I wonder would that still be the case if Candy Japan was using something like Stripe or Balanced, what happens in that situation? Would you be still responsible for 15 EUR chargeback fee? What did Recurly do in this case?
Candy Japan hit with credit card fraud
21–30 of 208 posts
Re: Candy Japan hit with credit card fraud
#22Earlier quoted context omitted.
From the article, it sounds like they are working in using an existing fraud detection service, would be interesting to see what goes into that sort of service.
Presumably, it would at least involve implementing "Verified by Visa", which protects online transactions by requiring a password or PIN. Mastercard and Amex have equivalent services, and these are all widely implemented by websites and card issuers in Europe and other countries. I suppose they are not so widely deployed in the USA or Japan, but at the very least, you'd protect yourself against fraud involving cards…
I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")
Re: Candy Japan hit with credit card fraud
#23Would verifying zip codes mitigate this issue, or do the carders have access to that too?
ZIP codes seem to be a US-specific thing.
Re: Candy Japan hit with credit card fraud
#24Currently we're integrating Sift Science to avoid this otherwise serious and annoying issue. I think it happens to everyone who's directly accepting credit cards online. Does anyone have experience with Sift Science or similar services? (I know MaxMind has one but that, to me, seems inferior to SS's.)
Came here to recommend a sift science type solution. I've previously integrated fraud systems like Cybersource (clunky interface, wouldn't recommend)
Re: Candy Japan hit with credit card fraud
#25Interestingly enough I found this subthread from an HN Post earlier today to be very relevant: https://news.ycombinator.com/item?id=10234561 > Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score…
This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this issue and recommend a fraud check service, or 2) include fraud protection in their service. I actually ran into an issue a little while ago in that I allowed my MaxMind account to run out of queries. Not realizing this, I saw a few days of higher than normal…
Since pro accounts initially cost £6 for month, it turns
out that this is low enough that it won't send red flags
to stolen cards
Edit: more importantly I never even thought Inwoukd need to implement fraud detection - is there a primer on "things you never thought of when selling on line - from VATMOSS to Vampires"?
Re: Candy Japan hit with credit card fraud
#26Interestingly enough I found this subthread from an HN Post earlier today to be very relevant: https://news.ycombinator.com/item?id=10234561 > Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score…
This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this issue and recommend a fraud check service, or 2) include fraud protection in their service. I actually ran into an issue a little while ago in that I allowed my MaxMind account to run out of queries. Not realizing this, I saw a few days of higher than normal…
>all of my fraudulent purchases came from Vietnam to the point that at one time I put in an IPTABLES rule to block the entire country.
I can never work this out; it seems that scammers from different countries (or using hacked servers / proxies?) are attracted to different sites or types of ecommerce sites.
For example:
- One of my sites has huge fraud from Ukraine and Russia
- Another from Indonesia
- Another's problem country is Pakistan
I typically use https://siftscience.com to identify fraud, plus country-level blocks where it makes sense.
Damned shame that all the legitimate users from a given country get blocked thanks to the fraudsters!
Re: Candy Japan hit with credit card fraud
#27Interestingly enough I found this subthread from an HN Post earlier today to be very relevant: https://news.ycombinator.com/item?id=10234561 > Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score…
This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this issue and recommend a fraud check service, or 2) include fraud protection in their service. I actually ran into an issue a little while ago in that I allowed my MaxMind account to run out of queries. Not realizing this, I saw a few days of higher than normal…
Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure
I have to use it with most online shops here in Switzerland.
Re: Candy Japan hit with credit card fraud
#28Damn shame to hear about this Bemmu -- would've felt like a massive punch to your guts!
Maybe you should set yourself up some email alerts when things seem 'off'. i.e. no referral, and the user/bot spends no time filling out the form and hitting submit. What's your glue code like?
I'm rootin' for ya. :-)
Re: Candy Japan hit with credit card fraud
#29Re: Candy Japan hit with credit card fraud
#30Interestingly enough I found this subthread from an HN Post earlier today to be very relevant: https://news.ycombinator.com/item?id=10234561 > Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score…
Osiris' info was useful. I really also need to put in some fraud detection like that. But there are so many companies providing that service, I'm not sure which one to go with. How involved is it to integrate these? It's not my idea of fun to try look at these transactions manually, so until I get a motivation boost to go through with the integration it'll probably be PayPal-only.
>I'm not sure which one to go with. How involved is it to integrate these?
I really like https://siftscience.com.
The important thing is to not over-think things; it's rarely that case that you truly, honestly, really need real-time automated fraud detection.
Start with implementing the absolute bare minimum. You'll then receive emails from e.g. Sift when a bad user is identified, and you can manually refund the transaction, cancel the order, and block the user.