There is a second point of feedback that should be exploited.
He knows which services are used for fraud, it is not unreasonable to conclude that Yahoo (2x) has something wrong in their service (terrible security problem) that AOL doesn't (0.5x).
Ex-Googlers Train Machine Army to Sift Out Crooks
21–30 of 32 posts
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#22Interesting that a prepaid gift card strongly suggests fraud. What if a person simply wants to protect his privacy?
If I want to protect my privacy, I can wear a ski mask to any place with surveillance cameras, such as banks and gas stations. But this does tend to strongly suggest that I'm there to rob the joint.
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#23From what I've read about this project so far, it requires adding "a single line of JavaScript to the site." So what's to stop scammers and spammers from just blocking the file from loading?
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#24I've used sift science, it's pretty neat! I recommend checking out their product.
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#25How would this sit with payment gateways from a PCI standpoint? An ideal customer would be an e-commerce marketplace, I imagine that Sift Science would want to receive as much information about the customer as possible, including credit card / address details. Are you guys completely PCI compliant? You're taking 10 out of 16 credit card digits... From a quick glance of your website you make no reference to PCI.
https://siftscience.com/docs/rest-api There is no requirement in their api to supply CC details... so no requirement to be PCI. So it would be weird if they did mention PCI... The first 6 and the last 4 is not enough to make a valid CC... And if you are still guessing the last details then it's the same as just guessing the full number. (just you'll get their quicker)
No, but 10 of 16 numbers that must conform to a checksum algorithm significantly reduces the search space to a point that a brute force seems trivial if other information is already possessed (e.g., zip code, or especially, cvv).
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#26From what I've read about this project so far, it requires adding "a single line of JavaScript to the site." So what's to stop scammers and spammers from just blocking the file from loading?
(I work at Sift Science)
If there has been no JavaScript activity from a user who makes a transaction on your site, that is a fraud signal in its own right. (You can send us events from your server in addition to adding the JS to your site, so that we know characteristics of your users' transactions that can't be gleaned from the JS. In both cases you set the user ID in the call to Sift.)
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#27Interesting that a prepaid gift card strongly suggests fraud. What if a person simply wants to protect his privacy?
And how do you defraud a retailer using a prepaid gift card anyway?
Not sure if this counts as fraud:
I live in Malaysia, and for the longest time, we didn't have access to the iTunes store. We effectively couldn't buy apps or music online from Apple.
To circumvent this, we could open a fake US account. Problem is, you can only purchase items with a valid US credit card. To circumvent that, some people went to the US, bought a lot of prepaid gift cards, and sold them here at a marked-up price. Then all we have to do is set up a US account with a fake US address (thank you, Beverly Hills 90210!).
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#28Earlier quoted context omitted.
https://siftscience.com/docs/rest-api There is no requirement in their api to supply CC details... so no requirement to be PCI. So it would be weird if they did mention PCI... The first 6 and the last 4 is not enough to make a valid CC... And if you are still guessing the last details then it's the same as just guessing the full number. (just you'll get their quicker)
No, but 10 of 16 numbers that must conform to a checksum algorithm significantly reduces the search space to a point that a brute force seems trivial if other information is already possessed (e.g., zip code, or especially, cvv).
The MyKi ticketing system in Australia prints the first 6 digits, last 4 digits, expiry date and full name on it's recepts. I mentioned to them in the past how easily it could be attacked, but the response was "nobody would do that".
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#29Interesting that a prepaid gift card strongly suggests fraud. What if a person simply wants to protect his privacy?
Why does people complain if I enter my bank with a ski mask? What if a person simply wants to protect their privacy?
In other words: A lot of things can have perfectly legitimate reasons but still strongly suggest that you're up to no good.
The tricky thing is to combine sufficient number of signals to get a high enough confidence to act on it without angering users with legitimate reasons.
Re: Ex-Googlers Train Machine Army to Sift Out Crooks
#30From what I've read about this project so far, it requires adding "a single line of JavaScript to the site." So what's to stop scammers and spammers from just blocking the file from loading?
(I work at Sift Science) If there has been no JavaScript activity from a user who makes a transaction on your site, that is a fraud signal in its own right. (You can send us events from your server in addition to adding the JS to your site, so that we know characteristics of your users' transactions that can't be gleaned from the JS. In both cases you set the user ID in the call to Sift.)
Ah, okay that makes sense, considering that both client side and server side events will be used. Thanks for the reply!