Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Candy Japan hit with credit card fraud

candyjapan.com

Post reply on HN
Print view View original

151–160 of 208 posts

Re: Candy Japan hit with credit card fraud

#151

Post by pc86 »

germanier wrote: post #110
bemmu wrote: post #103

Earlier quoted context omitted.

Also I need recurring payments. Not sure if those would be possible with ELV / iDEAL.

For ELV sure. That's the German implementation of SEPA direct debit (which should work almost everywhere in Europe). You can even charge different amount each time, provided you inform the customer before you attempt to charge. For example, I pay my electricity and phone bills by this system, just like my purchases on Amazon and almost everything else that is provided by German companies (just like most people). Don'…

I have a SaaS app that has only US customers at the moment but I would love to be able to offer this type of support and begin acquiring European customers. Do you have any recommendations of services that handle this ELV/SEPA/iDEAL type of integration?

Re: Candy Japan hit with credit card fraud

#152

Post by imjk »

fredleblanc wrote: post #104

I also had something like this happen on a site I built for my wife's work's site, a Boys & Girls Club[0]. I had a donation button that let people make an open donation to the club. It's such a tiny site with little traffic, but apparently the SEO must be decent because somehow it got targeted by people appearing to come through Brazil and Poland. Suddenly one day, hundreds of donation attempts. Checking the failed t…

How can they not be willing to pay a transaction fee from even PayPal for donations? Seems their options right now is to take donations via a service like Paypal with a transaction fee, or just take no donation.

Re: Candy Japan hit with credit card fraud

#153

Post by scurvy »

The one-time card numbers generated by the old AMEX Blue system were great for shopping on sites you didn't trust. Too bad that they dumped that and the card reader system around 2002-2003? I really liked it and felt much more confident using it. Seems like it would have cut down on fraud a lot more than many systems in use.

That said, I really don't know why anyone would want to try and write their own payment integration gateways nowadays. There are so many good alternatives out there. Why not use them? You should focus on what you love, not payment processing. If you're just selling simple goods, you can easily setup a store on Shopify, Weebly, WIX, etc. Let them handle the fraud stuff. Sure, you might be on the hook for a few bad charges here and there, but at least you didn't waste hours writing payment code.

Re: Candy Japan hit with credit card fraud

#154

Post by pc86 »

Maarten88 wrote: post #83
stevoski wrote: post #51

I commented this on yesterday's jsbin article, and I'll write it again. Don't implement the payment processing code yourself. (And using Stripe is _still_ implementing it yourself - they supply only one part of the process.) Writing this code will take time that you are not using to develop and market your product. (cf opportunity cost). Your code will be buggy. Your code will be weak. Your code will not support the…

Living in Holland, where everyone does online transactions with iDeal, I find it hard to understand why the rest of the world is using credit card payments at all, for anything. It is massively insecure, it's expensive for the merchant, and theft is ignored (when millions of stored creditcard records are stolen, those cards are not invalidated and replaced?). This is all at the cost of customers and other merchants.…

There are many reasons to use credit cards, and some of what you said is just not accurate:

- The vast majority (probably 95%+) of cards have rewards built in. Everything from miles to redeem on travel and accommodations to the most common being cash back credited against your account. These can range anywhere from 1% to 5% outside of special promotions where you typically get even more.

- They offer increased consumer protection in the form of warranties on items you buy in addition to the manufacturer's warranty.

- They offer increased consumer protection in the handling of charge backs, fraud prevention and being able to easily dispute charges (typically online).

- Of course if a card is stolen the number is invalidated and the physical card replaced - I don't know where you got the idea that this doesn't happen.

- None of this is at direct cost to the customer - assuming you pay off your statement balance prior to the due date, you are not charged interest and unless you have a card with an annual fee (most do not and if you have even decent credit it's trivial to upgrade to a card without one) all these features are free.

Re: Candy Japan hit with credit card fraud

#155

Post by sbov »

germanier wrote: post #132
emodendroket wrote: post #128

Earlier quoted context omitted.

> That's the reason they recommended to use a payment gateway that implements all those local payment solutions. For example, in Germany you loose a lot of customers if you don't offer direct debit (ELV) as many don't own a credit card (and don't want to). I can't imagine wanting to give out my bank details to allow direct debit of my account to every online retailer I do business with. Weird.

Not too different from giving out your credit card number. I can reverse any direct debit online with two clicks and a second-factor authentication. Disputing a credit card transaction here on the other hand requires filling out a form, signing it on paper, sending it via post, and waiting for the response.

Very different in the US.

US consumer protection laws treat credit and debit cards differently. They favor credit cards. The gap between the two is up to the goodwill of your bank.

I prefer to rely on law than goodwill. I have never had a problem with getting a refund on a credit card charge I claimed was fraud.

I have no idea why people choose to use a debit card over a credit card here.

Re: Candy Japan hit with credit card fraud

#156

Post by pc86 »

imjk wrote: post #152
fredleblanc wrote: post #104

I also had something like this happen on a site I built for my wife's work's site, a Boys & Girls Club[0]. I had a donation button that let people make an open donation to the club. It's such a tiny site with little traffic, but apparently the SEO must be decent because somehow it got targeted by people appearing to come through Brazil and Poland. Suddenly one day, hundreds of donation attempts. Checking the failed t…

How can they not be willing to pay a transaction fee from even PayPal for donations? Seems their options right now is to take donations via a service like Paypal with a transaction fee, or just take no donation.

You would be surprised at how unreasonable people can be once you start talking about taking a percentage of money they get (be it donations or business revenue or something else).

It's the financial equivalent of having a tumor that will kill you and refusing the surgery because the doctor says you have a chance of dying on the table.

Re: Candy Japan hit with credit card fraud

#157

Post by bhelx »

djm_ wrote: post #88
bhelx wrote: post #80

Earlier quoted context omitted.

This is true but in this case he's not directly integrated (he's using Recurly). Better fraud tools is something we are actively working on.

Would it be possible to give us a better ETA on when something is likely to be implemented? I was thinking of using recurly and this has put me off somewhat.

I'm an engineer so I can't really give you an ETA in public. You could certainly talk to one of our sales or product people about it.

The thing you need to remember is that you do have options. If you choose a gateway with good fraud tools, or a gateway that integrates with them, we upstream that information to you. Traditionally Recurly has left fraud up to the gateway because they are much better at dealing with it, but we are now seeing the need to offer some more professional fraud tools by default at the Recurly level.

Feel free to email me if you want to have a discussion about it: ben@recurly.com

Re: Candy Japan hit with credit card fraud

#158

Post by michaelt »

mattmanser wrote: post #94
SyneRyder wrote: post #39

Earlier quoted context omitted.

3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will fr…

Re: Conversion rates, as a consumer I have got used to it and it does not affect conversion for me at all. Everyone uses it now in the UK and you always get redirected to the exact same page. I expect it, it doesn't put me off buying. So it's a bad objection to the system, because once everyone's using it, it becomes the norm. Yes, there will be a dip in conversions to begin with as consumers are scared by the new pa…

I'm in the UK and I'm used to it - used to it being a crock of shit.

It's a complete flip of a coin whether the dodgy collection of forwards and cookies and iframes will go wrong somewhere, and such failures are always handled in the most user-hostile ways. I can completely understand why Amazon and so many other retailers just don't bother with it.

Re: Candy Japan hit with credit card fraud

#159

Post by scurvy »

One other tip: Block all TOR exit node IP's. You'll find mostly fraud and spam coming from them.

Deep down, I would love to support TOR in principle. I know there are people living in oppressive regimes that need access to information. I want to support that side of TOR. In reality it's still the transport tunnel of choice for scammers and criminals. The costs just don't outweigh the benefits. Considering the CDNs that block TOR (Akamai, Cloudflare, Incapsula, etc), you wouldn't be the only one blocking TOR. I'd also throw in EC2, GCE, Azure, and Rackspace IP's too.

Re: Candy Japan hit with credit card fraud

#160

Post by jandrese »

scurvy wrote: post #159

One other tip: Block all TOR exit node IP's. You'll find mostly fraud and spam coming from them. Deep down, I would love to support TOR in principle. I know there are people living in oppressive regimes that need access to information. I want to support that side of TOR. In reality it's still the transport tunnel of choice for scammers and criminals. The costs just don't outweigh the benefits. Considering the CDNs th…

Hopefully nobody is living in a regime so strict they can't order candy delivery without fearing for their life.
Post reply on HN