Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Candy Japan hit with credit card fraud

candyjapan.com

Post reply on HN
Print view View original

71–80 of 208 posts

Re: Candy Japan hit with credit card fraud

#71

Post by seszett »

SyneRyder wrote: post #39
chli wrote: post #27

Earlier quoted context omitted.

Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure I have to use it with most online shops here in Switzerland.

3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will fr…

Well, I used to be rather critical of 3D Secure until a few months ago. My wife's card (on our shared account) got compromised and a 300 euros or so payment was made with it. No 3D Secure enabled for her because she had not given her cell phone number to the bank.

Our bank refunded it alright, though it took about a month, but the next week I received an SMS with a 3D Secure confirmation number for a similar payment, in HKD, with my own card (by the way, the only place we used both cards for payments was Taobao). I was able to call my bank which blocked the card and quickly issued me a new one. At least in this case it both saved us, our bank and some unknown online shop, time and money.

Also, I think the smart way to do 3D Secure is what capitainetrain.com does, they use it only for the first payment of a customer (and explain what's going to happen during the payment process) and all subsequent purchases don't go through it (since the customer has already been verified as being legitimate). It only works when you expect customers to come back regularly, though.

Re: Candy Japan hit with credit card fraud

#72

Post by adrianmacneil »

jasontan wrote: post #61

We at Sift Science ( http://siftscience.com ) might be able to help. Feel free to email me at jason at siftscience dot com Even if you don't use us, we published some articles to help merchants new to dealing with fraud: * https://siftscience.com/sift-edu/fraud-basics * https://siftscience.com/sift-edu/prevent-fraud

Sift Science is a great service, I would highly recommend testing it out.

Re: Candy Japan hit with credit card fraud

#73

Post by DanBC »

Symbiote wrote: post #70
foota wrote: post #22

Earlier quoted context omitted.

I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")

> is there a way to require someone to enter the pin that they use when they buy something in person A PIN can be required for "cardholder present" transactions in most of the world. Some combination of card issuer, transaction processor and merchant decide at what value transactions may proceed without a PIN — e.g. a train company's actual loss from a fraudulent ride is very small, so they might not want the delay o…

> It's almost 100% of transactions in much of Europe

Unless the customer is using contactless payment card?

Re: Candy Japan hit with credit card fraud

#74

Post by bhelx »

alpb wrote: post #21

I wonder would that still be the case if Candy Japan was using something like Stripe or Balanced, what happens in that situation? Would you be still responsible for 15 EUR chargeback fee? What did Recurly do in this case?

This depends on the gateway you use. Recurly can't do much but refer you to the gateway in this case.

Re: Candy Japan hit with credit card fraud

#76

Post by WalterBright »

nchelluri wrote: post #2

Interestingly enough I found this subthread from an HN Post earlier today to be very relevant: https://news.ycombinator.com/item?id=10234561 > Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score…

I was using VeriSign for years. Then my site got hit with a "carding" [1] attack. VeriSign was simply not interested in helping with it, the merchant bank I had coupled it with was not interested either.

So I cancelled VeriSign and the merchant account, and use paypal and Amazon Payments instead.

I did make the rounds of a few banks, all were eager to set me up with a new merchant account. All gave me blank stares when I asked if they had any means of preventing carding attacks or other frauds.

[1] A carding attack is when there's an attempt to buy something for $0.00, just to see if it is rejected or not. I was getting one every minute or so. I got charged for every one of those, and so soon had racked up a grand in charges.

Re: Candy Japan hit with credit card fraud

#77

Post by jasontan »

adrianmacneil wrote: post #72
jasontan wrote: post #61

We at Sift Science ( http://siftscience.com ) might be able to help. Feel free to email me at jason at siftscience dot com Even if you don't use us, we published some articles to help merchants new to dealing with fraud: * https://siftscience.com/sift-edu/fraud-basics * https://siftscience.com/sift-edu/prevent-fraud

Sift Science is a great service, I would highly recommend testing it out.

Thanks for the kind words.

Re: Candy Japan hit with credit card fraud

#78

Post by PeterisP »

lordnacho wrote: post #47

I don't understand the search conversion statistic. If a guy is testing a bunch of cards, wouldn't he just find your site once and try them all sequentially? If a bunch of people had bought these packs of stolen cards, wouldn't they be spreading out over a bunch of different sites?

The automated scripts that the criminals use will try to simulate a real customer signup and transaction, otherwise it's too trivial to filter them out.

This is also why fraud detection is a big industry, you basically need full time staff to analyze the current types of fraudulent transactions and update your filters as fast as the criminals update their systems.

Re: Candy Japan hit with credit card fraud

#80

Post by bhelx »

stevoski wrote: post #51

I commented this on yesterday's jsbin article, and I'll write it again. Don't implement the payment processing code yourself. (And using Stripe is _still_ implementing it yourself - they supply only one part of the process.) Writing this code will take time that you are not using to develop and market your product. (cf opportunity cost). Your code will be buggy. Your code will be weak. Your code will not support the…

This is true but in this case he's not directly integrated (he's using Recurly). Better fraud tools is something we are actively working on.
Post reply on HN