Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nothing is certain, except death and taxes .. and chargebacks

blog.balancedpayments.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: Nothing is certain, except death and taxes .. and chargebacks

#41

Post by mrweasel »

jerguismi wrote: post #39
mrweasel wrote: post #38

I would actually be interested in knowing how others deal with a certain type of fraud. We currently have an issue where someone is using stolen credit cards to buy "digital goods". We in the UK and Scandinavia, so we started out blocking purchases of digital goods from the UK. Fraud goes to zero right away. The fraudsters moves to using stolen UK credit cards in Denmark, via a large number of Danish IPs, fine... We'…

Just out of intereste, what kind of digital product are you selling? I never thought fraud was a problem with digital products, because it is very easy to just go to the torrent sites and download it there... Edit: to mean, who would bother to do payment fraud, when you can just download torrents.

Mostly keys for games, Xbox live points, stuff like that. Very attractive products, both for legitimate customers, but sadly also for criminals.

Torrents are useless for games that require constant network access, which is most new games. You can have the "stolen" keys blocked, but you still lose money.

Re: Nothing is certain, except death and taxes .. and chargebacks

#43

Post by mrweasel »

jasonlotito wrote: post #12

I'm surprised the part on combatting friendly fraud (4.2) didn't include a part about contacting the customer directly, most likely via phone. If you are in an industry where this occurs more often, you might even want to invest in telephone authentication. While it won't stop the friendly fraud, it will be a deterrent. Anyways, contacting the customer can usually get things resolved as well, even if they went straig…

Phone verification will not stop the worst of the fraud. Do not underestimate how well some people lie. It will deter the small time criminals, but not professional.

Re: Nothing is certain, except death and taxes .. and chargebacks

#44

Post by mrweasel »

josscrowcroft wrote: post #42

That's super weird- I had my first chargeback today, from a customer who didn't even attempt to get in touch and ask for a refund... apparently this is quite common!

Not common, standard. Having the customer contact you isn't a frequent occurrence, depending on where you do business. The British do not wish to talk to you, they assume that you're the one trying to defraud them by default. Swedes will pretty much never do charge backs.

Re: Nothing is certain, except death and taxes .. and chargebacks

#45

Post by dminor »

mrb wrote: post #32
JoachimSchipper wrote: post #31

Earlier quoted context omitted.

And no fraud would be stopped.

Not stopped, but it would decrease fraud, as the fraction of payments made in bitcoins is guaranteed to be impossible to charge back. As this fraction increases, fraud is reduced further and further. It would be interesting to have a payment platform that evaluates the trustworthiness of a customer right before payment (based on factors such as customer history, shipping address matching the billing address...), and…

> Not stopped, but it would decrease fraud, as the fraction of payments made in bitcoins is guaranteed to be impossible to charge back.

I doubt it. Most fraudsters are trying to convert someone else's credit into cash by buying goods they can sell. If you have a bitcoin, you pretty much already have cash - just use one of the exchanges.

Re: Nothing is certain, except death and taxes .. and chargebacks

#46

Post by Domenic_S »

mrb wrote: post #32
JoachimSchipper wrote: post #31

Earlier quoted context omitted.

And no fraud would be stopped.

Not stopped, but it would decrease fraud, as the fraction of payments made in bitcoins is guaranteed to be impossible to charge back. As this fraction increases, fraud is reduced further and further. It would be interesting to have a payment platform that evaluates the trustworthiness of a customer right before payment (based on factors such as customer history, shipping address matching the billing address...), and…

> Not stopped, but it would decrease fraud

I can't see how.

As a non-fraudster, I would use any available payment method, including bitcoins.

As a fraudster, I would never use bitcoins.

Re: Nothing is certain, except death and taxes .. and chargebacks

#47

Post by Domenic_S »

dangrossman wrote: post #37
huhtenberg wrote: post #20

Earlier quoted context omitted.

This probably assumes that all cards are under different names.

The merchant doesn't know what name is on the cards. It's still virtually guaranteed fraud when one person presents more than 2 or 3 cards on your site in a short period.

Too bad you can never know what "one person" is.

Re: Nothing is certain, except death and taxes .. and chargebacks

#48

Post by dangrossman »

Domenic_S wrote: post #47
dangrossman wrote: post #37

Earlier quoted context omitted.

The merchant doesn't know what name is on the cards. It's still virtually guaranteed fraud when one person presents more than 2 or 3 cards on your site in a short period.

Too bad you can never know what "one person" is.

In theory, everything can be evaded. In practice, it won't be. If you run your transactions through something like MaxMind MinFraud with Device ID, you will know it's the same person, even if they clear cookies, switch proxies and re-register on your store between every card. It costs half a penny per transaction; anyone can afford basic risk scoring.

Most of the time that kind of tech isn't even necessary. The types of criminals most online stores deal with are not sophisticated; they're just people that paid $1/number for a list of phished credit cards on a black market forum who are going to enter them one-by-one on a few websites to see which haven't been reported stolen yet.

Re: Nothing is certain, except death and taxes .. and chargebacks

#49

Post by mrweasel »

mrb wrote: post #32
JoachimSchipper wrote: post #31

Earlier quoted context omitted.

And no fraud would be stopped.

Not stopped, but it would decrease fraud, as the fraction of payments made in bitcoins is guaranteed to be impossible to charge back. As this fraction increases, fraud is reduced further and further. It would be interesting to have a payment platform that evaluates the trustworthiness of a customer right before payment (based on factors such as customer history, shipping address matching the billing address...), and…

Wouldn't the fraction of people paying with Bitcoin be a subset of the people that didn't commit fraud with credit cards? You're just moving a very small number of honest buyers from credit cards to Bitcoin.

You not going to have a person not defraud you because you provided the option of Bitcoins. If you have transaction that you deem risky, require a bank transfer, that will make it easier for the criminals to go commit fraud somewhere else.

Re: Nothing is certain, except death and taxes .. and chargebacks

#50

Post by brandonb »

mrweasel wrote: post #38

I would actually be interested in knowing how others deal with a certain type of fraud. We currently have an issue where someone is using stolen credit cards to buy "digital goods". We in the UK and Scandinavia, so we started out blocking purchases of digital goods from the UK. Fraud goes to zero right away. The fraudsters moves to using stolen UK credit cards in Denmark, via a large number of Danish IPs, fine... We'…

My company (Sift Science) uses machine learning to fight fraud, and we work with customers who sell digital goods. You're right that normal country blacklisting, IP blocking, AVS, CVV, etc. aren't terribly effective.

I think some effective techniques for digital goods are: 1) behavioral signals, such as how long the user spent browsing your site before making a purchase, 2) physical device -- have I seen activity from this particular machine before, even if they're going through a proxy to use a fresh IP? 3) e-mail address -- is it a legitimate domain? an obvious throw-away account?, 4) mismatch between IP and billing info (as you noted).

In general, fraudsters switch tactics with surprising frequency, so I'd highly recommend combining multiple types of data into a machine learning system that will adapt. Otherwise you're going to spend a lot of time tuning rules.

And if you're looking for help, feel free to send me an e-mail: brandon@siftscience.com. My company deals with fraud all the time. Even if we can't help, I'd be happy to point you to others who can.

Post reply on HN