Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…
I'll add another to that list: -- People will never have a physical mailing address that contains "funny" numbers like "000", "420", "69420", or "80085".
Or that some towns may have... unusual substrings (Scunthorpe, Shitterton, Fingringhoe, and the ever-famous Fucking in Austria, now renamed to Fugging).
All these can be the wrong assumptions for sure. Working in a space with some fraud though I can tell you the majority of users verify fine and there ate only the few percentage that don’t for any number of reasons some what you have given above. For smaller vendors though things to consider are - a charge back can come up to 6 months later. A loss of that is not only a loss of funds but a charge back fee - too many…
The problem is that it's not acceptable for online providers to converge on making life miserable for "a few percent" of people. This is a market failure: to save the cost of a few bucks, huge costs are imposed on these individuals. The answer is to have some mechanism whereby people who run into these issues can pay ( once ) the small cost of being validated in an alternative way (like, actually talking to a human a…
But humans are the easiest to con.
I've worked in fraud prevention professionally for years and adding a human verification layer to the equation would make me vastly less likely to believe a suspicious applicant was legitimate.
The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…
> The problem with many of these examples is that 99% of the time, it is a sign a fraud, and 1% of the time it’s a false positive. That’s the key. It may very well be the wrong business decision to care about this 1%.
This is exactly it. Nobody assumes these factors are always true. Absolutely nobody in the fraud prevention chain.
They're just true often enough that the company is better off declining to serve the few exceptions than it is trying to build things around the edge cases.
Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…
> Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end.
My Google Maps language (on my PC) is STILL in Portuguese, but I only happened to be visiting Portugal (for 3 days) when they did the subdomain switch... Every time I change it back to English, it changes the language back the next time I visit the site. It's super frustrating.
I had to try literally multiple services just to buy expensive gift card So instead of contacting your bank or Amazon, you did the most money-laundering-looking thing you could do. Heckuva job there!
I work in fraud detection in the US and the number of people that end up making their legit purchases look like fraud is way too high.
ah, and that is our problem now? If I like to use my browser with uBlock, buying a gift card on a sunday 4am right, sharing data from my phone, different city and with my new laptop, it is still your problem for not letting it go through.
I would like to emphasize his point. When we get into a digital only currency world, you are loosing control. He is giving a real life example. Nothing hypothetical. Think about blocked - without given reason - Google accounts and such. Could be you bank account, in the future, too!
This is only true if you're talking about central bank digital currencies. And frankly I worry about anyone who isn't worried about those.
Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…
The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…
damn so I've been missing out on jobs because back in highschool I thought it was cool I could text from any browser without my phone
The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…
> The problem with many of these examples is that 99% of the time, it is a sign a fraud, and 1% of the time it’s a false positive. That’s the key. It may very well be the wrong business decision to care about this 1%.
I don't think it's safe to write off that 1% if you don't first make sure you understand who that 1% is and how decisions like this, especially at scale, could harm those people. If a person says that they are eligible to work in the USA, that should be taken in good faith. If 99% of applicants are fraudulently answering this question, you're probably doing something wrong and need to figure out what's broken in your application process, rather than aggressively filtering out applicants based on correlation. It would be better to filter them out with a more robust application process that doesn't attract these scattershot job applications typically pushed by bots.
(Tell HN:) Also: > Yet, many online services are giving me hell with their "smart" anti fraud detection and things like that To provide a contrarian opinion, credit card testing, free trial abuse, and other forms of fraud are a thing, so companies usually have to layer other anti-fraud mechanisms on top of 3D secure. That being said, what service are you facing issues with? I do see Amazon as one of the listed servic…
I lost my 25-years old Amazon account when their AI grew suspicious of my credit card. After spending several hours on the phone, sending countless batches of "documentation" and taking selfies in various difficult poses, I gave up and just use Walmart online and ebay now. Saved a lot of money btw.
Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…
The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…
I use my Google Voice number for everything that’s not family or friend.