Live data from Hacker News

Improved fraud prevention with Radar 2.0

stripe.com

11–20 of 83 posts

Re: Improved fraud prevention with Radar 2.0

#11
Anything that will cut the number of false positives is a welcome development. We lose far more to mysteriously failing charges than we've ever lost to fraud...

Can the new system now distinguish between the initial charge to start a subscription and subsequent ones? A recurring cause of those false positives is someone moving house after they've subscribed and not telling us, and thus failing a mandatory address verification when their next charge goes through. The concept of pre-approved and automatically-blocked lists seems like it might help with that problem, but it would be better still if we could just define the rules more flexibly in the first place so the address-related checks are done the first time but if they've passed previously then we're not too concerned if they start failing later.

Re: Improved fraud prevention with Radar 2.0

#12
post #7
post #5

It is really cool that Stripe is building Radar, we wanted to use https://siftscience.com for something similar, but they went all corporate, and changed their pricing model before we could implement, so instead of them charging per "transaction" or user action, you now had to pay a minimum of $1000 per month for their smallest offering.

I'm seriously hoping this will make SiftScience reconsider their pricing, but more importantly their handling of customers on legacy plans. Grandfathering? Anyone? This is a big win for Stripe. Sift is bullying customers into a minimum of 1,000 USD regardless of previous volume or history. We were in the 10k orders per month around 250 USD with Sift. Now get kicked in the teeth with the minimum 1,000 USD and no real…

This is the boat we're in currently. We haven't been forced to change our SiftScience plan to the $1k/mo minimum (which would over double our current costs)

I'd love to move to Stripe Radar, but that doesn't really help with PayPal orders.

Re: Improved fraud prevention with Radar 2.0

#13
post #9
post #2

Engineering manager for Stripe Radar here. Today’s update has been almost a year in the making and we’re excited to help Stripe businesses fight fraud more effectively. Here's more on what's new: https://stripe.com/blog/radar-2018 I (and the entire Radar team) are on hand to answer any questions you may have!

Thanks! We've updated the submission to use this link (from http://stripe.com/radar ).

[deleted]

Re: Improved fraud prevention with Radar 2.0

#14
Ok some really dumb questions if you don't mind, but how "fraud detection" works has always been one of those areas I am interested in, but not enough to seek out a practitioner and pin them down - until now !

- Any idea what the total fraud vs genuine transactions ratio is? And how that breaks down across industries? I am assuming that SaaS services don't get as much of this - i mean would people buy bingo cards with a stolen card?

- how does fraud get monetised? Once i have downloaded my millions of credit card numbers from Tor (or stolen my friends mothers wallet) I need to persuade a merchant to deliver me something - but it's always bugged me that they actually have to deliver it. to a physical address. that can presumably be traced. It all seems very low level

(Quick story, years ago, call it the year 2000, was in the UK version of BestBuy and the manager called up a service to verify that this 17 year old kid could have a laptop. The manager asked what's your name ? Ok Your address ? Ok. Date of Birth? March 1954? really? you look a bit young for fifty. It just seems a poor way to commit crime)

The question i am trying to ask is that turning credit card numbers into cash seems like a grind that farmville would be impressed by? is it just lots of low level grunts in shops and online or is there something i am missing?

- what advantages do you get as a payment processor that a merchant does not have? And how is that better / worse than the card provider? I would assume there are people trying the same card in multiple different stores at the same time, so if you spot one attempt you stop them all, whereas individual merchants could not know. But Visa probably spots that i just paid for goods on two continents which you can only spot of both merchants use you? Do you and visa share data or do sequential checks and the like?

- how much do the "obvious" checks help - highly unlikely purchases (3 iphones) timing or physical activity (I probably won't buy books on amazon, clothes on boohoo and petrol in a garage in the same five minutes) versus the more ML / secret squirrel stuff?

cheers

Re: Improved fraud prevention with Radar 2.0

#15
post #2

Engineering manager for Stripe Radar here. Today’s update has been almost a year in the making and we’re excited to help Stripe businesses fight fraud more effectively. Here's more on what's new: https://stripe.com/blog/radar-2018 I (and the entire Radar team) are on hand to answer any questions you may have!

One of the issues that I faced during my short stint building ML models for fraud detection in debit card transactions was dealing with class imbalance. I was not completely convinced that over sampling techniques or under sampling techniques would work. My initial experiments just resulted in more false positives. Just curious if you guys faced similar problems.

The other point I bring about is rather rhetorical - There are no open standards, model baselines and datasets in the Fraud domain. Compare building a model for fraud detection to building a model for image recognition or object detection There is a standard baseline, standard datasets and your model competes against that baseline. Because of the open nature of image recognition, the models have improved astronomically. I feel that a lack of such openness is fraud is holding back on innovation. I could be wrong in this assessment so please correct me if so.

Re: Improved fraud prevention with Radar 2.0

#17
post #12
post #7

Earlier quoted context omitted.

I'm seriously hoping this will make SiftScience reconsider their pricing, but more importantly their handling of customers on legacy plans. Grandfathering? Anyone? This is a big win for Stripe. Sift is bullying customers into a minimum of 1,000 USD regardless of previous volume or history. We were in the 10k orders per month around 250 USD with Sift. Now get kicked in the teeth with the minimum 1,000 USD and no real…

This is the boat we're in currently. We haven't been forced to change our SiftScience plan to the $1k/mo minimum (which would over double our current costs) I'd love to move to Stripe Radar, but that doesn't really help with PayPal orders.

We've gotten a few weeks extension, but at some point I'm pretty sure things will be enforced.

Regarding Paypal, I believe the fraud that hurts the most is credit card (chargebacks, threshold maximums and card programs!), and Paypal in general is not that bad at that (not as bad as other things).

If Sift sticks with their new pricing, I think it comes down to doing some math.

Our Current Sift Scenario: 3,000 USD a year.

Proposed Sift Scenario: 12,000 USD a year.

Potential Stripe Radar Only Scenario: 0.

Assuming Stripe is as good or possibly better than Sift at catching fraud/automating flows, then we've got 3 to 12k to offset any potential PayPal fraud and still come out on top.

Ok, Not proper math, but worth considering...

Edit: formatting.

Re: Improved fraud prevention with Radar 2.0

#18

Anything that will cut the number of false positives is a welcome development. We lose far more to mysteriously failing charges than we've ever lost to fraud... Can the new system now distinguish between the initial charge to start a subscription and subsequent ones? A recurring cause of those false positives is someone moving house after they've subscribed and not telling us, and thus failing a mandatory address ver…

PM on Radar here. There are a couple of ways to handle this. You could, as you said, add a customer to your allow list as soon as they pass the initial charge (and AVS) check. You can also use the new `is_recurring` rule attribute [0] which identifies whether the payment is a subscription charge or not (though there’s some additional work to distinguish the first charge, and how you use it depends on the nuances of your integration). I’d be happy to discuss your specific use case in more detail. Feel free to email me directly (eeke@stripe.com).

[0] https://stripe.com/docs/radar/rules/reference

Re: Improved fraud prevention with Radar 2.0

#19
post #2

Engineering manager for Stripe Radar here. Today’s update has been almost a year in the making and we’re excited to help Stripe businesses fight fraud more effectively. Here's more on what's new: https://stripe.com/blog/radar-2018 I (and the entire Radar team) are on hand to answer any questions you may have!

Are you allowed to share what tech stack you use? e.g. TensorFlow, Spark or ...

Most of our ML stack has been developed internally given the unique constraints we have for Radar. Among other things, we need to be able to

- compute a huge number of features, many of which are quite complex (involving data collected from throughout the payment process), in real-time: e.g. how many distinct IP addresses have we seen this card from over its entire history on Stripe, how many distinct cards have we seen from the IP address over its history, and do payments from this card usually come from this IP address?

- train custom models for all Stripe users who have enough data to make this feasible, necessitating the ability to train large numbers of models in parallel,

- provide human-readable explanations as to why we think a payment has the score that it does (which involves building simpler “explanation models”—which are themselves machine learning models—on top of the core fraud models),

- surface model performance and history in the Radar dashboard,

- allow users to customize the risk score thresholds at which we action payments in Radar for Fraud teams,

- and so forth.

We found that getting everything exactly right on the data-ML-product interactions necessitated our building most of the stack ourselves.

That said, we do use a number of open source tools—we use TensorFlow and pytorch for our deep learning work, xgboost for training boosted trees, and Scalding and Hadoop for our core data processing, among others.

Re: Improved fraud prevention with Radar 2.0

#20
post #17
post #12

Earlier quoted context omitted.

This is the boat we're in currently. We haven't been forced to change our SiftScience plan to the $1k/mo minimum (which would over double our current costs) I'd love to move to Stripe Radar, but that doesn't really help with PayPal orders.

We've gotten a few weeks extension, but at some point I'm pretty sure things will be enforced. Regarding Paypal, I believe the fraud that hurts the most is credit card (chargebacks, threshold maximums and card programs!), and Paypal in general is not that bad at that (not as bad as other things). If Sift sticks with their new pricing, I think it comes down to doing some math. Our Current Sift Scenario: 3,000 USD a ye…

I'm currently looking at some of our txn stats on Sift/PayPal, it seems like we could get by there with some simple internal rules.

Definitely something I'm considering.

Post reply on HN