Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Candy Japan hit with credit card fraud

candyjapan.com

Post reply on HN
Print view View original

111–120 of 208 posts

Re: Candy Japan hit with credit card fraud

#111

Post by kalleboo »

LeonM wrote: post #97
rplnt wrote: post #93

Earlier quoted context omitted.

Having visited NL, my card was practically useless. Any other country no problem, but Netherlands? So I don't understand you really. That being said, direct payment gateways are common, but they require cooperation with banks. There's probably hundreds of them and only make sense on local market where you can have on or two implemented to satisfy 80%+ of customers (and others will just use regular card).

That's the whole point, in the Netherlands we use debit cards (known as 'PIN cards' to the locals) instead of credit cards. Usually these are Maestro cards. I don't know the exact number, but as a Dutch resident I guess that >99% of all POS transactions are done using such card, not a credit card. Cashiers in most common shops probably don't even know how to accept a payment by credit card, so the'll just refuse. Mea…

In many countries (such as where I'm from, Sweden, or where I live now, Japan), debit cards and credit cards are interchangeable, and you can't even tell by looking at the card if it's debit or credit. They're both VISA or MasterCard branded, and what's backing it is only the business of the cardholder, not the merchant.

I remember Maestro cards in Sweden as being for under-18's, and then when you become an adult you get a VISA/MasterCard debit card instead, but I don't know if that's true anymore.

Re: Candy Japan hit with credit card fraud

#112

Post by germanier »

vacri wrote: post #29
frgewut wrote: post #23

Earlier quoted context omitted.

ZIP codes seem to be a US-specific thing.

ZIP codes are just a funny name for post codes, and most places have postcodes.

While many places have postcodes, most don't have postcode validation for credit card transactions. And it wouldn't really help to combat fraud anyway.

Re: Candy Japan hit with credit card fraud

#113

Post by ryanlol »

Unless there's some bug in your transaction processing system causing it to leak excessive amounts of data on why the transaction was denied it makes no sense for checkers to use it over their own merchant accounts.

(And typical checker traffic is more like thousands of transactions rather than tens)

It seems much much more likely that someone was just trying to card some candy.

Re: Candy Japan hit with credit card fraud

#114

Post by kalleboo »

foota wrote: post #22
Reason077 wrote: post #17

Earlier quoted context omitted.

Presumably, it would at least involve implementing "Verified by Visa", which protects online transactions by requiring a password or PIN. Mastercard and Amex have equivalent services, and these are all widely implemented by websites and card issuers in Europe and other countries. I suppose they are not so widely deployed in the USA or Japan, but at the very least, you'd protect yourself against fraud involving cards…

I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")

One of my banks requires me to enter my card in a physical card reader (and unlock the chip with the PIN) and validate the transaction by signing a nonce https://farm4.staticflickr.com/3237/2486214902_8feafd8200_b....

Re: Candy Japan hit with credit card fraud

#115

Post by mikkom »

Maarten88 wrote: post #83
stevoski wrote: post #51

I commented this on yesterday's jsbin article, and I'll write it again. Don't implement the payment processing code yourself. (And using Stripe is _still_ implementing it yourself - they supply only one part of the process.) Writing this code will take time that you are not using to develop and market your product. (cf opportunity cost). Your code will be buggy. Your code will be weak. Your code will not support the…

Living in Holland, where everyone does online transactions with iDeal, I find it hard to understand why the rest of the world is using credit card payments at all, for anything. It is massively insecure, it's expensive for the merchant, and theft is ignored (when millions of stored creditcard records are stolen, those cards are not invalidated and replaced?). This is all at the cost of customers and other merchants.…

> Living in Holland, where everyone does online transactions with iDeal, I find it hard to understand why the rest of the world is using credit card payments at all, for anything.

We do have both ideal type payments and credit card payments in Finland (I assume ideal is a direct bank payment to merchants account?)

I still personally always use credit card if possible as it gives the customer extra layer of security. For example in cases where you purchase something quite expensive let's say a holiday package if the company does not deliver the holiday, goes bankrupt etc you will get the money back with CC but NOT if you have paid directly via web bank payment form.

Same thing with online fraud, if you pay to fraudulent website it's going to be extremely hard to get your money back if you have paid it directly to scammers bank account.

Re: Candy Japan hit with credit card fraud

#116

Post by unclebucknasty »

bemmu wrote: post #105
veb wrote: post #28

Damn shame to hear about this Bemmu -- would've felt like a massive punch to your guts! Maybe you should set yourself up some email alerts when things seem 'off'. i.e. no referral, and the user/bot spends no time filling out the form and hitting submit. What's your glue code like? I'm rootin' for ya. :-)

Hey veb, This fraud would have been easy to detect if there had been any kind of detection system in place. But I had no fraud checking, captcha or 3-D secure, as I hadn't expected there to such a "fraud wave". Those payments didn't feel like necessarily coming from a bot, as there were time delays and for many purchases they even filled in the questionnaire. It felt more like someone had a pile of numbers they were…

>...they were entering manually

Definitely wouldn't discount that possibility. Unrelated to CC processing, but we used a service that gave us a device ID on signups to detect people signing up multiple times (a tipoff that fraud was likely to come).

We later found fraudsters were using Amazon's Mechanical Turk to get real people to register manually, thus getting around our device detection.

Re: Candy Japan hit with credit card fraud

#118

Post by Amezarak »

Reason077 wrote: post #54
SyneRyder wrote: post #39

Earlier quoted context omitted.

3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will fr…

These verification mechanisms don't freak people out once people are used to them. Pretty much anyone who uses credit cards to buy anything online in Europe will have encountered this system before and will be more suspicious if they don't see it! Using customers birthdate is indeed a very poor authentication mechanism, but even that is going to defeat the majority of fraudsters who are simply trying to bulk-authenti…

> My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc.

How can the bank know what any of the letters in your password are unless they are storing it insecurely?

Re: Candy Japan hit with credit card fraud

#119

Post by sspiff »

LeonM wrote: post #97
rplnt wrote: post #93

Earlier quoted context omitted.

Having visited NL, my card was practically useless. Any other country no problem, but Netherlands? So I don't understand you really. That being said, direct payment gateways are common, but they require cooperation with banks. There's probably hundreds of them and only make sense on local market where you can have on or two implemented to satisfy 80%+ of customers (and others will just use regular card).

That's the whole point, in the Netherlands we use debit cards (known as 'PIN cards' to the locals) instead of credit cards. Usually these are Maestro cards. I don't know the exact number, but as a Dutch resident I guess that >99% of all POS transactions are done using such card, not a credit card. Cashiers in most common shops probably don't even know how to accept a payment by credit card, so the'll just refuse. Mea…

Same is true for Belgium, though the Belgian infrastructure is a little more up to date (most terminals can accept credit cards, if the shop has payed for the quite expensive creditcard processing service with the company issuing the terminals): debit cards are the norm, credit cards are much less common.

Re: Candy Japan hit with credit card fraud

#120

Post by [deleted] »

kalleboo wrote: post #111
LeonM wrote: post #97

Earlier quoted context omitted.

That's the whole point, in the Netherlands we use debit cards (known as 'PIN cards' to the locals) instead of credit cards. Usually these are Maestro cards. I don't know the exact number, but as a Dutch resident I guess that >99% of all POS transactions are done using such card, not a credit card. Cashiers in most common shops probably don't even know how to accept a payment by credit card, so the'll just refuse. Mea…

In many countries (such as where I'm from, Sweden, or where I live now, Japan), debit cards and credit cards are interchangeable, and you can't even tell by looking at the card if it's debit or credit. They're both VISA or MasterCard branded, and what's backing it is only the business of the cardholder, not the merchant. I remember Maestro cards in Sweden as being for under-18's, and then when you become an adult you…

[deleted]
Post reply on HN