Radar – A new set of integrated tools to help prevent fraud • Hacker News Board

Re: Radar – A new set of integrated tools to help prevent fraud

#91

Post by tarstarr » Wed, Oct 19, 2016, 11:46 PM UTC

globile wrote: post #87

compumike wrote: post #27

Just checked our Stripe dashboard and it looks like this has quietly been doing good work for us for many months now blocking suspicious charges. It took me a few clicks to find https://dashboard.stripe.com/search/rules?rule_token=block_i... and after going through a few of them, the per-charge risk factor descriptions are really helpful too. The high-risk reasons are messages like: "This card has been used from an u…

"Primary risk factor: The country where this card was issued (EC) does not match the country where the payment was made (US)." This has become clear now....but Stripe has thus been blocking legitimate payments from our users with no insight for us 80% of our clients are travelling at the time of purchase... Now we understand why we were getting so many BLOCKED transactions!! Although this is a welcome addition, a hea…

One thing to note is that the risk factor surfaced in the dashboard is the primary risk factor, but the final risk level is a combination of many different factors--it's not accurate to say that the charge was blocked only because the card country did not match the IP country. That said, if you are certain that there are areas where there are high numbers of false positives, Radar does provide tools for making corrections (by writing rules to allow or send charges to review, for example). I'm happy to talk more about the specifics in your case if you send me a note (and definitely let me know if there's a way we can make this clearer in docs/product) -- I'm tara@stripe.com.

Re: Radar – A new set of integrated tools to help prevent fraud

#92

Post by tyingq » Wed, Oct 19, 2016, 11:48 PM UTC

X-Cubed wrote: post #90

tyingq wrote: post #67

Earlier quoted context omitted.

The most common scenario where we experience credit card fraud is high value items ($500+) and a freight forwarder. The scammer orders the item, using the billing address of the legitimate owner of the card, but a shipping address that corresponds with a freight forwarding operation. These places offer a US address, but forward the shipments on to various places, including South America, islands in the Caribbean, etc…

I understand your concerns as seller, but as a buyer located outside the US, blacklisting freight forwarders is really annoying, as it blocks access to legitimate buyers as well. The government-owned postal service in New Zealand, NZPost, run a service known as YouShop https://www.nzpost.co.nz/tools/youshop specifically to allow Kiwis to get access to products that are either only sold overseas, or would cost ridicul…

Unfortunately, the fraud rate is just too high for us to do otherwise.

Additionally, it creates issues even with legitimate customers. If the product arrives with shipping damage, there's no way to know if it was caused by our shipper, or the freight forwarder. The customer, though, is quite sure it's our issue to resolve...

Re: Radar – A new set of integrated tools to help prevent fraud

#93

Post by gruez » Thu, Oct 20, 2016, 1:03 AM UTC

rwmurrayVT wrote: post #64

I think the "golden age" of online fraud is coming to an end quickly. I've posted quite heavily on Stripe and fraud threads on HN previously if you want to read my comment history. This is a big step for Stripe. I've often asked why they didn't have an integration with MaxMind or SiftScience already set up. They've been building their own behind-the-scenes the entire time! This feature is fantastic if you are a merch…

>in part because the biggest forum thread discussing it was closed

what was that forum?

Re: Radar – A new set of integrated tools to help prevent fraud

#94

Post by King-Aaron » Thu, Oct 20, 2016, 1:14 AM UTC

edwinwee wrote: post #30

bflesch wrote: post #12

I like the rotating 3D model in the landing page very much. Are they using some sort of pre-baked library which lets you create such an visualization with 30 lines of Javascript, or is it 100% custom? Maybe someone can point me to a good resource for such elegant WebGL renderings.

Glad you like it! We used Three.js ( https://threejs.org ) to handle rendering the icosahedron itself. Three.js actually includes an icosahedron as one of its built-in primitives, however we also wanted to add some subtle details to the model such as rounded edges. So, we created a rounded version in Cinema 4D, and then rendered both that model as well as an invisible copy of the object using the Three.js primitive.…

Agree, awesome work. Probably one of the nicest visual elements I've seen on a tech site for a while.

Re: Radar – A new set of integrated tools to help prevent fraud

#95

Post by rwmurrayVT » Thu, Oct 20, 2016, 1:18 AM UTC

undefined0 wrote: post #89

rwmurrayVT wrote: post #64

I think the "golden age" of online fraud is coming to an end quickly. I've posted quite heavily on Stripe and fraud threads on HN previously if you want to read my comment history. This is a big step for Stripe. I've often asked why they didn't have an integration with MaxMind or SiftScience already set up. They've been building their own behind-the-scenes the entire time! This feature is fantastic if you are a merch…

Using Spreedy to act as a 'white' proxy to their API would make it an even harder job for Stripe to detect the fraudsters. What would be your solution to the problem?

It seems Spreedy is the solution I'm talking about. I can't say with absolute certainty. Their website says it uses api.stripe.com, which is great. Basically, any code that passes directly to Stripe's API instead of to Stripe.JS/Checkout.

If you strip away the "buyer's" IP then a lot of their ability to detect fraudulent transactions goes away. They still have account based limits and other methods, but my personal opinion is the anecdotal increase in difficulty of creating fraudulent Stripe accounts is due to Radar based detection.

Re: Radar – A new set of integrated tools to help prevent fraud

#96

Post by rwmurrayVT » Thu, Oct 20, 2016, 1:22 AM UTC

gruez wrote: post #93

rwmurrayVT wrote: post #64

I think the "golden age" of online fraud is coming to an end quickly. I've posted quite heavily on Stripe and fraud threads on HN previously if you want to read my comment history. This is a big step for Stripe. I've often asked why they didn't have an integration with MaxMind or SiftScience already set up. They've been building their own behind-the-scenes the entire time! This feature is fantastic if you are a merch…

>in part because the biggest forum thread discussing it was closed what was that forum?

AlphaBay. It had a 200+ page thread on Stripe and methods for creating Stripe accounts to process fraudulent payments. I feel confident saying this time 1 year ago they were easily pushing 500k-1m USD in transactions a month. There were several users who posted screen shots of single accounts reaching 50k-180k.

Threads deleted, but only to stop newbies and methods from leaking out to public readers like myself.

Re: Radar – A new set of integrated tools to help prevent fraud

#97

Post by rwmurrayVT » Thu, Oct 20, 2016, 1:23 AM UTC

Artemis2 wrote: post #88

rwmurrayVT wrote: post #64

I think the "golden age" of online fraud is coming to an end quickly. I've posted quite heavily on Stripe and fraud threads on HN previously if you want to read my comment history. This is a big step for Stripe. I've often asked why they didn't have an integration with MaxMind or SiftScience already set up. They've been building their own behind-the-scenes the entire time! This feature is fantastic if you are a merch…

Is it something different from the /tokens endpoint? Do they have any protection against pushing your data directly that way?

private message me or email me at my username @vt.edu.

Edit: I lied my email is rwmurray @ [vt.edu].

Re: Radar – A new set of integrated tools to help prevent fraud

#98

Post by rwmurrayVT » Thu, Oct 20, 2016, 1:26 AM UTC

arcticfox wrote: post #75

compumike wrote: post #27

Just checked our Stripe dashboard and it looks like this has quietly been doing good work for us for many months now blocking suspicious charges. It took me a few clicks to find https://dashboard.stripe.com/search/rules?rule_token=block_i... and after going through a few of them, the per-charge risk factor descriptions are really helpful too. The high-risk reasons are messages like: "This card has been used from an u…

Usually fraud systems are black boxes to prevent abuse, not because they can't be human readable. I agree however that to my eye it does usually seem excessively black-box, as it's not like most fraudsters are idiots, they already know what tools are arrayed against them.

Prime example is MaxMind's minFraud. How long do you think it took for someone to pay $500 and test their card details + billing information + shipping information + sock5/rdp before submitting payment on a MaxMind "protected" webstore?

MaxMind isn't a black box either. You can pay 0.03 USD to get the full break down of scores on an inquiry. You can register and get an ID number to token your fraudulent VM/RDP with the card before submitting a real payment. That partially helps defeat their device tracking [1].

https://www.maxmind.com/en/minfraud-device-tracking

Re: Radar – A new set of integrated tools to help prevent fraud

#99

Post by rwmurrayVT » Thu, Oct 20, 2016, 1:34 AM UTC

maratc wrote: post #86

woodcut wrote: post #84

Earlier quoted context omitted.

Unsure as to why you're being downvoted... as chargeback insurance is the predominant model used by anti-fraud companies. That said, it's not necessary for Stripe to take their cut that way as they already are the payment service provider and so already have taken a cut and their model allows them to just offload risk to the client.

If they limit themselves to be "payment service provider" it's not clear how this anti-fraud stuff really fits into their model.

Ending the bleeding they're currently suffering at the hands of accounts that exist solely to process fraudulent transactions.

Re: Radar – A new set of integrated tools to help prevent fraud

#100

Post by rwmurrayVT » Thu, Oct 20, 2016, 1:35 AM UTC

tyingq wrote: post #67

patmcguire wrote: post #16

I work at a company with a fairly large number of transactions and we don't really have a problem with fraud. I don't know anyone else who's really battled it either. Is it much more prevalent for certain industries and products?

The most common scenario where we experience credit card fraud is high value items ($500+) and a freight forwarder. The scammer orders the item, using the billing address of the legitimate owner of the card, but a shipping address that corresponds with a freight forwarding operation. These places offer a US address, but forward the shipments on to various places, including South America, islands in the Caribbean, etc…

MaxMind allows you to take into account shipping address and billing address. Their 'insights' service will also show you the estimate distance between IP & shipping/billing.

That said, it can also be defeated.