Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ex-Googlers Train Machine Army to Sift Out Crooks

wired.com

Post reply on HN
Print view View original

11–20 of 32 posts

Re: Ex-Googlers Train Machine Army to Sift Out Crooks

#11

Post by brandonb »

mynewwork wrote: post #5

So what happens when a user scores high? Suppose I'm a firefox & windows xp user from elbonia shopping at 3am, does the site not let me make a purchase? Am I forced to provide extra information or are items delayed before shipping?

(I work at Sift Science.)

We provide a score, and then let our customers decide what to do. The majority of our customers have a human review the user, and sometimes as part of that review, they'll do extra verification such as calling the user up. In other cases, customers will delay charging the credit card until they can verify it's legitimate.

Re: Ex-Googlers Train Machine Army to Sift Out Crooks

#12

Post by brandonb »

theorique wrote: post #7

Interesting that a prepaid gift card strongly suggests fraud. What if a person simply wants to protect his privacy?

(I work at Sift Science.)

One thing to note -- our system analyzes a whole bunch of patterns for each user. So just shopping at 3am by itself won't cause problems, nor will using a prepaid gift card by itself. But if a user matches multiple fraud patterns, then they're likely to get a high fraud score.

Re: Ex-Googlers Train Machine Army to Sift Out Crooks

#15

Post by ryguytilidie »

theorique wrote: post #7

Interesting that a prepaid gift card strongly suggests fraud. What if a person simply wants to protect his privacy?

Then they are making a purchase in a category that is most often fraud though they are not committing fraud. Its not like the two things can't exist at the same time.

Re: Ex-Googlers Train Machine Army to Sift Out Crooks

#16

Post by beilabs »

How would this sit with payment gateways from a PCI standpoint?

An ideal customer would be an e-commerce marketplace, I imagine that Sift Science would want to receive as much information about the customer as possible, including credit card / address details. Are you guys completely PCI compliant? You're taking 10 out of 16 credit card digits...

From a quick glance of your website you make no reference to PCI.

Re: Ex-Googlers Train Machine Army to Sift Out Crooks

#17

Post by Volpe »

beilabs wrote: post #16

How would this sit with payment gateways from a PCI standpoint? An ideal customer would be an e-commerce marketplace, I imagine that Sift Science would want to receive as much information about the customer as possible, including credit card / address details. Are you guys completely PCI compliant? You're taking 10 out of 16 credit card digits... From a quick glance of your website you make no reference to PCI.

https://siftscience.com/docs/rest-api

There is no requirement in their api to supply CC details... so no requirement to be PCI.

So it would be weird if they did mention PCI...

The first 6 and the last 4 is not enough to make a valid CC... And if you are still guessing the last details then it's the same as just guessing the full number. (just you'll get their quicker)

Re: Ex-Googlers Train Machine Army to Sift Out Crooks

#18

Post by brandonb »

beilabs wrote: post #16

How would this sit with payment gateways from a PCI standpoint? An ideal customer would be an e-commerce marketplace, I imagine that Sift Science would want to receive as much information about the customer as possible, including credit card / address details. Are you guys completely PCI compliant? You're taking 10 out of 16 credit card digits... From a quick glance of your website you make no reference to PCI.

Great question. We should add it to a FAQ. The PCI-DSS rules apply to systems that store the entire credit card number ("PAN" in PCI-DSS parlance). We don't accept the full credit card number -- just the first six digits (which identify the type of credit card and bank) and the last four (typically printed on receipts), which the PCI-DSS rules allow for. So if you're PCI compliant already, you'll still be PCI compliant if you use Sift Science.

Re: Ex-Googlers Train Machine Army to Sift Out Crooks

#19

Post by beilabs »

brandonb wrote: post #18
beilabs wrote: post #16

How would this sit with payment gateways from a PCI standpoint? An ideal customer would be an e-commerce marketplace, I imagine that Sift Science would want to receive as much information about the customer as possible, including credit card / address details. Are you guys completely PCI compliant? You're taking 10 out of 16 credit card digits... From a quick glance of your website you make no reference to PCI.

Great question. We should add it to a FAQ. The PCI-DSS rules apply to systems that store the entire credit card number ("PAN" in PCI-DSS parlance). We don't accept the full credit card number -- just the first six digits (which identify the type of credit card and bank) and the last four (typically printed on receipts), which the PCI-DSS rules allow for. So if you're PCI compliant already, you'll still be PCI complia…

Thanks for the information, I think I'll be in touch about an account in the next few weeks for a marketplace I'm developing.

Perfect timing too, I just started looking at our options for developing something similar internally.

Would love to see the systems that Etsy / Ebay for handling this type of fraud.

Re: Ex-Googlers Train Machine Army to Sift Out Crooks

#20

Post by brandonb »

luser001 wrote: post #14

Since the Sift guys are responding: from where do you get the raw data about fraudulent transactions? I'm assuming you have streams of fraudulent and valid transactions, otherwise you can't figure out what correlates with fraud.

Our customers send examples of users that they've banned from their site or who have caused a credit card chargeback -- these are the $label events in our API and quickstart.

Those $label events let us do two really important things.

First, we can learn patterns that are unique to a particular site. Every site is a little different, so that has a big impact. Patterns that catch fraud accurately for an auction site may not work at all on a travel site.

Two, if a user gets banned from one site in our network, we can identify when they attack another site. That means as more sites join the network, the system gets more accurate for everybody.

Post reply on HN