12 ms·

Seven habits of highly fraudulent users

390 points by necubi 12y ago

wdewind 12y ago
I love these. Building fraud detection systems is so funny because the signals themselves end up usually being really simple, it's just a matter of: a) Having the tools to look at all your data to see where the patterns are b) Having the tools to track instances of patterns once you've identified them. But as I said, the patterns themselves are usually pretty simple, as you see in this article. This one is a bit specific to Justworks since we use bank account numbers instead of credit card numbers, but one we've picked up is the source of the bank account is a great signal. If a company has bank accounts exclusively from certain banks then they are almost certainly fraudulent. We've even seen people try to sign up with consecutive bank account numbers from the same banks!
- aestra 12y ago
  This goes for other industries as well. For example every insurance claim from any insurance company is run through fraud detection software. Turns out there are some characteristics of a fraudulent insurance claims that have been identified over the years. The software can flag a claim as potentially fraudulent for further human review. Discover Card's fraud detection worked extremely well in my case. My CC number was stolen and after only two fraudulent transactions (total about $500) it tripped the software to freeze the card. I have no idea how they identified those as fraud so quickly, they didn't seem out of place to my eyes considering my transaction history.
  - Mz 12y ago
    For example every insurance claim from any insurance company is run through fraud detection software. Turns out there are some characteristics of a fraudulent insurance claims that have been identified over the years. The software can flag a claim as potentially fraudulent for further human review. I worked for an insurance company for over 5 years, processing claims. This is the first I have ever heard this. Which does not prove it to be untrue but does make me skeptical. We had some claims automatically paid via computer but most claims were reviewed by human eyes. Humans were trained to look for indicators of fraud. There was no one thing that would get it sent to the fraud department for investigation. We were looking for a pattern or multiple indicators.
    - aestra 12y ago
      >We had some claims automatically paid via computer but most claims were reviewed by human eyes. Humans were trained to look for indicators of fraud. There was no one thing that would get it sent to the fraud department for investigation. We were looking for a pattern or multiple indicators. Oh, I'm never saying that claims get paid automatically or that humans don't look for fraud too. I'm saying that there is also software on the back end that flags things to go to the fraud department automatically. Probably without your knowledge. I just remember reading an article about it a while ago - just about how good it has gotten over the years and it has become an important part of the insurance industry. Just another example of extensive data mining. When I say "every insurance claim from any insurance company" I mean that I assume any insurance company worth anything would be running such software. Found some products: http://www.csc.com/p_and_c_general_insurance/offerings/26121/57633-fraud_detection_software_fraud_prevention_via_analytics http://www.csc.com/p_and_c_general_insurance/offerings/26121... http://www.sas.com/en_us/industry/insurance/fraud-framework.html http://www.sas.com/en_us/industry/insurance/fraud-framework.... AllState implies they do. http://www.allstate.com/claims/fight-fraud.aspx http://www.allstate.com/claims/fight-fraud.aspx >Through the use of innovative technologies and network analysis tools, we are able to help detect and stop these crimes
      - Mz 12y ago
        Ok. But I think you are still misinformed --> For example every insurance claim from any insurance company is run through fraud detection software. From digging around, this seems kind of a new trend. I seriously doubt that "every claim at any insurance company" is being analyzed this way. And, sure, it's possible it was in use at the company where I worked and I simply did not know. But from reading some of what you linked to, I doubt it. (Though perhaps that has changed since I left.) From one of the sites you linked to: "Industry research indicates 10 percent of all claims contain an element of fraud," says Wolfe, and as of the end of 2010, CNA was seeing just 3.7 percent of its claims referred as potential fraud. "That’s considerably below the industry average, and we wanted to find out how much we were missing that wasn’t identified by our adjustors." So, yeah, that's relatively recent and the searches I did sort of imply that this is an emerging market, they are still trying to convince insurance companies to do this, etc. Insurance is a very conservative industry. They tend to be somewhat slow to adopt new technologies. They are regulated by both federal laws that cover financial companies and also federal laws that cover medical companies (like HIPAA). So they have a huge regulatory burden and this makes change especially hard. Any new tech or new processes have to really be put through their paces to see if they still pass muster on multiple fronts. The de facto result is that insurance companies are kind of sticks in the mud. Where I worked, a lot of the software was homegrown. It had been developed in-house. They didn't like hiring outside vendors/buying outside solutions. From what I gather, they were fairly cutting edge -- though, of course, it is possible that was just company hype. Since I worked there, I sometimes knew that some statements amounted to spin-doctoring. But I did only have an entry level job and was not really expecting it to turn into a career, so I am sure there is plenty that I missed. Thanks for replying.
  - superuser2 12y ago
    Sometimes the pattern only exists in data writ large. For example, a particular merchant is breached, and then the fraudsters try to run most of the cards stolen in that breach at a few locations. It could be obvious on your bank's end that a few dozen customers made a charge at Store A and then reported a charge at Store B to be fraudulent, so then they decided to freeze the cards of everyone with the same Store A -> Store B pattern.
    - aestra 12y ago
      Great point.
  - NoMoreNicksLeft 12y ago
    Quite possibly, they saw the same item purchased 5 times within minutes, all off of other Discover cards. You'd only see the transaction that used your number.
  - x0x0 12y ago
    I've heard that good signals are things like small gas purchases at a gas station you haven't been to before; they're used to test card validity at a pay-station with no human present.
    - meowface 12y ago
      This has been such a common signature for fraud over the years that I'd be surprised if many fraudsters are still doing this. If they were smart they'd buy a chocolate bar from a grocery store that has self-checkout, then buy something a little more expensive from Target or whatever, then buy the very expensive thing they really want.
      - Estragon 12y ago
        What's the purpose of the target purchase?
        tatterdemalion 12y ago
        I think because it masks the "tiny purchase -> giant purchase" signal that is used to detect fraud?
        Estragon 12y ago
        Ah, thanks.
        x0x0 12y ago
        a guess: probing the available balance. Presumably, you only get a couple shots at the apple store to buy that laptop because a single person isn't going to be able to try 5 cards with different names on them in a row without the police being called.
  - keithpeter 12y ago
    Do you tend to go shopping for a given product at the same kind of times/days? E.g. for me clothes shopping is on Saturday or Sunday. Do you tend to go to certain physical locations or use a limited number of Web sites to buy from? Just guessing.
    - aestra 12y ago
      Nope! My spending habits are kinda random and I travel a lot.
- andreyg 12y ago
  Disclaimer: I work here. Thanks @wdewind! We do too. We had a field day playing with the data. We actually have thousands of features and these are just some of the most simple signals. We're really careful not to disclose some of our more complex (and powerful) ones - but I can say that we statistically model patterns such as position of digits in email address, page visit sequence, etc.
ChuckMcM 12y ago
This was a great read. You know what fraudsters search for ? Vulnerable PHP web sites and sites with anonymous logins. Its kind of amazing. I would imagine that if you could take all of these signals and geo-track them back to the originating IP you would be able to illuminate fraud tolerant ISPs[1], and fraud schemes and targets. Sure its a big data problem but it seems imminently tractable if local vendors provide fraud detection data to central source. [1] You could notify ISPs of their hosting fraudlent traffic and if they continue to host it ...
- devicenull 12y ago
  Getting consumer ISPs to respond to obvious abuse cases (DDOS attacks) is very difficult. Getting them to respond to fraud (which they'd have to investigate more then looking at a bandwidth graph) seems impossible. Now throw a language barrier on top, and it's even more difficult. Hell, getting accurate abuse contact information is a project all by itself.
- deleted 12y ago
  [deleted]
josu 12y ago
>Habit #2: Fraudsters Are Night Owls Are they using local time? Or is there a chance that they are not accounting for the fact that most of the fraudsters are foreign and in a different time zone?
- deleted 12y ago
  [deleted]
- wdewind 12y ago
  I believe they mean the SiftSciences customer's time, not the hacker's time. They are proposing that fraudsters tend to hit in the middle of the night based on where the target is hosted, not where they are.
  - AnimalMuppet 12y ago
    If the targets were US-based, this could fit with the "fraudsters are international" finding.
- necubi 12y ago
  All times are local to the user (as inferred by IP geolocation).
- pbhjpbhj 12y ago
  Or maybe fraudsters route their traffic through international tunnels to make law enforcement activity more difficult?
deleted 12y ago
[deleted]
- frandroid 12y ago
  That's why they said it's only one of many signals one should look for, and not to block transactions on that symptom alone.
- sliverstorm 12y ago
  Spam handling is all about weights. Attachment? I won't block you for that, but I'll give you a point. Valid domain? I won't accept you for that, but I'll subtract a half point. Then at the end you throw the message away if the sum total of the points passes some threshold "X" Counting digits in an envelope sender would just be one more metric. I do some blacklisting, but 99% of the time blacklisting on one fuzzy metric is seen as extremely bad practice in mail.
valarauca1 12y ago
A while ago I really wanted to build a bot farm, not to do anything particular malicious (farm reddit upvotes and push content to the front page). Now this post feels like its encouraging me too.
- ary 12y ago
  > A while ago I really wanted to build a bot farm, not to do anything particular malicious (farm reddit upvotes and push content to the front page). You and I have very different definitions of the word "malicious".
  - newaccountfool 12y ago
    Hmmm,I wouldn't say it was malicious as long as there was no legal activity created by it.
- opendais 12y ago
  Vote manipulation to acquire attention is malicious.
  - jotm 12y ago
    Tell that to the hundreds (thousands?) of SEO and PR agencies around the world that offer this same service...
    - forgottenpass 12y ago
      What? Tell them they're sleazeballs? Already ahead of you on that. They don't want to hear it and usually have a lame rationalization that lets them sleep at night.
    - opendais 12y ago
      Its tens of thousands. And depending on how they go about it, it is. You are, however, comparing apples and oranges. Building a bot net vs. sending out a press release is very different things. Please look into Black Hat vs. White Hat SEO. You do something different with your property is OK. Manipulating other people's property through directly bypassing the countermeasures they have in place isn't OK.
mootothemax 12y ago
Fraudsters tend to make multiple accounts on their laptop or phone to commit fraud. Any idea how this can be tracked? Normal cookies, or something more in-depth? A site I'm working on tracks page visits independently of logged-in user sessions. I'm wondering if it's worth considering explicitly looking for multiple logged-in users sharing the same page visit session. There are various tricks - e.g. Flash cookies, Etags etc - that make me feel a bit uneasy, despite how much I like the idea of tracking multiple accounts per device.
- dthakur 12y ago
  You might find this paper about fingerprinting useful https://www.cosic.esat.kuleuven.be/fpdetective/ https://www.cosic.esat.kuleuven.be/fpdetective/
- diminoten 12y ago
  User-Agent strings are pretty good ways of tracking devices, I believe.
  - velodrome 12y ago
    Not really. You can spoof user agents...
    - diminoten 12y ago
      You can spoof anything.
      - rjaco31 12y ago
        You can't really spoof IP address if you want any kind of two-way interaction
        diminoten 12y ago
        Oh yeah you can. It's not simple, but you very much can.
mynewwork 12y ago
Ghostery blocks access to the content due to how they're doing a redirect. I wonder if that's intentional, was one of the seven habits users who block trackers?
gojomo 12y ago
Seems they should be keeping these signals secret.
- dublinben 12y ago
  These traits aren't unknown to anyone who is processing credit card transactions and keeping an eye out for fraud. It's pretty clear that they don't consider them trade secrets either, or they wouldn't be sharing.
woodchuck64 12y ago
Fascinating. I can't get over why Fraudsters Go Hungry. Rampant speculation: they're used to eating in front of a computer screen, they're doing what they love so no reason to do anything differently during lunch hour, they're shut-ins and socially inept. International nerds, male, unmarried, above average IQ but didn't get into the top Indian/Russian/Chinese universities so making a living and finding meaning hacking into America.
- Zikes 12y ago
  The "mechanical turk" style fraudster setups probably rely more on getting desperate, unemployed people to work in regions so scarcely regulated that lunch breaks aren't even expected.
- wtracy 12y ago
  Or a large portion of them could just be bots.
dm2 12y ago
It's interesting that gmail is the least likely used for fraud, why is that? Can't anybody create multiple gmail accounts? VPN traffic would also be an interesting metric.
- codygman 12y ago
  IIRC you have to do text message validation. If not I believe the amount of messages you can send are under 50. However these things change over time, and I believe at one point (maybe now) you couldn't make a gmail account without text verification. Feel free to correct me if my memory is wrong because it very well could be.
  - NoMoreNicksLeft 12y ago
    At one point I was thinking about setting up a tv channel for VLC... you can write a lua script to let VLC extract video urls from a webpage. So I'd use Tor/bitcoin to get hosting somewhere, put up a simple page for that purpose, and use Youtube to host the videos. You need Google accounts though, lots of them (Google would suspend them quickly, after all). The solution I considered was paying people in Africa to sign up for gmail for me, and I'd pay them per account. I figured I'd only need 50-100 per month, so the low volume might make it possible. They often have smartphones, and amounts that are too low for you to bother with might be a decent payday for them for 5 minutes work. Now, I know what you're going to say... Youtube detects copyrighted works, won't let you upload them. That part was easy. Just invert the video color, and flip it upside down. Then the lua script for VLC would de-invert and unflip it. And I could even bring in the audio from another site (VLC allows muxing), since Youtube uses audio signatures more than they do video signatures for that stuff. I had a prototype going for awhile. Called it "Space Potato Channel". It just played videos others had uploaded (wrote a little backend to schedule movies). If you tuned in 5 minutes late, it'd show the video 5 minutes in, etc. Then I learned about how the NSA was giving tips to law enforcement and doing the parallel reconstruction thing, and I reconsidered my scheme to become a bitcoin millionaire. Long story short, gmail accounts were never something I thought would be much of a problem.
    - 12y ago
IgorPartola 12y ago
The night owl thing is misinterpreting the data. I am going to guess that the more likely scenario is that at 3am there are simply less total transactions, while fraudulent transactions stay at more or less the same level. Looking at a total volume of fraudulent transactions vs the hour or the day would be more helpful. Another prediction: "fraudsters work on weekends" would yield the same graph if displayed as a percentage of total transactions. Edit: http://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statistics http://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statisti...
- pyduan 12y ago
  It's also partly due to them tending to be more international, meaning they are more likely to live in a different timezone. The "outside of business hours" explanation is still a valid explanation but definitely not the whole story. Overall, I'd caution that when building fraud detection models understanding the stories behind the data is extremely important, or you risk having an algorithm that works for the wrong reasons. For example, if suddenly your user base because more international (for example if you start allowing non-US users to use your website), you'll suddenly have a lot of false positives if you're not cautious because to your system it'll look like they're "operating outside of business hours".
  - x0x0 12y ago
    The graphs say local time; I interpreted that to mean ip-address local time.
    - true_religion 12y ago
      It may just be that they use US proxies. I did when I was overseas.
  - grier 12y ago
    It's also only a good signal as long as you aren't actioning on it. As soon as it becomes advantageous enough to fit in with the normal user patterns, the attackers will modify their behavior accordingly. The time-of-day, internationality, and many other signals mentioned in this post are easily evaded when it becomes profitable to do so.
bitL 12y ago
LOL, I am hitting most of these for completely different reasons and never attempted nor plan to attempt a fraud. I guess another overreaching application of statistics (it must be because confidence intervals say so and our prediction model agrees!). It resembles to me the saying that all murderers eat bread, so bread is dangerous!!! I really hate oversimplifications in these serious matters. It happened to me that my bank was using a similar silly algorithm to consistently block my credit card during my world travel every time I arrived to a new country/airport, even if I told them about it in advance. A way to lose customer for life for sure, especially when their emergency line operates only during working days between 9am-6pm in Germany...
- Zikes 12y ago
  The article clearly says that these factors are not to be taken individually, but in addition to hundreds or thousands of others.
- asdfologist 12y ago
  Not sure what your point is. Every model, be it human or automatic/statistical, is by definition a "simplification" and is going to have some false positives and negatives. Having these flaws doesn't make the entire model useless.
romaniv 12y ago
These articles always seem to imply that you can use those traits for detection. Can you? I mean, the numbers and wording imply that you can, but some of the stats are not very clear or intuitive. For example, just because group X usually doesn't eat lunch doesn't mean that not eating lunch is a good trait to detect them in the general population. Also, 6% of outlook.com is used for fraud? This is a huge percentage. How does this company detect multiple accounts on the device?
- lilsunnybee 12y ago
  I think they mean 6% of the email addresses used for fraudulent transactions were outlook.com addresses, at least in the data they were analyzing. 6% of fraud perpetrators use outlook.com is a much different statistic than 6% of outlook.com users commit fraud.
- roel_v 12y ago
  Only only 'you can', it is being done by thousands of companies across the world every second. (not these properties directly, just building a statistical model of fraudulent users and comparing transactions to that model to flag potentially fraudulent transactions - in wire transfers, online purchases, credit card use, ...)
excitom 12y ago
The drawback to services like this is that they are great at hindsight (Aha! Based on the signals we should have known!) but bad at prediction. Take the example of Doral, FL that they offer; it has 8X higher fraud. But, should you avoid Doral customers? No. Should you avoid people who use forwarding services? No. But if you're scammed, you can look back and say "I should have known!"
- x0x0 12y ago
  If a scam works once, it will probably be tried again. Even if you are correct, there is probably value in simply detecting similar scams. Plus, if sift's network is big enough, a given business will be protected against scams that hit other businesses.
johnchristopher 12y ago
> outlook > Some of the most fraudulent email domains are operated by Microsoft. Why could this be? Two possible reasons are that 1) Microsoft has been around for a lot longer and 2) email addresses were easier to create back in the day. Today, websites use challenge responses such as image verification or two-factor authentication to verify your legitimate identity. But outlook.com is the most recent Microsoft web mail domain. Why is it already much more used than other Microsoft web mail domains (hotmail, live, etc.) ?
- josh2600 12y ago
  Go to hotmail.com and look at the login portal.
  - phaemon 12y ago
    So what? The mail server name has practically nothing to do with the email address. The address is still @hotmail.com. He makes a valid point: why did @outlook.com addresses suddenly become used for scamming?
    - chatmasta 12y ago
      Here's a possibility: - - - - @outlook.com is a relatively new email domain (< 2 years) - - - - Most people buying online are over age 18 - - - - Most people do not change their email address - - - - Most people over the age of 18 have had their email address longer than two years So, by that logic, if someone has a @outlook.com email address, there are a few possibilities: - - - - They had an old email address, but switched/forwarded it to @outlook.com sometime in the last 2 years (unlikely - generally people don't suddenly change their email) - - - - They made an @outlook.com address for ecommerce signups (unlikely - why not use your current provider e.g. Gmail?) - - - - This is their first email account (unlikely) - - - - They registered it to commit fraud (hmmmm) Obviously this is all speculation and there are exceptions to all those assumptions, but it seems logical that the last option is more likely than the others, especially shen weighted by the fact that fraudsters almost always create more than one email account.
    - 12y ago
alexsmolen 12y ago
This is interesting and well-informed, but it's important to remember that fraud is an adversarial problem. The bad guys will change their behavior to evade detection. The habits described here may exist when there is no defense in place, but if you use them to detect fraud, you'll likely see shifts in behavior to appear more "normal" and evade detection.
gordon_freeman 12y ago
Pretty interesting insights. Though in Habit #6: "Fraudsters Are Really Boring" : the digits in email addresses appear pretty obvious (non-fraudster) to me. We need to remember that there are 600 million + email accounts registered with Gmail for example and it is really difficult to increase your chance of creating new email ID without using any digit(s) while registering your email address. I myself use email address with 2 digits and I have so many of my friends using 4 digits or so. I personally don't think having more digits in your email ID is directly proportional to being more fraudulent.
- skeoh 12y ago
  I would say that while there can be legitimate email addresses with multiple digits, and fraudulent email addresses with no digits, neither of these facts precludes the possibility of a correlation.
  - gordon_freeman 12y ago
    that's exactly my point. Looking at this habit of "email address with multiple digits" alone seems correlation rather than causation. Making an anti-fraud algorithm by including all or most of these habits might point to causation and help solve the problem though.
- robmccoll 12y ago
  Also, that distribution doesn't scream "relevant correlation" to me. The bins are different sizes.
  - gordon_freeman 12y ago
    Yep. I don't understand how having 1 digit in one's email ID makes him more fraudulent than someone whose email ID consists of 2 digits. :-o
    - wastedhours 12y ago
      Anecdotal of course, but I and a few friends/family I've seen used to have email addresses (when I was younger) with two digits representing birth year (like, something85), whereas I can't think of a reason I'd use only one...
RevRal 12y ago
I'm pretty impressed with how the header and side bar operate on this site. Enlarge/zoom the page and the sidebar becomes the header. I'd like to know how this is achieved.
- skeoh 12y ago
  The website has a responsive design [0], which adapts to the available viewport. It looks like this one was implemented with Bootstrap [1]. [0]: http://en.wikipedia.org/wiki/Responsive_web_design http://en.wikipedia.org/wiki/Responsive_web_design [1]: http://getbootstrap.com/ http://getbootstrap.com/)
  - joshmlewis 12y ago
    I want to point out that this commenting style is very good. You provided helpful answers, looked into the original question, and then provided sources. More people should comment like this.
  - RevRal 12y ago
    Thank you for the information :).
contingencies 12y ago
The Four Habits of Highly Silicon-Valley Startups. 1. Put something that doesn't belong there in the cloud. 2. Make undue generalizations about its applicability to third party businesses of which you have limited understanding. 3. Fake growth by dubious means, such as ramping up 'customers' (even if none of them actually use your service on an ongoing basis), hiring extensively, and waylaying all business processes to cater toward visible progress at investment rounds. 4. Spend almost as much on marketing as development.
owenversteeg 12y ago
Argh, that's not how you use an <abbr> element! (in "Fraudsters are really boring")
minusSeven 12y ago
I doubt how much the data can used as an overall generalization. They should analyse the pattern and go little more deeper. And what is exact meaning of fraudulent user here ?
koyote 12y ago
So Microsoft domains account for the highest amount of fraud? Maybe a third-party should seize hotmail and outlook.com in order to clean it up for them...
- aytekin 12y ago
  Those domains are more popular in countries where fraud is higher.
  - wldcordeiro 12y ago
    The OP was referring to how Microsoft seized domains from another company under the guise of security.
jacquesm 12y ago
I've built a system like this recently and most of these are supported by the analysis I made. Even so, there are many more signals possible than the ones listed here and only in the aggregate can you use any of this, a single signal is never strong enough to distinguish between fraud and friend. False positives will always happen, no matter how many signals you throw into the mix, there will always be exceptions. Even so the difference between running with a system like this and being wide open is like day and night.
joering2 12y ago
Outlook is seriously broken! 10 minutes after creating an account, my spam mailbox had already 20 messages. I don't believe that spammers are mailing every possible combination of a username; there must be some leak or other way. Also it seems that Microsoft gave up on verifying whether your message is spam or not. I had government emails (USPS, for example) as well as emails from my gmail and yahoo friends landing straight in junk.
jfasi 12y ago
Is it just me, or did they really just fit a quintic curve to theirs "Fraudsters are Sneaky" plot? There had better be a good reason for their using such a high-dimensional polynomial.
- sks 12y ago
  It may be a non parametric estimate. My guess is that they used loess (https://en.wikipedia.org/wiki/Local_regression https://en.wikipedia.org/wiki/Local_regression).
jdong 12y ago
This makes the ridiculous assumption that fraudsters don't use proxies, they do.

390 points by necubi 12y ago

I love these. Building fraud detection systems is so funny because the signals themselves end up usually being really simple, it's just a matter of: a) Having the tools to look at all your data to see where the patterns are b) Having the tools to track instances of patterns once you've identified them. But as I said, the patterns themselves are usually pretty simple, as you see in this article. This one is a bit specific to Justworks since we use bank account numbers instead of credit card numbers, but one we've picked up is the source of the bank account is a great signal. If a company has bank accounts exclusively from certain banks then they are almost certainly fraudulent. We've even seen people try to sign up with consecutive bank account numbers from the same banks!

aestra 12y ago
This goes for other industries as well. For example every insurance claim from any insurance company is run through fraud detection software. Turns out there are some characteristics of a fraudulent insurance claims that have been identified over the years. The software can flag a claim as potentially fraudulent for further human review. Discover Card's fraud detection worked extremely well in my case. My CC number was stolen and after only two fraudulent transactions (total about $500) it tripped the software to freeze the card. I have no idea how they identified those as fraud so quickly, they didn't seem out of place to my eyes considering my transaction history.
- Mz 12y ago
  For example every insurance claim from any insurance company is run through fraud detection software. Turns out there are some characteristics of a fraudulent insurance claims that have been identified over the years. The software can flag a claim as potentially fraudulent for further human review. I worked for an insurance company for over 5 years, processing claims. This is the first I have ever heard this. Which does not prove it to be untrue but does make me skeptical. We had some claims automatically paid via computer but most claims were reviewed by human eyes. Humans were trained to look for indicators of fraud. There was no one thing that would get it sent to the fraud department for investigation. We were looking for a pattern or multiple indicators.
  - aestra 12y ago
    >We had some claims automatically paid via computer but most claims were reviewed by human eyes. Humans were trained to look for indicators of fraud. There was no one thing that would get it sent to the fraud department for investigation. We were looking for a pattern or multiple indicators. Oh, I'm never saying that claims get paid automatically or that humans don't look for fraud too. I'm saying that there is also software on the back end that flags things to go to the fraud department automatically. Probably without your knowledge. I just remember reading an article about it a while ago - just about how good it has gotten over the years and it has become an important part of the insurance industry. Just another example of extensive data mining. When I say "every insurance claim from any insurance company" I mean that I assume any insurance company worth anything would be running such software. Found some products: http://www.csc.com/p_and_c_general_insurance/offerings/26121/57633-fraud_detection_software_fraud_prevention_via_analytics http://www.csc.com/p_and_c_general_insurance/offerings/26121... http://www.sas.com/en_us/industry/insurance/fraud-framework.html http://www.sas.com/en_us/industry/insurance/fraud-framework.... AllState implies they do. http://www.allstate.com/claims/fight-fraud.aspx http://www.allstate.com/claims/fight-fraud.aspx >Through the use of innovative technologies and network analysis tools, we are able to help detect and stop these crimes
    - Mz 12y ago
      Ok. But I think you are still misinformed --> For example every insurance claim from any insurance company is run through fraud detection software. From digging around, this seems kind of a new trend. I seriously doubt that "every claim at any insurance company" is being analyzed this way. And, sure, it's possible it was in use at the company where I worked and I simply did not know. But from reading some of what you linked to, I doubt it. (Though perhaps that has changed since I left.) From one of the sites you linked to: "Industry research indicates 10 percent of all claims contain an element of fraud," says Wolfe, and as of the end of 2010, CNA was seeing just 3.7 percent of its claims referred as potential fraud. "That’s considerably below the industry average, and we wanted to find out how much we were missing that wasn’t identified by our adjustors." So, yeah, that's relatively recent and the searches I did sort of imply that this is an emerging market, they are still trying to convince insurance companies to do this, etc. Insurance is a very conservative industry. They tend to be somewhat slow to adopt new technologies. They are regulated by both federal laws that cover financial companies and also federal laws that cover medical companies (like HIPAA). So they have a huge regulatory burden and this makes change especially hard. Any new tech or new processes have to really be put through their paces to see if they still pass muster on multiple fronts. The de facto result is that insurance companies are kind of sticks in the mud. Where I worked, a lot of the software was homegrown. It had been developed in-house. They didn't like hiring outside vendors/buying outside solutions. From what I gather, they were fairly cutting edge -- though, of course, it is possible that was just company hype. Since I worked there, I sometimes knew that some statements amounted to spin-doctoring. But I did only have an entry level job and was not really expecting it to turn into a career, so I am sure there is plenty that I missed. Thanks for replying.
- superuser2 12y ago
  Sometimes the pattern only exists in data writ large. For example, a particular merchant is breached, and then the fraudsters try to run most of the cards stolen in that breach at a few locations. It could be obvious on your bank's end that a few dozen customers made a charge at Store A and then reported a charge at Store B to be fraudulent, so then they decided to freeze the cards of everyone with the same Store A -> Store B pattern.
  - aestra 12y ago
    Great point.
- NoMoreNicksLeft 12y ago
  Quite possibly, they saw the same item purchased 5 times within minutes, all off of other Discover cards. You'd only see the transaction that used your number.
- x0x0 12y ago
  I've heard that good signals are things like small gas purchases at a gas station you haven't been to before; they're used to test card validity at a pay-station with no human present.
  - meowface 12y ago
    This has been such a common signature for fraud over the years that I'd be surprised if many fraudsters are still doing this. If they were smart they'd buy a chocolate bar from a grocery store that has self-checkout, then buy something a little more expensive from Target or whatever, then buy the very expensive thing they really want.
    - Estragon 12y ago
      What's the purpose of the target purchase?
      - tatterdemalion 12y ago
        I think because it masks the "tiny purchase -> giant purchase" signal that is used to detect fraud?
        Estragon 12y ago
        Ah, thanks.
      - x0x0 12y ago
        a guess: probing the available balance. Presumably, you only get a couple shots at the apple store to buy that laptop because a single person isn't going to be able to try 5 cards with different names on them in a row without the police being called.
- keithpeter 12y ago
  Do you tend to go shopping for a given product at the same kind of times/days? E.g. for me clothes shopping is on Saturday or Sunday. Do you tend to go to certain physical locations or use a limited number of Web sites to buy from? Just guessing.
  - aestra 12y ago
    Nope! My spending habits are kinda random and I travel a lot.
andreyg 12y ago
Disclaimer: I work here. Thanks @wdewind! We do too. We had a field day playing with the data. We actually have thousands of features and these are just some of the most simple signals. We're really careful not to disclose some of our more complex (and powerful) ones - but I can say that we statistically model patterns such as position of digits in email address, page visit sequence, etc.

ChuckMcM 12y ago

This was a great read. You know what fraudsters search for ? Vulnerable PHP web sites and sites with anonymous logins. Its kind of amazing. I would imagine that if you could take all of these signals and geo-track them back to the originating IP you would be able to illuminate fraud tolerant ISPs[1], and fraud schemes and targets. Sure its a big data problem but it seems imminently tractable if local vendors provide fraud detection data to central source. [1] You could notify ISPs of their hosting fraudlent traffic and if they continue to host it ...

devicenull 12y ago
Getting consumer ISPs to respond to obvious abuse cases (DDOS attacks) is very difficult. Getting them to respond to fraud (which they'd have to investigate more then looking at a bandwidth graph) seems impossible. Now throw a language barrier on top, and it's even more difficult. Hell, getting accurate abuse contact information is a project all by itself.
deleted 12y ago
[deleted]

josu 12y ago

>Habit #2: Fraudsters Are Night Owls Are they using local time? Or is there a chance that they are not accounting for the fact that most of the fraudsters are foreign and in a different time zone?

deleted 12y ago
[deleted]
wdewind 12y ago
I believe they mean the SiftSciences customer's time, not the hacker's time. They are proposing that fraudsters tend to hit in the middle of the night based on where the target is hosted, not where they are.
- AnimalMuppet 12y ago
  If the targets were US-based, this could fit with the "fraudsters are international" finding.
necubi 12y ago
All times are local to the user (as inferred by IP geolocation).
pbhjpbhj 12y ago
Or maybe fraudsters route their traffic through international tunnels to make law enforcement activity more difficult?

deleted 12y ago

[deleted]

frandroid 12y ago
That's why they said it's only one of many signals one should look for, and not to block transactions on that symptom alone.
sliverstorm 12y ago
Spam handling is all about weights. Attachment? I won't block you for that, but I'll give you a point. Valid domain? I won't accept you for that, but I'll subtract a half point. Then at the end you throw the message away if the sum total of the points passes some threshold "X" Counting digits in an envelope sender would just be one more metric. I do some blacklisting, but 99% of the time blacklisting on one fuzzy metric is seen as extremely bad practice in mail.

valarauca1 12y ago

A while ago I really wanted to build a bot farm, not to do anything particular malicious (farm reddit upvotes and push content to the front page). Now this post feels like its encouraging me too.

ary 12y ago
> A while ago I really wanted to build a bot farm, not to do anything particular malicious (farm reddit upvotes and push content to the front page). You and I have very different definitions of the word "malicious".
- newaccountfool 12y ago
  Hmmm,I wouldn't say it was malicious as long as there was no legal activity created by it.
opendais 12y ago
Vote manipulation to acquire attention is malicious.
- jotm 12y ago
  Tell that to the hundreds (thousands?) of SEO and PR agencies around the world that offer this same service...
  - forgottenpass 12y ago
    What? Tell them they're sleazeballs? Already ahead of you on that. They don't want to hear it and usually have a lame rationalization that lets them sleep at night.
  - opendais 12y ago
    Its tens of thousands. And depending on how they go about it, it is. You are, however, comparing apples and oranges. Building a bot net vs. sending out a press release is very different things. Please look into Black Hat vs. White Hat SEO. You do something different with your property is OK. Manipulating other people's property through directly bypassing the countermeasures they have in place isn't OK.

mootothemax 12y ago

Fraudsters tend to make multiple accounts on their laptop or phone to commit fraud. Any idea how this can be tracked? Normal cookies, or something more in-depth? A site I'm working on tracks page visits independently of logged-in user sessions. I'm wondering if it's worth considering explicitly looking for multiple logged-in users sharing the same page visit session. There are various tricks - e.g. Flash cookies, Etags etc - that make me feel a bit uneasy, despite how much I like the idea of tracking multiple accounts per device.

dthakur 12y ago
You might find this paper about fingerprinting useful https://www.cosic.esat.kuleuven.be/fpdetective/ https://www.cosic.esat.kuleuven.be/fpdetective/
diminoten 12y ago
User-Agent strings are pretty good ways of tracking devices, I believe.
- velodrome 12y ago
  Not really. You can spoof user agents...
  - diminoten 12y ago
    You can spoof anything.
    - rjaco31 12y ago
      You can't really spoof IP address if you want any kind of two-way interaction
      - diminoten 12y ago
        Oh yeah you can. It's not simple, but you very much can.

mynewwork 12y ago

Ghostery blocks access to the content due to how they're doing a redirect. I wonder if that's intentional, was one of the seven habits users who block trackers?

gojomo 12y ago

Seems they should be keeping these signals secret.

dublinben 12y ago
These traits aren't unknown to anyone who is processing credit card transactions and keeping an eye out for fraud. It's pretty clear that they don't consider them trade secrets either, or they wouldn't be sharing.

woodchuck64 12y ago

Fascinating. I can't get over why Fraudsters Go Hungry. Rampant speculation: they're used to eating in front of a computer screen, they're doing what they love so no reason to do anything differently during lunch hour, they're shut-ins and socially inept. International nerds, male, unmarried, above average IQ but didn't get into the top Indian/Russian/Chinese universities so making a living and finding meaning hacking into America.

Zikes 12y ago
The "mechanical turk" style fraudster setups probably rely more on getting desperate, unemployed people to work in regions so scarcely regulated that lunch breaks aren't even expected.
wtracy 12y ago
Or a large portion of them could just be bots.

dm2 12y ago

It's interesting that gmail is the least likely used for fraud, why is that? Can't anybody create multiple gmail accounts? VPN traffic would also be an interesting metric.

codygman 12y ago
IIRC you have to do text message validation. If not I believe the amount of messages you can send are under 50. However these things change over time, and I believe at one point (maybe now) you couldn't make a gmail account without text verification. Feel free to correct me if my memory is wrong because it very well could be.
- NoMoreNicksLeft 12y ago
  At one point I was thinking about setting up a tv channel for VLC... you can write a lua script to let VLC extract video urls from a webpage. So I'd use Tor/bitcoin to get hosting somewhere, put up a simple page for that purpose, and use Youtube to host the videos. You need Google accounts though, lots of them (Google would suspend them quickly, after all). The solution I considered was paying people in Africa to sign up for gmail for me, and I'd pay them per account. I figured I'd only need 50-100 per month, so the low volume might make it possible. They often have smartphones, and amounts that are too low for you to bother with might be a decent payday for them for 5 minutes work. Now, I know what you're going to say... Youtube detects copyrighted works, won't let you upload them. That part was easy. Just invert the video color, and flip it upside down. Then the lua script for VLC would de-invert and unflip it. And I could even bring in the audio from another site (VLC allows muxing), since Youtube uses audio signatures more than they do video signatures for that stuff. I had a prototype going for awhile. Called it "Space Potato Channel". It just played videos others had uploaded (wrote a little backend to schedule movies). If you tuned in 5 minutes late, it'd show the video 5 minutes in, etc. Then I learned about how the NSA was giving tips to law enforcement and doing the parallel reconstruction thing, and I reconsidered my scheme to become a bitcoin millionaire. Long story short, gmail accounts were never something I thought would be much of a problem.
  - 12y ago

IgorPartola 12y ago

The night owl thing is misinterpreting the data. I am going to guess that the more likely scenario is that at 3am there are simply less total transactions, while fraudulent transactions stay at more or less the same level. Looking at a total volume of fraudulent transactions vs the hour or the day would be more helpful. Another prediction: "fraudsters work on weekends" would yield the same graph if displayed as a percentage of total transactions. Edit: http://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statistics http://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statisti...

pyduan 12y ago
It's also partly due to them tending to be more international, meaning they are more likely to live in a different timezone. The "outside of business hours" explanation is still a valid explanation but definitely not the whole story. Overall, I'd caution that when building fraud detection models understanding the stories behind the data is extremely important, or you risk having an algorithm that works for the wrong reasons. For example, if suddenly your user base because more international (for example if you start allowing non-US users to use your website), you'll suddenly have a lot of false positives if you're not cautious because to your system it'll look like they're "operating outside of business hours".
- x0x0 12y ago
  The graphs say local time; I interpreted that to mean ip-address local time.
  - true_religion 12y ago
    It may just be that they use US proxies. I did when I was overseas.
- grier 12y ago
  It's also only a good signal as long as you aren't actioning on it. As soon as it becomes advantageous enough to fit in with the normal user patterns, the attackers will modify their behavior accordingly. The time-of-day, internationality, and many other signals mentioned in this post are easily evaded when it becomes profitable to do so.

bitL 12y ago

LOL, I am hitting most of these for completely different reasons and never attempted nor plan to attempt a fraud. I guess another overreaching application of statistics (it must be because confidence intervals say so and our prediction model agrees!). It resembles to me the saying that all murderers eat bread, so bread is dangerous!!! I really hate oversimplifications in these serious matters. It happened to me that my bank was using a similar silly algorithm to consistently block my credit card during my world travel every time I arrived to a new country/airport, even if I told them about it in advance. A way to lose customer for life for sure, especially when their emergency line operates only during working days between 9am-6pm in Germany...

Zikes 12y ago
The article clearly says that these factors are not to be taken individually, but in addition to hundreds or thousands of others.
asdfologist 12y ago
Not sure what your point is. Every model, be it human or automatic/statistical, is by definition a "simplification" and is going to have some false positives and negatives. Having these flaws doesn't make the entire model useless.

romaniv 12y ago

These articles always seem to imply that you can use those traits for detection. Can you? I mean, the numbers and wording imply that you can, but some of the stats are not very clear or intuitive. For example, just because group X usually doesn't eat lunch doesn't mean that not eating lunch is a good trait to detect them in the general population. Also, 6% of outlook.com is used for fraud? This is a huge percentage. How does this company detect multiple accounts on the device?

lilsunnybee 12y ago
I think they mean 6% of the email addresses used for fraudulent transactions were outlook.com addresses, at least in the data they were analyzing. 6% of fraud perpetrators use outlook.com is a much different statistic than 6% of outlook.com users commit fraud.
roel_v 12y ago
Only only 'you can', it is being done by thousands of companies across the world every second. (not these properties directly, just building a statistical model of fraudulent users and comparing transactions to that model to flag potentially fraudulent transactions - in wire transfers, online purchases, credit card use, ...)

excitom 12y ago

The drawback to services like this is that they are great at hindsight (Aha! Based on the signals we should have known!) but bad at prediction. Take the example of Doral, FL that they offer; it has 8X higher fraud. But, should you avoid Doral customers? No. Should you avoid people who use forwarding services? No. But if you're scammed, you can look back and say "I should have known!"

x0x0 12y ago
If a scam works once, it will probably be tried again. Even if you are correct, there is probably value in simply detecting similar scams. Plus, if sift's network is big enough, a given business will be protected against scams that hit other businesses.

johnchristopher 12y ago

> outlook > Some of the most fraudulent email domains are operated by Microsoft. Why could this be? Two possible reasons are that 1) Microsoft has been around for a lot longer and 2) email addresses were easier to create back in the day. Today, websites use challenge responses such as image verification or two-factor authentication to verify your legitimate identity. But outlook.com is the most recent Microsoft web mail domain. Why is it already much more used than other Microsoft web mail domains (hotmail, live, etc.) ?

josh2600 12y ago
Go to hotmail.com and look at the login portal.
- phaemon 12y ago
  So what? The mail server name has practically nothing to do with the email address. The address is still @hotmail.com. He makes a valid point: why did @outlook.com addresses suddenly become used for scamming?
  - chatmasta 12y ago
    Here's a possibility: - - - - @outlook.com is a relatively new email domain (< 2 years) - - - - Most people buying online are over age 18 - - - - Most people do not change their email address - - - - Most people over the age of 18 have had their email address longer than two years So, by that logic, if someone has a @outlook.com email address, there are a few possibilities: - - - - They had an old email address, but switched/forwarded it to @outlook.com sometime in the last 2 years (unlikely - generally people don't suddenly change their email) - - - - They made an @outlook.com address for ecommerce signups (unlikely - why not use your current provider e.g. Gmail?) - - - - This is their first email account (unlikely) - - - - They registered it to commit fraud (hmmmm) Obviously this is all speculation and there are exceptions to all those assumptions, but it seems logical that the last option is more likely than the others, especially shen weighted by the fact that fraudsters almost always create more than one email account.
  - 12y ago

alexsmolen 12y ago

This is interesting and well-informed, but it's important to remember that fraud is an adversarial problem. The bad guys will change their behavior to evade detection. The habits described here may exist when there is no defense in place, but if you use them to detect fraud, you'll likely see shifts in behavior to appear more "normal" and evade detection.

gordon_freeman 12y ago

Pretty interesting insights. Though in Habit #6: "Fraudsters Are Really Boring" : the digits in email addresses appear pretty obvious (non-fraudster) to me. We need to remember that there are 600 million + email accounts registered with Gmail for example and it is really difficult to increase your chance of creating new email ID without using any digit(s) while registering your email address. I myself use email address with 2 digits and I have so many of my friends using 4 digits or so. I personally don't think having more digits in your email ID is directly proportional to being more fraudulent.

skeoh 12y ago
I would say that while there can be legitimate email addresses with multiple digits, and fraudulent email addresses with no digits, neither of these facts precludes the possibility of a correlation.
- gordon_freeman 12y ago
  that's exactly my point. Looking at this habit of "email address with multiple digits" alone seems correlation rather than causation. Making an anti-fraud algorithm by including all or most of these habits might point to causation and help solve the problem though.
robmccoll 12y ago
Also, that distribution doesn't scream "relevant correlation" to me. The bins are different sizes.
- gordon_freeman 12y ago
  Yep. I don't understand how having 1 digit in one's email ID makes him more fraudulent than someone whose email ID consists of 2 digits. :-o
  - wastedhours 12y ago
    Anecdotal of course, but I and a few friends/family I've seen used to have email addresses (when I was younger) with two digits representing birth year (like, something85), whereas I can't think of a reason I'd use only one...

RevRal 12y ago

I'm pretty impressed with how the header and side bar operate on this site. Enlarge/zoom the page and the sidebar becomes the header. I'd like to know how this is achieved.

skeoh 12y ago
The website has a responsive design [0], which adapts to the available viewport. It looks like this one was implemented with Bootstrap [1]. [0]: http://en.wikipedia.org/wiki/Responsive_web_design http://en.wikipedia.org/wiki/Responsive_web_design [1]: http://getbootstrap.com/ http://getbootstrap.com/)
- joshmlewis 12y ago
  I want to point out that this commenting style is very good. You provided helpful answers, looked into the original question, and then provided sources. More people should comment like this.
- RevRal 12y ago
  Thank you for the information :).

contingencies 12y ago

The Four Habits of Highly Silicon-Valley Startups. 1. Put something that doesn't belong there in the cloud. 2. Make undue generalizations about its applicability to third party businesses of which you have limited understanding. 3. Fake growth by dubious means, such as ramping up 'customers' (even if none of them actually use your service on an ongoing basis), hiring extensively, and waylaying all business processes to cater toward visible progress at investment rounds. 4. Spend almost as much on marketing as development.

owenversteeg 12y ago

Argh, that's not how you use an <abbr> element! (in "Fraudsters are really boring")

minusSeven 12y ago

I doubt how much the data can used as an overall generalization. They should analyse the pattern and go little more deeper. And what is exact meaning of fraudulent user here ?

koyote 12y ago

So Microsoft domains account for the highest amount of fraud? Maybe a third-party should seize hotmail and outlook.com in order to clean it up for them...

aytekin 12y ago
Those domains are more popular in countries where fraud is higher.
- wldcordeiro 12y ago
  The OP was referring to how Microsoft seized domains from another company under the guise of security.

jacquesm 12y ago

I've built a system like this recently and most of these are supported by the analysis I made. Even so, there are many more signals possible than the ones listed here and only in the aggregate can you use any of this, a single signal is never strong enough to distinguish between fraud and friend. False positives will always happen, no matter how many signals you throw into the mix, there will always be exceptions. Even so the difference between running with a system like this and being wide open is like day and night.

joering2 12y ago

Outlook is seriously broken! 10 minutes after creating an account, my spam mailbox had already 20 messages. I don't believe that spammers are mailing every possible combination of a username; there must be some leak or other way. Also it seems that Microsoft gave up on verifying whether your message is spam or not. I had government emails (USPS, for example) as well as emails from my gmail and yahoo friends landing straight in junk.

jfasi 12y ago

Is it just me, or did they really just fit a quintic curve to theirs "Fraudsters are Sneaky" plot? There had better be a good reason for their using such a high-dimensional polynomial.

sks 12y ago
It may be a non parametric estimate. My guess is that they used loess (https://en.wikipedia.org/wiki/Local_regression https://en.wikipedia.org/wiki/Local_regression).

jdong 12y ago

This makes the ridiculous assumption that fraudsters don't use proxies, they do.