Live data from Hacker News

Tell HN: Automatic fraud detection is making my life hell

news.ycombinator.com

131–140 of 406 posts

Re: Tell HN: Automatic fraud detection is making my life hell

#131
Wrong assumptions programmers make about fraud prevention:

-- A mobile phone number uniquely identifies a single person.

-- Every person has a mobile phone number and they only have one mobile phone number.

-- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud.

-- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under all circumstances.

-- Mobile phones are never lost or stolen and their batteries never run down.

-- Mobile phone numbers last forever.

-- An email address uniquely identifies a person.

-- Every person has an email address and they only have one email address.

-- Every person is always able to receive email under all circumstances.

-- Email addresses last forever.

-- People never travel to foreign countries.

-- A person's IP address always determines where they are located.

-- Geolocated IP addresses are always accurate.

-- Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end.

-- The IP address for a customer will never change during a given session (i.e. LEO satellite internet does not exist).

-- If the IP address for a customer changes "too quickly", that indicates fraud (i.e. LEO satellite internet does not exist).

-- Your customer will never connect to you through a VPN.

-- If your customer connects to you through a VPN, they are doing something fraudulent, rather than trying to get around your geolocation brain damage.

Re: Tell HN: Automatic fraud detection is making my life hell

#132

One of my favorites amongst this stupid platforms is PayPal. I have moved countries/continents. Once I forgot to close my account before moving (still had some $100 on it), after I could never access it as it wanted a phone call to my non existent former phone number to confirm this is really me, ok my fault. Now I have moved again when I want to pay with PayPal I can't because my account is associated to a different…

Oh yeah it's crazy, I have three phones for three different countries just to keep up with stuff. A little expensive but at least I can receive sms verification and incoming calls without paying roaming apparently.

Re: Tell HN: Automatic fraud detection is making my life hell

#133

I move to random corners of the world every 2-3 years and this is starting to give me real anxiety every time I try to make a purchase. One of my credit cards makes me jump through all of the verification and "Was this really you?" messages, then still locks my account half the time. So many online stores will approve my purchase and bill the card with no issue, then cancel it a few hours later for vague security rea…

I found that notifying my providers of upcoming moves eliminates this. Call them, tell them what you're doing and ask their advice (b/c there may be something you overlooked or they may have special problems of their own). Anyway, they're doing you a service and notifying them is good etiquette. And like good etiquette, it often greases the wheels of commerce.

Having to contact the provider to spend one's own money is simply outrageous.

And yet, I also have started to make preemptive contact with them to avoid the complete hassle of having the card blocked for fraud that is NOT fraud.

Re: Tell HN: Automatic fraud detection is making my life hell

#134

Earlier quoted context omitted.

In this case it might actually make it worse. Why are you suddenly, while in the US (for example), ordering physical services in India? My bank locked my credit card once due to suspected fraud. I asked what triggered it and they said "You never buy gas on this card". This was 15 years ago and I'm sure the algorithms have only gotten better. A different bank used to ask you to tell them if you were planning on travel…

Not to mention the number of apps (and increasingly websites) which will require location services. So now you have a GPS location in India, and you're making credit card purchases alternating between USA IP's and India point-of-sale machines (and presumably sometimes Indian IP's for apps/sites that might block USA IP's) throughout the day. As a fellow world traveler / international worker, I do still think this is w…

>Not to mention the number of apps (and increasingly websites) which will require location services.

Like what? I've never encountered this.

Re: Tell HN: Automatic fraud detection is making my life hell

#135

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

Programmers make these assumptions? How about product/program managers?

Re: Tell HN: Automatic fraud detection is making my life hell

#136
post #126
post #117

Earlier quoted context omitted.

Not the same (it’s a debit card), but when Schwab locked my debit card after I tried to buy a transport pass in Poland, a quick phone call got me a human who apologized, put a travel alert on my account, and gave me $50 for the inconvenience. As for C1, they updated the app while I was in Ukraine, and it wouldn’t even let me log in; I had to use a VPN.

If Schwab would fix their account security to allow plain TOTP instead of the scam that is Symantec VIP, I would have nothing but good... well, there was the two times, yes, two times in a month that I had to spend hours on the phone telling them to stop letting people randomly transfer securities into my account without my consent. They assured me that (1) it would be illegal for me to refuse the request to take bac…

Interesting. I was considering opening a second account specifically as a backup card and hedge against lockouts while travelling, and Schwab was high on my list, but it sounds like based on your experience that they are not fit for purpose.

Re: Tell HN: Automatic fraud detection is making my life hell

#137

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive.

> If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud.

I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discovered that VOIP phone numbers on a resume is extremely highly correlated with the applicant lying about where they live.

If it weren’t for this screening step, I literally wouldn’t be able to hire anyone because the volume of fraud is so incredibly high that it drowns out legitimate candidates.

I wish there were a way to detect fraud while never having a false positive.

But the reality is that a lot of the heuristics you listed are indeed strongly correlated with fraud. It sucks, but it’s also not realistic to optimize for the 1% of false positives at the expense of the 99%.

Re: Tell HN: Automatic fraud detection is making my life hell

#138
post #135

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

Programmers make these assumptions? How about product/program managers?

I would say it's both.

Re: Tell HN: Automatic fraud detection is making my life hell

#139

One of my favorites amongst this stupid platforms is PayPal. I have moved countries/continents. Once I forgot to close my account before moving (still had some $100 on it), after I could never access it as it wanted a phone call to my non existent former phone number to confirm this is really me, ok my fault. Now I have moved again when I want to pay with PayPal I can't because my account is associated to a different…

Yes, PayPal once locked me from reading their developer docs because I opened it from the wrong country. These guys never heard of remote working apparently?

Re: Tell HN: Automatic fraud detection is making my life hell

#140

One of my favorites amongst this stupid platforms is PayPal. I have moved countries/continents. Once I forgot to close my account before moving (still had some $100 on it), after I could never access it as it wanted a phone call to my non existent former phone number to confirm this is really me, ok my fault. Now I have moved again when I want to pay with PayPal I can't because my account is associated to a different…

PayPal refuse to close an account(↑) I didn't knowingly consent to the creation of, and certainly never provided any photographic ID for, because I refuse to 'prove my identity' to delete it.

There's not even a real phone number (0s) or address (ABC nonsense) on the bloody thing, but of course giving up some PII they don't have will somehow verify that I have the authority to close an account which is basically name + email address (I've provided those!).

(↑: it comes from the scummy dark park pattern checkout process where you say you want to pay with card not PayPal, and the it turns out the card payment is actually provided by PayPal and here you go have an account with the details you provided to the merchant not PayPal, wouldn't that be helpful. It's certainly not GDPR compliant, but try making PayPal care.)

Post reply on HN