Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Candy Japan hit with credit card fraud

candyjapan.com

Post reply on HN
Print view View original

31–40 of 208 posts

Re: Candy Japan hit with credit card fraud

#31

Post by lifeisstillgood »

Osiris wrote: post #6
nchelluri wrote: post #2

Interestingly enough I found this subthread from an HN Post earlier today to be very relevant: https://news.ycombinator.com/item?id=10234561 > Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score…

This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this issue and recommend a fraud check service, or 2) include fraud protection in their service. I actually ran into an issue a little while ago in that I allowed my MaxMind account to run out of queries. Not realizing this, I saw a few days of higher than normal…

Let me say I vastly appreciate the honesty in your blog series having caught up just now. It's good to hear others have these worries and can learn - if painfully !

Good luck

Re: Candy Japan hit with credit card fraud

#32

Post by huhtenberg »

alpb wrote: post #21

I wonder would that still be the case if Candy Japan was using something like Stripe or Balanced, what happens in that situation? Would you be still responsible for 15 EUR chargeback fee? What did Recurly do in this case?

With Stripe you are still responsible for the chargeback fee, but they do not charge you for transactions that don't go through. They also have some fraud protection, but it did pass some obvious fraud in our case.

Re: Candy Japan hit with credit card fraud

#34

Post by sdrothrock »

peterhunt wrote: post #33

This is something we (www.smyte.com) can help out with -- send me an email at pete at smyte dot com if interested. Also happy to answer any questions about general mitigation techniques.

I tried to go to your site but am getting a 500 error.

Edit: Interestingly enough, www.smyte.com is fine, but smyte.com yields the 500 error.

Re: Candy Japan hit with credit card fraud

#35

Post by mootothemax »

peterhunt wrote: post #33

This is something we (www.smyte.com) can help out with -- send me an email at pete at smyte dot com if interested. Also happy to answer any questions about general mitigation techniques.

Your site appears to be down right now, otherwise I'd hunt for info there :)

What's the difference between you and Sift, and what advantages do you offer over them?

Edit: your T&Cs and privacy policy pages referring to a different site entirely don't exactly fill me with confidence :-/

Re: Candy Japan hit with credit card fraud

#38

Post by maemre »

Osiris wrote: post #6
nchelluri wrote: post #2

Interestingly enough I found this subthread from an HN Post earlier today to be very relevant: https://news.ycombinator.com/item?id=10234561 > Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score…

This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this issue and recommend a fraud check service, or 2) include fraud protection in their service. I actually ran into an issue a little while ago in that I allowed my MaxMind account to run out of queries. Not realizing this, I saw a few days of higher than normal…

> My ideal credit card would be on where the physical card has e-paper on it with a 6-digit PIN that changes periodically, like 2-factor auth, and that PIN could be required for purchases to be authenticated. The new smart-chip cards don't help at all with online purchases, only point of sale.

The banks and companies like Visa/MasterCard in Turkey use something called 3D Secure [1], in which you are directed to your bank's 3D secure page and enter a code that is sent to you via SMS and your CVC number so they have 2-factor auth. Most of the merchants I used in Turkey supported 3D Secure but I don't know the situation with other countries.

Banks in Turkey still support the processing system that is currently used worldwide however some banks have an option where you can cancel all non-3D-Secure online transactions.

Also the chip-and-PIN standard was conceived in 1990s AFAIK so the smart-chip cards are not new at all, they are just not adopted in some countries like US.

[1]: https://en.wikipedia.org/wiki/3-D_Secure

Re: Candy Japan hit with credit card fraud

#39

Post by SyneRyder »

chli wrote: post #27
Osiris wrote: post #6

Earlier quoted context omitted.

This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this issue and recommend a fraud check service, or 2) include fraud protection in their service. I actually ran into an issue a little while ago in that I allowed my MaxMind account to run out of queries. Not realizing this, I saw a few days of higher than normal…

Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure I have to use it with most online shops here in Switzerland.

3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate:

https://news.ycombinator.com/item?id=10235328

That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will freak some people out. Consider that some banks make the Verified By Visa password the customer's birthday (ie something easily researched) and you quickly realize it's a horrible system.

Re: Candy Japan hit with credit card fraud

#40

Post by stanleydrew »

This sucks and can often be a crippling blow for a small business if it's not caught early.

I remember we used to deal with a lot of this at Twilio, except the carders would then also try to cash out the credit card into Twilio credit. The pattern was try to spend $10 on a card, then one minute later try to spend $1000 once the first charge went through.

But it's a lot less costly than toll fraud, which I learned the hard way working on our auth system at https://charge.co.

Post reply on HN