Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Radar – A new set of integrated tools to help prevent fraud

stripe.com

Post reply on HN
Print view View original

111–120 of 120 posts

Re: Radar – A new set of integrated tools to help prevent fraud

#111

Post by [deleted] »

maratc wrote: post #107
louischatriot wrote: post #105

Earlier quoted context omitted.

-- Most merchants want either a declined transaction (possibly with explanation -- possibly), or an accepted one with a guarantee against chargebacks. Well in fact their is an issue of misaligned incentives here. Your chargeback insurance has a strong incentive not to receive any chargeback (of course), so they will be overly cautious and decline a lot of valid charges. Stripe on the other hand as perfectly aligned i…

This does not contradict what I said. Declines should be free. Accepts should be guaranteed (but not free). Stripe currently offers free declines, but not guaranteed accepts.

[deleted]

Re: Radar – A new set of integrated tools to help prevent fraud

#112

Post by vertex-four »

morgante wrote: post #40
Silhouette wrote: post #4

This looks very promising. Stripe seems to have sometimes let surprising payments through up to now, even with all the card details security checks they provided activated, and they've never supported 3-D Secure. They've also suffered from surprisingly high rates of unexpected declined charges in our experience. Hopefully if they're now rolling out more comprehensive fraud protection, that will go some way to address…

> they've never supported 3-D Secure That's a feature. It's a horrible system which I wish nobody ever used. I've literally never been able to successfully complete a transaction.

Which bank are you with? Every bank in the UK seems to have a different implementation of it. My own bank just does some automated fraud detection (I assume picking up my IP address, browser details, etc), while a friend's bank requires the user to enter three random letters from a passcode.

Re: Radar – A new set of integrated tools to help prevent fraud

#113

Post by madeofpalk »

bflesch wrote: post #12

I like the rotating 3D model in the landing page very much. Are they using some sort of pre-baked library which lets you create such an visualization with 30 lines of Javascript, or is it 100% custom? Maybe someone can point me to a good resource for such elegant WebGL renderings.

Stripe's product pages and FE technical excellence are second to none. Maybe Apple, but they tend to over do it sometimes whereas Stripe does a great job of making the perfect amount of 'subtle flashy'.

Re: Radar – A new set of integrated tools to help prevent fraud

#114

Post by emdowling »

patmcguire wrote: post #16

I work at a company with a fairly large number of transactions and we don't really have a problem with fraud. I don't know anyone else who's really battled it either. Is it much more prevalent for certain industries and products?

Charities are a huge fraud target too. Often, stolen credit cards get run against donation portals for charities like the Red Cross to see if the still work and are valid (as the charges can be quite small).

This costs the charities a lot of money in chargebacks and man power in dealing with it. Stripe's offerings here could prove invaluable in this scenario.

Re: Radar – A new set of integrated tools to help prevent fraud

#115

Post by rwmurrayVT »

_pmf_ wrote: post #104
rwmurrayVT wrote: post #98

Earlier quoted context omitted.

Prime example is MaxMind's minFraud. How long do you think it took for someone to pay $500 and test their card details + billing information + shipping information + sock5/rdp before submitting payment on a MaxMind "protected" webstore? MaxMind isn't a black box either. You can pay 0.03 USD to get the full break down of scores on an inquiry. You can register and get an ID number to token your fraudulent VM/RDP with t…

> You can register and get an ID number to token your fraudulent VM/RDP with the card before submitting a real payment. That leaves a trail.

Purchasing minFraud or creating device ID numbers? If you're on a RDP or VM who cares? The trail will lead back to nowhere.

You want to create a history, a trail, so to speak with browser/device, IP, and card usage. MaxMind's device ID tracking is similar to what Radar is offering. You've used your card before on a MaxMind protected website with device ID creating LSOs. Now they have you fingerprinted and they can tell if you suddenly start making purchases from an unusual PC/IP. It helps you as a legitimate cardholder at the expense of your privacy.

Stripe uses IESnare when you sign up to determine if you have any sketchy internet history or are a previously banned user. It's a similar strategy, pose as a legitimate user for a week by browsing the internet normally and search for payment processors to "compare" online. Then sign up after you've created history on the device and IP.

Re: Radar – A new set of integrated tools to help prevent fraud

#116

Post by rwmurrayVT »

joshmn wrote: post #101

Yeah, I still wouldn't trust it. Nothing beats manual verification. People aren't sharing credit card numbers on public forums and mashing them against Stripe. People are paying for fulls, and grabbing a socks5 that's piped within a few miles of the address of the cardholder. Never trust your processor to protect you against your (potential) customers. Stripe has very little incentive to do so. They'd rather you pay…

If it isn't my personal favorite HN'er.

Re: Radar – A new set of integrated tools to help prevent fraud

#117

Post by slv77 »

bedros wrote: post #31
patmcguire wrote: post #16

I work at a company with a fairly large number of transactions and we don't really have a problem with fraud. I don't know anyone else who's really battled it either. Is it much more prevalent for certain industries and products?

I have my stolen identity in the past, and had over 15 transactions in next few days. most are buying credit for online services, like online data storage, care.com, etc. and to throw a curve ball, they created yahoo account with my first name plus extra characters and created a subscription to USA today, verified with my fake yahoo account, and sent it to my home. it happened after I went out with friends to a bar a…

Most likely the card was compromised from an online store weeks or months before hand. Cards that are stolen at brick and mortar stores have the CVV value from the magnetic strip and are more valuable than those stolen from online databases. Those are re-encoded and typically used at gas station pumps or other stores that haven't switched to chips.

Cards stolen online typically come with the CVV2 and billing data that makes online fraud easier. At one time the Secret Service would analyze patterns in purchases to identify which merchants had been compromised. They wouod identify large databases of cards that had been compromised and would turn that information over to the card issuing bank. Given the cost of reusing the cards most banks would chose to mark the cards for additional surveillance instead of re-issuing the cards. At a conference one bank executive said that 20% of cards in the portfolio were marked this way.

The net is that if you carry five cards it's probably that one is in the hands of a fraudster already.

Re: Radar – A new set of integrated tools to help prevent fraud

#118

Post by [deleted] »

derefr wrote: post #103
johnhenry wrote: post #85

Earlier quoted context omitted.

If a system requires that it be a black box to prevent abuse, you should use another system. A black box with flaws that allow abuse is difficult to fix. With an open, auditable system, methods of abuse are more easily exposed and fixed.

The problem is not "flaws" being protected in a security-by-obscurity sense. Rather, it's that these predictive models mostly consist of linear combinations of metrics. (By necessity: "linear combinations of metrics" is usually what most accurately reflects the real world.) If you know exactly which factors, at what weightings, a given predictive model has, you can build a simple function to spread out your fraudulen…

[deleted]
Post reply on HN