Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Candy Japan got credit card fraud somewhat under control

candyjapan.com

Post reply on HN
Print view View original

21–30 of 128 posts

Re: How Candy Japan got credit card fraud somewhat under control

#21

Post by fweespee_ch »

SilasX wrote: post #16
stcredzero wrote: post #13

If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…

Yeah I was just talking to an employee of a CC fraud prevention company and that was my thought: they proudly talk about how they can identify fraud and refuse the transaction, when my question was, why not just look like you're approving the order and then follow it right to the fraudster? Better to reliably catch the humans behind this and impose stringent legal penalties than allow them to keep guessing without a…

> Yeah I was just talking to an employee of a CC fraud prevention company and that was my thought: they proudly talk about how they can identify fraud and refuse the transaction, when my question was, why not just look like you're approving the order and then follow it right to the fraudster?

You can get disposable physical addresses as well.

It is part of why some companies flag a mailing address I use as a fraudulent order. I primarily use it to avoid handing out my RL address on domains that don't allow whois protection.

Re: How Candy Japan got credit card fraud somewhat under control

#22

Post by Osiris »

I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees.

I ended up implementing a system using Braintree to do 1) Request an AUTHORIZATION for the amount 2) If the AUTHORIZATION fails, return the error (sounds like I need to change this part, but how to do it without hurting legitimate users?) 3) Send information, including IP and email address, to minFraud 4) If the minFraud riskScore is >= 20, request a VOID on the authorization request 4b) If the riskScore is low, submit a REQUEST SETTLEMENT on the AUTHORIZATION

This has worked extremely well, but a few still slip through the minFraud check.

Even though Braintree offers it's own fraud checking, I still feel more comfortable with minFraud. I really wish that processors like Braintree would put more effort into fraud detection.

I NEVER have this issue with PayPal transactions. Even if it's fraud, they just reverse the transaction and there's no chargeback fee.

Re: How Candy Japan got credit card fraud somewhat under control

#24

Post by kyle6884 »

SilasX wrote: post #16
stcredzero wrote: post #13

If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…

Yeah I was just talking to an employee of a CC fraud prevention company and that was my thought: they proudly talk about how they can identify fraud and refuse the transaction, when my question was, why not just look like you're approving the order and then follow it right to the fraudster? Better to reliably catch the humans behind this and impose stringent legal penalties than allow them to keep guessing without a…

This may work nicely for a subscription business where you have 2 weeks to identify problematic orders. But what about everyone else? Should we silently fail on orders where a customer accidentally mistyped their CC#? Imagine all the extra work involved when you could have had them fix it on the spot.

Re: How Candy Japan got credit card fraud somewhat under control

#25

Post by bemmu »

michaelbuckbee wrote: post #17
bemmu wrote: post #10

Earlier quoted context omitted.

Yep, PayPal is awesome at this. I originally intended to go on a long tirade about how PayPal had dealt with this, but cut it out as the post was starting to get a bit long. --- Peter Thiel on PayPal: "In mid-2000, we had survived the dot-com crash and we were growing fast, but we faced one huge problem: we were losing upwards of $10 million to credit card fraud every month. Since we were processing hundreds or even…

I've heard Max Levchin describe Paypal as a "credit card fraud detection system that also accepts payments".

Also this quote from the book Zero to One: 'Max was able to boast, grandiously but truthfully, that he was "the Sherlock Holmes of the Internet Underground"'.

Re: How Candy Japan got credit card fraud somewhat under control

#26

Post by extrapickles »

ape4 wrote: post #19

What if a real users mistypes their credit card number... your order was successful.

The last digit of a credit card number is a checksum, so it can catch most of those errors.

See https://en.wikipedia.org/wiki/Luhn_algorithm for details

Re: How Candy Japan got credit card fraud somewhat under control

#27

Post by optimiz3 »

stcredzero wrote: post #13

If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…

This also applies to customer service. Nice customers get fast response times. Toxic entitled customers (especially of the free plan) wait 2-3+ days before getting a response.

Re: How Candy Japan got credit card fraud somewhat under control

#28

Post by TylerE »

Osiris wrote: post #22

I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees. I ended up implementing a system using Braintree to do 1) Request an AUTHORIZATION for the amount 2) If the AUTHORIZATION fails, re…

Why not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?

Re: How Candy Japan got credit card fraud somewhat under control

#29

Post by epa »

TylerE wrote: post #28
Osiris wrote: post #22

I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees. I ended up implementing a system using Braintree to do 1) Request an AUTHORIZATION for the amount 2) If the AUTHORIZATION fails, re…

Why not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?

For some simple companies, this may be the right answer. However this grows in complexity as your business scales so don't forget about that.

Re: How Candy Japan got credit card fraud somewhat under control

#30

Post by awesomerobot »

thaeli wrote: post #20

What's the best way to do "no immediate feedback" when you're selling something that is instantly delivered? (Site paywalls, for instance.)

Do paywalls face as much fraud? My understanding is that industries that provide digital goods or services see a much lower rate of fraud because there's little resale value involved (and the cost of stolen/returned goods is much lower).
Post reply on HN