Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Candy Japan 2015 Year in Review

candyjapan.com

Post reply on HN
Print view View original

11–20 of 67 posts

Re: Candy Japan 2015 Year in Review

#11

Post by benlarcey »

technofiend wrote: post #4

See the recent article on [hoverboards @ Buzzfeed]( http://www.buzzfeed.com/josephbernstein/steal-a-credit-card-... ) and [responses here @ HN]( https://news.ycombinator.com/item?id=10727371 ) - I believe they mention options to help with fraud detection but it's not clear how useful they are. Sorry.

I'm actually in the same space selling "hoverboards" and have been massively hit with fraudulent transactions. Luckily we realised fairly quickly and enforced draconian fraud checks, we're missing out on potential sales but the Buzzfeed is article is the alternative.

I'm not sure which processor Candy Japan uses, but you can usually request to implement advanced fraud rules and strict settings that require Zip/postal code to match exactly.

Re: Candy Japan 2015 Year in Review

#12

Post by Retric »

natvod wrote: post #5

I think someone else mentioned this in another post about this. Thought it was a great idea so I'll repeat it here: To prevent fraudsters from using you to authenticate their stolen credit cards, set it up so that every purchase automatically redirects to a 'order successful' page. After seeing that a few their credit card numbers all seem to work on your site, the fraudster will realize they can't use your site to t…

There are several stages of CC validation. EX: http://www.experian.com/decision-analytics/credit-card-verif...

  M = Full match
  P = Partial match
  C = Match, but account is closed
  L = Match, but card is lost or stolen
  E = Invalid card number
  X = No record or security alert
  N = No match
IMO, you can display an error page for some types of issues without helping scammers. However, for physical goods it's a good idea to wait 24+ hours to display C or L codes to users. That way it's not useful for CC scammers, and you have minimal impact on users. Partial matches or other stages that fail your security checks are up to you.

Re: Candy Japan 2015 Year in Review

#13

Post by sitharus »

kbenzle wrote: post #8
natvod wrote: post #5

I think someone else mentioned this in another post about this. Thought it was a great idea so I'll repeat it here: To prevent fraudsters from using you to authenticate their stolen credit cards, set it up so that every purchase automatically redirects to a 'order successful' page. After seeing that a few their credit card numbers all seem to work on your site, the fraudster will realize they can't use your site to t…

Best reply, but... How often is a typo made (1:1000?), how much time for support staff is needed and how many lost orders due to a ~24 hour delay in some orders being placed. Also, easy to flood the system with bad orders that need to be manually sorted, like a fake order DDoS.

If a typo is made 1:1000 times Candy Japan would have had.. 2? At this small scale it's probably worth it - the loss of a customer isn't as big a problem as loss of physical goods.

Re: Candy Japan 2015 Year in Review

#14

Post by smegel »

What happens with the fraud? Does the charge back affect the seller or the bank? Sucks if the former. What do other people/companies do about this? Surely all the CC frauds in the world haven't chosen to gang up on one tiny seller of niche candy from Japan...

Re: Candy Japan 2015 Year in Review

#15

Post by tehwebguy »

jordanlev wrote: post #7
natvod wrote: post #5

I think someone else mentioned this in another post about this. Thought it was a great idea so I'll repeat it here: To prevent fraudsters from using you to authenticate their stolen credit cards, set it up so that every purchase automatically redirects to a 'order successful' page. After seeing that a few their credit card numbers all seem to work on your site, the fraudster will realize they can't use your site to t…

How does one deem a purchase as legitimate or not? And how would you differentiate between a legit customer who mistyped their info versus a fraudulent attempt?

Some low hanging fruit: orders where the billing address is an exact match and it also matches the shipping address are probably the most likely to be legit.

There are many more factors to consider though.

Re: Candy Japan 2015 Year in Review

#16

Post by Zikes »

digikata wrote: post #10
gregwtmtno wrote: post #2

Before people suggest bitcoin--and I love bitcoin--it probably wouldn't solve this guy's fraud problem. Yes, it would stop the fraud, but there are simply too few people willing to pay in bitcoin.

Wouldn't bitcoin give rise to the opposite problem - consumers paying bitcoin now shoulder all the risk of buying from a bad vendor.

I think there are bitcoin escrow payment systems.

Re: Candy Japan 2015 Year in Review

#17

Post by tehwebguy »

smegel wrote: post #14

What happens with the fraud? Does the charge back affect the seller or the bank? Sucks if the former. What do other people/companies do about this? Surely all the CC frauds in the world haven't chosen to gang up on one tiny seller of niche candy from Japan...

They aren't doing it to take money from them, they are using Candy Japan to test their cards out before using them for more expensive items that can be liquidated.

Re: Candy Japan 2015 Year in Review

#18

Post by huac »

tehwebguy wrote: post #15
jordanlev wrote: post #7

Earlier quoted context omitted.

How does one deem a purchase as legitimate or not? And how would you differentiate between a legit customer who mistyped their info versus a fraudulent attempt?

Some low hanging fruit: orders where the billing address is an exact match and it also matches the shipping address are probably the most likely to be legit. There are many more factors to consider though.

usually, sure - this case is interesting b/c the fraudsters don't care about receiving the actual product

this is a really big field - most large companies that have to process tons of transactions will implement a big data approach - put together as much demographic and behavioral info about customer as possible and analyze risk. this is really impossible for small vendors

Re: Candy Japan 2015 Year in Review

#19

Post by bemmu »

benlarcey wrote: post #11
technofiend wrote: post #4

See the recent article on [hoverboards @ Buzzfeed]( http://www.buzzfeed.com/josephbernstein/steal-a-credit-card-... ) and [responses here @ HN]( https://news.ycombinator.com/item?id=10727371 ) - I believe they mention options to help with fraud detection but it's not clear how useful they are. Sorry.

I'm actually in the same space selling "hoverboards" and have been massively hit with fraudulent transactions. Luckily we realised fairly quickly and enforced draconian fraud checks, we're missing out on potential sales but the Buzzfeed is article is the alternative. I'm not sure which processor Candy Japan uses, but you can usually request to implement advanced fraud rules and strict settings that require Zip/postal…

Thanks, next year I want to get back and try to fix the situation. I fell back to PayPal only and have been losing customers since.

Re: Candy Japan 2015 Year in Review

#20

Post by eloisius »

Zikes wrote: post #16
digikata wrote: post #10

Earlier quoted context omitted.

Wouldn't bitcoin give rise to the opposite problem - consumers paying bitcoin now shoulder all the risk of buying from a bad vendor.

I think there are bitcoin escrow payment systems.

The Bitcoin protocol supports multisig transactions. You can use it to implement escrow by including a third party public key and require 2 of 3 parties to sign the transaction.
Post reply on HN