected so you end up loosing every time. The big issue is that the merchant is the one bearing the risk. I recently learned that some banks allow customers to request a chargeback months or even up to a year after purchase. I had a customer do that more than 60 days after purchase. One can buy a digital good, use it until they don't want it anymore and then get their money back... and the merchant ends up loosing money on it, in addition to giving them their money back. From my point of view, the merchants shouldn't have to pay for fraud in the banking system. The banks don't even have an incentive to secure credit card transactions if they make money on it (or at least break even)!
  - kalleboo 14y ago
    > The banks don't even have an incentive to secure credit card transactions if they make money on it (or at least break even)! This may be changing a bit. At least in Europe, we now have Chip-and-pin for offline transactions, and 3DSecure/Verified by Visa/MasterCard SecureCode for online. One of my banks now requires these schemes for online purchases, and I can't use their card on any online stores that don't support it. I believe Chip-and-PIN shifts the burden of fraud onto the consumer (if you leak your PIN it's your fault), and I wouldn't be surprised if it's the same for 3DSecure (or my bank wouldn't have any incentive to require it)
    - elisee 14y ago
      Indeed, same here (France) and it's definitely a move in the right direction. For cases similar to Unknown Worlds' though, it's important that the whole world moves to something more secure, otherwise bad guys will still be able to get their hands on less secure credit cards and use those against them.
- rgbrenner 14y ago
  1) There are a couple of protection for sellers. a) a floor limit - where visa/mc/etc cover the chargeback if it's under a certain amount ($5-20 is common)... if it is in your contract at all, it's limited to physical stores. Ecommerce/card-not-present is explicitly excluded. b) if they can prove the keys were delivered to the card holder, and the cardholder is not claiming fraud/misrepresented goods/etc, then you can usually dispute the chargeback. This is harder than it sounds, because you need to ship to the billing address via a trackable service and obtain a signature from the cardholder when it is delivered. If you've ever shipped via UPS/FedEx then you know they will often not collect the signature, or they will collect it from another person at the address, or leave the package at the door, or the signature is illegible, etc, etc, etc. 2) I've seen chargeback fees between 10 and 50$ (25-30 is common). This is a fee from the bank that provides your merchant account.. so it varies. It's a fee for handling the chargeback.. keep in mind the bank must receive the chargeback, forward it to you, accept your response, send it to the customer's bank, etc. Does that cost $22? Definitely not. Merchants are responsible for verifying the card is not fraudulent, and they accept the risk of fraud when they accept the order. If the merchant does not control the level of fraud, they'll see their merchant account terminated. The threshold varies by merchant bank.. I've seen as low as 0.2% up to 1%... but merchants usually don't get to see this number.
  - gamblor956 14y ago
    This is why you would use a service like Paypal: the contract with PP does include digital goods, and in fact Paypal is very good about backing the merchant in situations like this, so long as you can provide evidence of the purchase (including, for example, evidence that the customer used the purchased digital good after the challenged transaction).
    - rgbrenner 14y ago
      My experience here is from running an ecommerce store.. so we actually ship the product to the customer. I believe banks would accept digital proof as long as it established: 1) the cardholder made the purchase; 2) the cardholder received and/or used the digital goods. But that is really only useful if the cardholder says they did not receive the license key/digital goods. If they say you misrepresented the item, or they did not make the purchase (because their card was stolen), then I can't imagine how you would dispute the chargeback. And in that regard, PayPal is the same. If the PayPal user says their PayPal account was hacked, and they didn't make a number of transfers.. PayPal will undo the transactions.
ryguytilidie 14y ago
Where do credit card companies NOT make money? The businesses who use them pay a fee on each transaction. Their cardholders pay them interest on the balance of their account and apparently businesses are charged for fraudulent charges, even though it was the credit card company that authorized said charges. How is no one fixing this industry?
- niggler 14y ago
  "How is no one fixing this industry?" You can, and many people do, live a no-credit-card lifestyle. Need something from an online store? Amazon and other retailers offer store accounts with direct billing (search for "Amazon.com Store Card") and more favorable terms. If you find the practice shady, you as a customer can choose not to use a credit card. Use a debit card, or just pay cash. The problem is that customers like credit cards: it lets you buy stuff now!
  - NateDad 14y ago
    Debit cards aren't really any better.
    - de90 14y ago
      How come?
      - niggler 14y ago
        Visa and/or Mastercard (two of the Credit Card companies) are involved in most debit card transactions
  - cma 14y ago
    Until the consumer banking stuff passed under Obama you really had no choice but to participate. Card companies enforced merchant agreements which wouldn't let merchants charge people less for not using a card (though some states banned such agreements prior to the federal change). Merchants would lose business if they didn't accept cards, and card companies were basically able to squeeze them until such loss of business was barely more painful than just going through with it. A slight market correction came in the form of competition between card companies to give cash-back deals. This essentially rebated some of the fee back to the consumer (if an Ayn Rand nutjob saw a government bureaucratic scheme half as complex they would explode with anger). People with cash couldn't opt out; they still had to pay the same as card users, but now those merchant agreements have been restricted by law.
ge0rg 14y ago
It is a real pity banks are externalizing the fraud risk to merchants, who are not in the position to improve security in a meaningful way. This can really be only possible in a monopolistic environment...
ericbrunstad 14y ago
If VISA associated an email address with the card when the card is created and digital purchases always went to that email address, then the allure of digital fraud would be decreased since if you bought digital goods with someone else's card, you would not get the goods.
elisee 14y ago
Submission title was changed from "Unknown Worlds faced with $30.000 in chargeback fees from fraudulent purchases" to "Beware Discount Steam Keys". I thought it was interesting for Hacker News people to discuss it based on the merchant angle, not from the point of view of a consumer choosing to buy from a shady discount website, that's why I submitted it with such a title. I think the title change makes the submission that bit less valuable/tailored to the community.

33 points by elisee 14y ago

Can someone who understands how chargebacks work please explain: 1) If this such an obvious case of massive fraud, isn't there any kind of protection for the seller? If they provide proof that the product keys were delivered to the customers, how can customers still arbitrarily have their requested chargebacks accepted? 2) Are chargeback fees always on the order of $22? That seems unbelievably high. Is this just a way that credit card operators take advantage of businesses, because they don't have much other choice? I totally understand penalizing businesses for excessive chargeback levels, when it's "widespread" and due to the business's own products. But I don't understand why credit card companies aren't going to work with businesses in case of chargeback fraud, instead of working against them. Do they really have so much monopoly power that they have no incentive to?

Negitivefrags 14y ago
I work on an online game also. In the case of virtual goods, you will never have a chargeback side with the seller. Never. You are at the complete mercy of every customer. All you can do is ban the account after there has been a chargeback. We get reasons like "I need to pay my rent so I want the money back" or "I played the game for a few days and I don't want to play anymore". You can supply email evidence like that as part of the chargeback claim. You will still be decided against. For virtual goods, the credit card system is just broken. Chargeback fees tend to be around $15, but you also lose the cost of the purchase.
- tantalor 14y ago
  Isn't this fraud? If you have evidence that customers are ripping you off, why not report to law enforcement?
  - elisee 14y ago
    I don't think it would be economically viable for most independent developers or small companies to spend time and money that could be used for productive stuff to deal with a few individual chargebacks every now and then, with no guarantee that you'll make your money back anyway. Plus what happens when you lose? When it's on a massive scale like in TFA, they will probably work with law enforcement but 1) will they find the responsible? 2) even if they do, would the payment processor agreements with the various banks cover getting the chargeback fees cancelled? I don't know but it doesn't seem a given.
    - tantalor 14y ago
      You raise a good point about the cost of pursuing these cases. From my naive understanding, this type of fraud would have both criminal and civil penalties. For the criminal component, determining jurisdiction might be an issue, so there ought to be a federal agency to report cases to. The civil components might be "sold" to specialized firms, e.g., debt collectors. The point is to disincentive fraudsters and recompense victims.
- gamblor956 14y ago
  If you can provide evidence that the charge was legitimate, the CC processor will undo the reversal of the charge (which means the charge will be placed back on the customer's bill). YMMV outside of the US, but the CC processors have lost enough court cases in the US on this point to settle the issue.
  - elisee 14y ago
    At least PayPal doesn't cover digital purchases at all for sellers. It would basically be your word against the credit card holder anyway since there is no physical proof so I can understand why they can't. Anyone could make up some proof. The root problem is with the banks: it's their system that is being used fraudulently and they should be the ones paying for it so that they have an incentive to improve it.
    - gamblor956 14y ago
      Paypal does cover digital purchases for US sellers. I know this for a fact because I have used Paypal as a merchant of digital goods and been in this situation. Paypal's service was exemplary; I simply provided a receipt of the transaction, the customer's IP address, and logs showing that the same IP address downloaded the software. Paypal never charged back the transaction and handled the dispute for me with the customer's bank. If the customer's bank refused to undo the chargeback, then Paypal swalled the loss on my behalf. Anyone could make up some proof. Well, yes. But people generally don't go through the trouble of making up proof for relatively small transactions (<$100, from the merchant's perspective). It's simply not worth the time and effort to fake up proof for something less than a $100 unless the work would take a minute or two more than simply collecting the evidence supporting the transaction.
      - elisee 14y ago
        Was this recent? Did you sign up for a particular PayPal service? I use the basic Express Checkout myself so maybe some of their more expensive plans cover that? Anyway, from my own recent experience and what I heard from several indie devs, even after providing server logs & screenshots, PayPal can't do anything (and I'm not blaming them, I'm sure they do fight the charge if at all possible) EDIT: Oh, just saw you wrote "US seller". I'm not in the US so that might have something to do with it maybe.
tantalor 14y ago
The product keys were delivered to the purchaser (i.e., perpetrator of fraud), not the account holder (i.e., victim of fraud).
davidandgoliath 14y ago
It's up to merchants to ensure fraud is prevented, that is: refund anything sketchy before it becomes a chargeback. As for them being that high: $22 does seem excessive considering the purchase price of natural selections but I've seen higher.
- seanc722 14y ago
  22$ for a 25$ game? So they lose out on the 25$ sale and get charged 22$. I feel like this amount is a little excessive.
  - ennuihenry 14y ago
    The merchant bank probably has a default chargeback fee that Unknown Worlds agreed to when they signed up with them. For instance, Balanced Payments (https://www.balancedpayments.com/docs/overview?language=bash#pricing-and-fees https://www.balancedpayments.com/docs/overview?language=bash...) has a $15 chargeback fee. It's incumbent on the business to review the fees before signing up.
elisee 14y ago
1) From my understanding, the purchases were made en masse using stolen credit card info, and the game keys were then sold (maybe several times?) until they ended up in front of everyday customers looking to save a bit of money by buying one from a shady website. The people who requested chargebacks are people who had their credit card info stolen and didn't make the purchase. From their point of view, it's completely legitimate to ask for a refund. 2) Chargebacks are in the $15-30 range I think. PayPal and similar services will fight a chargeback for you against the bank, but digital purchases are not protected so you end up loosing every time. The big issue is that the merchant is the one bearing the risk. I recently learned that some banks allow customers to request a chargeback months or even up to a year after purchase. I had a customer do that more than 60 days after purchase. One can buy a digital good, use it until they don't want it anymore and then get their money back... and the merchant ends up loosing money on it, in addition to giving them their money back. From my point of view, the merchants shouldn't have to pay for fraud in the banking system. The banks don't even have an incentive to secure credit card transactions if they make money on it (or at least break even)!
- kalleboo 14y ago
  > The banks don't even have an incentive to secure credit card transactions if they make money on it (or at least break even)! This may be changing a bit. At least in Europe, we now have Chip-and-pin for offline transactions, and 3DSecure/Verified by Visa/MasterCard SecureCode for online. One of my banks now requires these schemes for online purchases, and I can't use their card on any online stores that don't support it. I believe Chip-and-PIN shifts the burden of fraud onto the consumer (if you leak your PIN it's your fault), and I wouldn't be surprised if it's the same for 3DSecure (or my bank wouldn't have any incentive to require it)
  - elisee 14y ago
    Indeed, same here (France) and it's definitely a move in the right direction. For cases similar to Unknown Worlds' though, it's important that the whole world moves to something more secure, otherwise bad guys will still be able to get their hands on less secure credit cards and use those against them.
rgbrenner 14y ago
1) There are a couple of protection for sellers. a) a floor limit - where visa/mc/etc cover the chargeback if it's under a certain amount ($5-20 is common)... if it is in your contract at all, it's limited to physical stores. Ecommerce/card-not-present is explicitly excluded. b) if they can prove the keys were delivered to the card holder, and the cardholder is not claiming fraud/misrepresented goods/etc, then you can usually dispute the chargeback. This is harder than it sounds, because you need to ship to the billing address via a trackable service and obtain a signature from the cardholder when it is delivered. If you've ever shipped via UPS/FedEx then you know they will often not collect the signature, or they will collect it from another person at the address, or leave the package at the door, or the signature is illegible, etc, etc, etc. 2) I've seen chargeback fees between 10 and 50$ (25-30 is common). This is a fee from the bank that provides your merchant account.. so it varies. It's a fee for handling the chargeback.. keep in mind the bank must receive the chargeback, forward it to you, accept your response, send it to the customer's bank, etc. Does that cost $22? Definitely not. Merchants are responsible for verifying the card is not fraudulent, and they accept the risk of fraud when they accept the order. If the merchant does not control the level of fraud, they'll see their merchant account terminated. The threshold varies by merchant bank.. I've seen as low as 0.2% up to 1%... but merchants usually don't get to see this number.
- gamblor956 14y ago
  This is why you would use a service like Paypal: the contract with PP does include digital goods, and in fact Paypal is very good about backing the merchant in situations like this, so long as you can provide evidence of the purchase (including, for example, evidence that the customer used the purchased digital good after the challenged transaction).
  - rgbrenner 14y ago
    My experience here is from running an ecommerce store.. so we actually ship the product to the customer. I believe banks would accept digital proof as long as it established: 1) the cardholder made the purchase; 2) the cardholder received and/or used the digital goods. But that is really only useful if the cardholder says they did not receive the license key/digital goods. If they say you misrepresented the item, or they did not make the purchase (because their card was stolen), then I can't imagine how you would dispute the chargeback. And in that regard, PayPal is the same. If the PayPal user says their PayPal account was hacked, and they didn't make a number of transfers.. PayPal will undo the transactions.

ryguytilidie 14y ago

Where do credit card companies NOT make money? The businesses who use them pay a fee on each transaction. Their cardholders pay them interest on the balance of their account and apparently businesses are charged for fraudulent charges, even though it was the credit card company that authorized said charges. How is no one fixing this industry?

niggler 14y ago
"How is no one fixing this industry?" You can, and many people do, live a no-credit-card lifestyle. Need something from an online store? Amazon and other retailers offer store accounts with direct billing (search for "Amazon.com Store Card") and more favorable terms. If you find the practice shady, you as a customer can choose not to use a credit card. Use a debit card, or just pay cash. The problem is that customers like credit cards: it lets you buy stuff now!
- NateDad 14y ago
  Debit cards aren't really any better.
  - de90 14y ago
    How come?
    - niggler 14y ago
      Visa and/or Mastercard (two of the Credit Card companies) are involved in most debit card transactions
- cma 14y ago
  Until the consumer banking stuff passed under Obama you really had no choice but to participate. Card companies enforced merchant agreements which wouldn't let merchants charge people less for not using a card (though some states banned such agreements prior to the federal change). Merchants would lose business if they didn't accept cards, and card companies were basically able to squeeze them until such loss of business was barely more painful than just going through with it. A slight market correction came in the form of competition between card companies to give cash-back deals. This essentially rebated some of the fee back to the consumer (if an Ayn Rand nutjob saw a government bureaucratic scheme half as complex they would explode with anger). People with cash couldn't opt out; they still had to pay the same as card users, but now those merchant agreements have been restricted by law.

ge0rg 14y ago

It is a real pity banks are externalizing the fraud risk to merchants, who are not in the position to improve security in a meaningful way. This can really be only possible in a monopolistic environment...

ericbrunstad 14y ago

If VISA associated an email address with the card when the card is created and digital purchases always went to that email address, then the allure of digital fraud would be decreased since if you bought digital goods with someone else's card, you would not get the goods.

elisee 14y ago

Submission title was changed from "Unknown Worlds faced with $30.000 in chargeback fees from fraudulent purchases" to "Beware Discount Steam Keys". I thought it was interesting for Hacker News people to discuss it based on the merchant angle, not from the point of view of a consumer choosing to buy from a shady discount website, that's why I submitted it with such a title. I think the title change makes the submission that bit less valuable/tailored to the community.