8 ms·

Fraudsters tend to make multiple accounts on their laptop or phone to commit fraud. Any idea how this can be tracked? Normal cookies, or something more in-dept

Fraudsters tend to make multiple accounts on their laptop or phone to commit fraud. Any idea how this can be tracked? Normal cookies, or something more in-depth? A site I'm working on tracks page visits independently of logged-in user sessions. I'm wondering if it's worth considering explicitly looking for multiple logged-in users sharing the same page visit session. There are various tricks - e.g. Flash cookies, Etags etc - that make me feel a bit uneasy, despite how much I like the idea of tracking multiple accounts per device.

dthakur 12y ago
You might find this paper about fingerprinting useful https://www.cosic.esat.kuleuven.be/fpdetective/ https://www.cosic.esat.kuleuven.be/fpdetective/
diminoten 12y ago
User-Agent strings are pretty good ways of tracking devices, I believe.
- velodrome 12y ago
  Not really. You can spoof user agents...
  - diminoten 12y ago
    You can spoof anything.
    - rjaco31 12y ago
      You can't really spoof IP address if you want any kind of two-way interaction
      - diminoten 12y ago
        Oh yeah you can. It's not simple, but you very much can.
        jdong 12y ago
        Not in the real world.
personZ 12y ago
It sounds like users of this service are essentially sharing data with each via siftscience (e.g. bad credit cards, shipping addresses, etc). I considered exactly this business model years ago, but considered it a complete non-starter due to privacy and proprietary information reasons. I could be completely misreading this, but it does seem like a lot of the value is not just in each customer's data in isolation, but comparing it against the growing volume of shared data.
coops 12y ago
This is generally known as "device fingerprinting"--there are many ways to do it but they all involve probing for unique properties of a client via JS / Flash (listing installed fonts, drawing invisible characters and measuring via JS, etc.), then hashing them together to generate a unique ID for that user. Some people think this practice violates users' privacy, and I'm one of them. This technology can be used to uniquely identify a user across multiple logins on the same site, or even multiple sites. It's quite widespread. This paper[0] is mostly a survey of prominent DF providers and sites using this technology, and it's also a good primer on device fingerprinting techniques. [0] http://www.cosic.esat.kuleuven.be/publications/article-2334.pdf http://www.cosic.esat.kuleuven.be/publications/article-2334....
- mootothemax 12y ago
  This is generally known as "device fingerprinting" Is this definitely how it's achieved though? I would presume a highly-skilled fraudster could just spin up a new VM, for instance, and evade detection that way. Do we know if "regular" cookies alone are good enough for 90% of the lazy fraudsters? Regarding using "device fingerprinting," can I collect some opinions from HN? Specifically, if every user record created stores a fingerprint alongside it (which is only used to find account registrations from the same device) is that just as offensive as using fingerprinting to track anonymous sessions?
  - coops 12y ago
    Consider that if you collect device fingerprints, you can detect users who live together, because they are likely to share devices. If somebody bad then gets access to that data, they could do creepy things to your users.
  - pyduan 12y ago
    > I would presume a highly-skilled fraudster could just spin up a new VM, for instance, and evade detection that way. From my experience building fraud detection systems at Eventbrite most fraudsters are not that sophisticated -- fraudsters usually go for the lowest-hanging fruit and as such are looking for systems to defraud that have the highest payout for the lowest effort. Because there is always some level of uncertainty (getting detected, the credit card not working, etc.) fraudsters often favor techniques that allow them to try as many websites/cards as possible. This is especially true for Sift Science's customers who tend to be more small to mid-size companies; big companies for whom fraud detection is critical will tend to have their own in-house solution. In addition this is usually only one signal -- ideally you want your algorithm to be able to detect first-time fraudsters too, so the other signals should be able to stand on their own. One caveat though, the reason why multiple accounts is a signal of fraud is because fraudsters tend to be repeat offenders, and will keep defrauding the same website if their previous attempts worked. But now that they're facing a fraud detection algorithms that detects repeat offenders more easily, it's highly possible they will adapt their behavior. This is a signal that will fade out in strength over time, and one of the dangers of pooling together data from multiple websites as in this blog post (but hopefully this is taken into account in their algorithms) is that the strength of the signal may be skewed by the proportion of new users of their platform (who will have a higher proportion of unsophisticated fraudsters by nature of they not having a fraud detection system previously). This is why whenever you are building a fraud detection algorithm (or any machine learning algorithm that's consumer facing) understanding the story behind the data is very important, and not just looking at the numbers.
JohnTHaller 12y ago
You can track it in-browser with cookies. You can track it in-browser and have it remain when the user clears cookies with offline storage. You can track it in-browser and cross browser on the same PC and have it remain when the user clears cookies with flash cookies. When a user logs out, you can store the account fingerprint used in all 3 of those places and maintain it as another account logs in. Combine them all and it's pretty effective.
- shawnz 12y ago
  Even more techniques here: http://samy.pl/evercookie/ http://samy.pl/evercookie/
deleted 12y ago
[deleted]
x0x0 12y ago
a relatively privacy friendly way is to compare accounts to ip addresses. You obviously expect there to be some nat-ing going on but it should be relatively constant over time. That is, if in your entire network you've seen, say, 10 accounts from a given ip and all of a sudden 5 accounts interact with a given shop, it's probably fraudulent. You can monitor characteristics the browser reports, including user agent strings. You can use techniques like differences in rendering of canvas drawings to images to fingerprint browsers. In fact, I'd bet good money this is a great signal: what you're trying to do is not fingerprint, but detect when the reported user-agent has been overridden. Few people override user-agents. Then you can go on to ways to bury identifiers in browsers. For example, etags on cached objects may be ok if you aren't using it for advertising and clear it in your privacy guidelines. You can also fingerprint with time deltas, though this may be patented. Briefly: computers synchronize to milliseconds, I think. If you are careful, you can probably detect sub-millisecond clock skew between a client and your server. This should not be constant across devices. etc etc etc
- TheLoneWolfling 12y ago
  ...And then you start flagging businesses, ISPs, even entire countries as fraudulent. The number of NATs there are make that sort of correlation... difficult. For that matter, there are people that use UA "spoofing" for non-nefarious purposes. Me, for one.
  - x0x0 12y ago
    um, no you don't, and yes i've done something similar before While I'm sure there are valid reasons for ua spoofing, I'd bet it's a great signal for fraud.
  - thaumasiotes 12y ago
    Speaking as someone who's spent a lot of time in China... flagging entire countries as fraudulent isn't the end of some ridiculous slippery slope -- it's a thriving practice today. I have to hide my IP address to interact with the internet in almost any interesting way.

dthakur 12y ago

You might find this paper about fingerprinting useful https://www.cosic.esat.kuleuven.be/fpdetective/ https://www.cosic.esat.kuleuven.be/fpdetective/

diminoten 12y ago

User-Agent strings are pretty good ways of tracking devices, I believe.

velodrome 12y ago
Not really. You can spoof user agents...
- diminoten 12y ago
  You can spoof anything.
  - rjaco31 12y ago
    You can't really spoof IP address if you want any kind of two-way interaction
    - diminoten 12y ago
      Oh yeah you can. It's not simple, but you very much can.
      - jdong 12y ago
        Not in the real world.

personZ 12y ago

It sounds like users of this service are essentially sharing data with each via siftscience (e.g. bad credit cards, shipping addresses, etc). I considered exactly this business model years ago, but considered it a complete non-starter due to privacy and proprietary information reasons. I could be completely misreading this, but it does seem like a lot of the value is not just in each customer's data in isolation, but comparing it against the growing volume of shared data.

coops 12y ago

This is generally known as "device fingerprinting"--there are many ways to do it but they all involve probing for unique properties of a client via JS / Flash (listing installed fonts, drawing invisible characters and measuring via JS, etc.), then hashing them together to generate a unique ID for that user. Some people think this practice violates users' privacy, and I'm one of them. This technology can be used to uniquely identify a user across multiple logins on the same site, or even multiple sites. It's quite widespread. This paper[0] is mostly a survey of prominent DF providers and sites using this technology, and it's also a good primer on device fingerprinting techniques. [0] http://www.cosic.esat.kuleuven.be/publications/article-2334.pdf http://www.cosic.esat.kuleuven.be/publications/article-2334....

mootothemax 12y ago
This is generally known as "device fingerprinting" Is this definitely how it's achieved though? I would presume a highly-skilled fraudster could just spin up a new VM, for instance, and evade detection that way. Do we know if "regular" cookies alone are good enough for 90% of the lazy fraudsters? Regarding using "device fingerprinting," can I collect some opinions from HN? Specifically, if every user record created stores a fingerprint alongside it (which is only used to find account registrations from the same device) is that just as offensive as using fingerprinting to track anonymous sessions?
- coops 12y ago
  Consider that if you collect device fingerprints, you can detect users who live together, because they are likely to share devices. If somebody bad then gets access to that data, they could do creepy things to your users.
- pyduan 12y ago
  > I would presume a highly-skilled fraudster could just spin up a new VM, for instance, and evade detection that way. From my experience building fraud detection systems at Eventbrite most fraudsters are not that sophisticated -- fraudsters usually go for the lowest-hanging fruit and as such are looking for systems to defraud that have the highest payout for the lowest effort. Because there is always some level of uncertainty (getting detected, the credit card not working, etc.) fraudsters often favor techniques that allow them to try as many websites/cards as possible. This is especially true for Sift Science's customers who tend to be more small to mid-size companies; big companies for whom fraud detection is critical will tend to have their own in-house solution. In addition this is usually only one signal -- ideally you want your algorithm to be able to detect first-time fraudsters too, so the other signals should be able to stand on their own. One caveat though, the reason why multiple accounts is a signal of fraud is because fraudsters tend to be repeat offenders, and will keep defrauding the same website if their previous attempts worked. But now that they're facing a fraud detection algorithms that detects repeat offenders more easily, it's highly possible they will adapt their behavior. This is a signal that will fade out in strength over time, and one of the dangers of pooling together data from multiple websites as in this blog post (but hopefully this is taken into account in their algorithms) is that the strength of the signal may be skewed by the proportion of new users of their platform (who will have a higher proportion of unsophisticated fraudsters by nature of they not having a fraud detection system previously). This is why whenever you are building a fraud detection algorithm (or any machine learning algorithm that's consumer facing) understanding the story behind the data is very important, and not just looking at the numbers.

JohnTHaller 12y ago

You can track it in-browser with cookies. You can track it in-browser and have it remain when the user clears cookies with offline storage. You can track it in-browser and cross browser on the same PC and have it remain when the user clears cookies with flash cookies. When a user logs out, you can store the account fingerprint used in all 3 of those places and maintain it as another account logs in. Combine them all and it's pretty effective.

shawnz 12y ago
Even more techniques here: http://samy.pl/evercookie/ http://samy.pl/evercookie/

deleted 12y ago

[deleted]

x0x0 12y ago

a relatively privacy friendly way is to compare accounts to ip addresses. You obviously expect there to be some nat-ing going on but it should be relatively constant over time. That is, if in your entire network you've seen, say, 10 accounts from a given ip and all of a sudden 5 accounts interact with a given shop, it's probably fraudulent. You can monitor characteristics the browser reports, including user agent strings. You can use techniques like differences in rendering of canvas drawings to images to fingerprint browsers. In fact, I'd bet good money this is a great signal: what you're trying to do is not fingerprint, but detect when the reported user-agent has been overridden. Few people override user-agents. Then you can go on to ways to bury identifiers in browsers. For example, etags on cached objects may be ok if you aren't using it for advertising and clear it in your privacy guidelines. You can also fingerprint with time deltas, though this may be patented. Briefly: computers synchronize to milliseconds, I think. If you are careful, you can probably detect sub-millisecond clock skew between a client and your server. This should not be constant across devices. etc etc etc

TheLoneWolfling 12y ago
...And then you start flagging businesses, ISPs, even entire countries as fraudulent. The number of NATs there are make that sort of correlation... difficult. For that matter, there are people that use UA "spoofing" for non-nefarious purposes. Me, for one.
- x0x0 12y ago
  um, no you don't, and yes i've done something similar before While I'm sure there are valid reasons for ua spoofing, I'd bet it's a great signal for fraud.
- thaumasiotes 12y ago
  Speaking as someone who's spent a lot of time in China... flagging entire countries as fraudulent isn't the end of some ridiculous slippery slope -- it's a thriving practice today. I have to hide my IP address to interact with the internet in almost any interesting way.