5 ms·

"Basically, we were in a race to develop new anti-fraud techniques and they were in a race to develop new ways to steal money. The by-product of it was all our

by ig1 13y ago

"Basically, we were in a race to develop new anti-fraud techniques and they were in a race to develop new ways to steal money. The by-product of it was all our competitors got wiped out because as the Russian mobsters got better and better, they got better and better at destroying all of our competitors." - Max Levchin on the history of Paypal. Those who don't learn from history are doomed to repeat it.

sillysaurus3 13y ago
The quote was so interesting that I went and found the source: http://ecorner.stanford.edu/1028.ect http://ecorner.stanford.edu/1028.ect Now there's this gem: "it was basically became clear that we either figure out how to beat the fraudsters or the fraudsters will take us under. And the company more or less refocused itself as a research entity towards figuring out innovative technological ways of destroying fraud in the Internet. And that alone could be the subject of an entire class or a series of classes so I will completely skip over all the cool technology we developed. Some of you might have seen stuff in the news, words like EOR or ELIA, all these tools that we've built. They're as cool as they sound. I could never tell you about them because they're very secret and they're still in use. But maybe if you want to hang out afterwards, I can tell you a little bit. But they're really cool and we did really figured out how to kill fraud. ... The submerged part of PayPal is this massive and very, very numerically-driven risk management system which allows us to instantaneously tell when you're moving money to someone else, with a very high degree of certainty whether the money you're moving is yours or you got it illegally and we might be on the hook later on to help the authorities investigate or retrieve the money, et cetera, et cetera." I simply must know. I'll never find out how Paypal killed fraud unless I ask HN right now, and I've got to know. So, with apologies for branching into a completely unrelated topic: What magic did Paypal invent in order to do all of those amazing things described above? How'd they kill fraud? What are the details of how the technology works? Is it still a closely guarded secret? Do they use some advanced statistical mathematics to detect fraud, or do they bruteforce the detection by providing massive quantities of data to the otherwise-dumb detector algorithm? What fascinates me is that they've come up with a way to detect fraud automatically, with no human input. There are false positives, which everyone here has probably had some terrible experiences with, but... Still, how did they train a computer to detect and freeze the very sophisticated and very subtle covert techniques of Russian mobster money launderers? Any info would be very much appreciated, especially citations / references for further reading on this topic.
- patio11 13y ago
  I didn't work in risk analysis at Paypal, but I have a passing interest in the field. A lot of it is much simpler than you think it is. Want a not-so-secret anti-fraud technique? If the billing address is Kansas and the IP is China, you probably shouldn't let that transaction go through. Really obnoxious for those of us who live overseas. Stupendously valuable, though. There exists a particular anti-fraud heuristic at a YC company. They shared it to me in confidence, because as soon as you know it exists, you can trivially avoid it. I mean trivially. It's apparently insanely effective, though, half because it has a really good handle on who it wants to frustrate and the other half because it's not in the literature at all and, as a consequence, the bad guys don't even know they have to avoid defenses in that class of algorithms. ("But that's security through obscurity!" Good recitation of the dogma, but can I point out to you "This was implemented, in actual computer code, and does in fact actually work?") There exist more complicated things you can do with machine learning. There also exist more complicated things you can do with heuristics. There also exist more complicated things you can do with live fraud teams. There is non-zero value to finding fraud even after it has happened, because shutting down the fraudulent accounts means you can either keep some horses in the barn or even, potentially, call some of the stolen ones back. An underappreciated angle of this is that you don't have to outrun the tiger, you just have to outrun your friend. You start getting dedicated adversarial interest as you approach the most lucrative weak link in the entire financial system. That was Paypal back in the day -- with a bullet. Even though no startup/bank/etc ships with perfect security, investing sufficiently in security means the guy that gets victimized is someone other than you. They either go bankrupt or have their problems burned away in cleansing fire. Then the cycle repeats. (One reason Bitcoin companies keep getting looted is that if you plot out "Amount we could conveniently steal" versus "Resources spent on defense in the last 6 months" for all companies in the financial sector there are a lot of dots representing Bitcoin companies which are isolated islands, and the sea is filled with sharks.) It's a fun field, for a certain perverse and high-stress definition of "fun." I'd probably have made a career in it, but found making and selling software (with just a wee bit of risk management/security/etc thrown in) to be more fulfilling.
  - enraged_camel 13y ago

by ig1 13y ago

sillysaurus3 13y ago

The quote was so interesting that I went and found the source: http://ecorner.stanford.edu/1028.ect http://ecorner.stanford.edu/1028.ect Now there's this gem: "it was basically became clear that we either figure out how to beat the fraudsters or the fraudsters will take us under. And the company more or less refocused itself as a research entity towards figuring out innovative technological ways of destroying fraud in the Internet. And that alone could be the subject of an entire class or a series of classes so I will completely skip over all the cool technology we developed. Some of you might have seen stuff in the news, words like EOR or ELIA, all these tools that we've built. They're as cool as they sound. I could never tell you about them because they're very secret and they're still in use. But maybe if you want to hang out afterwards, I can tell you a little bit. But they're really cool and we did really figured out how to kill fraud. ... The submerged part of PayPal is this massive and very, very numerically-driven risk management system which allows us to instantaneously tell when you're moving money to someone else, with a very high degree of certainty whether the money you're moving is yours or you got it illegally and we might be on the hook later on to help the authorities investigate or retrieve the money, et cetera, et cetera." I simply must know. I'll never find out how Paypal killed fraud unless I ask HN right now, and I've got to know. So, with apologies for branching into a completely unrelated topic: What magic did Paypal invent in order to do all of those amazing things described above? How'd they kill fraud? What are the details of how the technology works? Is it still a closely guarded secret? Do they use some advanced statistical mathematics to detect fraud, or do they bruteforce the detection by providing massive quantities of data to the otherwise-dumb detector algorithm? What fascinates me is that they've come up with a way to detect fraud automatically, with no human input. There are false positives, which everyone here has probably had some terrible experiences with, but... Still, how did they train a computer to detect and freeze the very sophisticated and very subtle covert techniques of Russian mobster money launderers? Any info would be very much appreciated, especially citations / references for further reading on this topic.

patio11 13y ago
I didn't work in risk analysis at Paypal, but I have a passing interest in the field. A lot of it is much simpler than you think it is. Want a not-so-secret anti-fraud technique? If the billing address is Kansas and the IP is China, you probably shouldn't let that transaction go through. Really obnoxious for those of us who live overseas. Stupendously valuable, though. There exists a particular anti-fraud heuristic at a YC company. They shared it to me in confidence, because as soon as you know it exists, you can trivially avoid it. I mean trivially. It's apparently insanely effective, though, half because it has a really good handle on who it wants to frustrate and the other half because it's not in the literature at all and, as a consequence, the bad guys don't even know they have to avoid defenses in that class of algorithms. ("But that's security through obscurity!" Good recitation of the dogma, but can I point out to you "This was implemented, in actual computer code, and does in fact actually work?") There exist more complicated things you can do with machine learning. There also exist more complicated things you can do with heuristics. There also exist more complicated things you can do with live fraud teams. There is non-zero value to finding fraud even after it has happened, because shutting down the fraudulent accounts means you can either keep some horses in the barn or even, potentially, call some of the stolen ones back. An underappreciated angle of this is that you don't have to outrun the tiger, you just have to outrun your friend. You start getting dedicated adversarial interest as you approach the most lucrative weak link in the entire financial system. That was Paypal back in the day -- with a bullet. Even though no startup/bank/etc ships with perfect security, investing sufficiently in security means the guy that gets victimized is someone other than you. They either go bankrupt or have their problems burned away in cleansing fire. Then the cycle repeats. (One reason Bitcoin companies keep getting looted is that if you plot out "Amount we could conveniently steal" versus "Resources spent on defense in the last 6 months" for all companies in the financial sector there are a lot of dots representing Bitcoin companies which are isolated islands, and the sea is filled with sharks.) It's a fun field, for a certain perverse and high-stress definition of "fun." I'd probably have made a career in it, but found making and selling software (with just a wee bit of risk management/security/etc thrown in) to be more fulfilling.
- enraged_camel 13y ago