Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

E-commerce Fraud Facts

blog.siftscience.com

Post reply on HN
Print view View original

21–30 of 46 posts

Re: E-commerce Fraud Facts

#21

Post by prakster »

larrys wrote: post #7

With domain name registration the factors that we have noticed that are almost certainly fraud orders are (in various combinations): 1) credit card payment is all lower case and/or obvious non understanding of how US addresses are formatted 2) domain name has "hack" or some foreign sounding word. Or is anything related to vietnam (get plenty from vietnam) 3) IP location doesn't match customers location 4) Multiple at…

Hushmail: In my experience, if the email address is xyz@hushmail.com, it's a fraudster 100% of the time.

Re: E-commerce Fraud Facts

#22

Post by AsymetricCom »

What exactly is a "fraudulent order" anyway? Someone has a credit card, pays you and you send the product. Where is the fraud? Isn't it external to the company or service? If someone steals a credit card and makes an online purchase, isn't that the responsibility of the card company in securing its account proxy more fully?

Re: E-commerce Fraud Facts

#23

Post by jusben1369 »

jasontan wrote: post #16
ekanes wrote: post #13

Earlier quoted context omitted.

I think they're actually quite sophisticated about it - they look at the time zone according to the shopper's browser. So they're looking at local-to-the-shopper.

Yep! We try to localize the time.

So the fraudsters in Vietnam are trying to time it for 2am to 4am in the local market of the site they're defrauding?

Re: E-commerce Fraud Facts

#24

Post by jasontan »

prakster wrote: post #21
larrys wrote: post #7

With domain name registration the factors that we have noticed that are almost certainly fraud orders are (in various combinations): 1) credit card payment is all lower case and/or obvious non understanding of how US addresses are formatted 2) domain name has "hack" or some foreign sounding word. Or is anything related to vietnam (get plenty from vietnam) 3) IP location doesn't match customers location 4) Multiple at…

Hushmail: In my experience, if the email address is xyz@hushmail.com, it's a fraudster 100% of the time.

10minutemail.com and yopmail.com too! :-)

Re: E-commerce Fraud Facts

#25

Post by svmegatron »

larrys wrote: post #19
svmegatron wrote: post #2

The patterns that emerge for fraudulent orders are amazing. And, as the article notes, often specific to a particular merchant. Fraudulent orders often come in waves lasting up to several months, and pattern recognition can be particularly helpful in identifying parts of those longer waves. I'm also working on a project in this space - http://www.merchantprotector.net

(I upvoted you but I might have clicked the downarrow instead). On your site this phrase: "We used to have a problem with fraudulent orders." My suggestion is that the following is much clearer: "We no longer have a problem with fraudulent orders." Also the other info I would present in a less negative way. People tend to respond better (imho and experience) to a message presented in a positive way rather than negati…

Thanks for the feedback! Those are great ideas, I will test them out!

Re: E-commerce Fraud Facts

#26

Post by ekanes »

jasontan wrote: post #15
ekanes wrote: post #5

This is awesome stuff. Theoretically. But Sift doesn't actually make these functional/actionable right away through their service (even though they could). We signed up, love (LOVE!) the idea, but they keep asking for more data before returning meaningful results. Their home page says, "Get going in minutes: Integrate in just three steps: paste a Javascript snippet onto your site, log transactions from your servers t…

Hey Aaron, I'm the OP, and CEO of Sift Science. Sorry that your experience has been subpar. I'll follow up offline. I think there's some confusion -- we actually do have a global machine learning model, which is what customers will start with if we haven't received any labels (training examples to learn from). But, your mileage may vary with the global model. We think it's a starting point, but that fraud differs fro…

Thanks for the call, for listening, and keep up the great work!

Re: E-commerce Fraud Facts

#27

Post by ecopoesis »

joshuahedlund wrote: post #3

We've found that good indicators include: a large distance between billing and shipping addresses, a large distance between estimated IP location and billing address, large order size, using a free email like gmail/yahoo/hotmail (that's the smallest of the factors, but virtually all of our fraud orders use them). Even combining these and others with a threshold, it's still hard to reliably detect without too many fal…

At a previous gig we found the same basic factors. I wrote a quick script to iterate through all the available Weka[1] classifiers using our manually flagged data as a training set. Then I took the top 20 performing ones and used them on incoming orders in production. If more then half the classifiers agreed a transaction was fraud, we denied it. Though this seems a very blunt hammer (I'm not a machine learning expert by any stretch) it worked remarkably well.

[1] http://www.cs.waikato.ac.nz/ml/weka/

Re: E-commerce Fraud Facts

#28

Post by AsymetricCom »

dminor wrote: post #20

So for something like "fraudsters don't use capital letters," does your system discover a fact like this automatically, or do I have to think up these indicators myself and hope they are relevant?

There is no relevancy here to be had, these are simply trivially interesting trends.

Re: E-commerce Fraud Facts

#29

Post by smoyer »

"It might turn out that size 10 shoes are more fraudulent than size 15 shoes."

There should be a pretty limited list of mailing addresses that would order size 15 shoes (Shaq's house?) and the black-market for reselling them must be a lot tighter.

Re: E-commerce Fraud Facts

#30

Post by stephenlambe »

AsymetricCom wrote: post #22

What exactly is a "fraudulent order" anyway? Someone has a credit card, pays you and you send the product. Where is the fraud? Isn't it external to the company or service? If someone steals a credit card and makes an online purchase, isn't that the responsibility of the card company in securing its account proxy more fully?

E-commerce fraud takes many forms. Three main types of fraud impact merchants: payment fraud, new account fraud and account takeover. We described all three recently at Sift in a blog post: http://ow.ly/oPrS2.

In the stolen card scenario you describe (a type of payment fraud), the e-commerce merchant is actually liable. In other words, if that card is reported stolen by the cardholder after the goods are shipped out, the merchant loses the revenue. This is b/c for online credit card transactions, they are categorized as "card not present" transactions, since the merchant can't be as certain the actual cardholder made the purchase. If the transaction had occurred in a physical store, the card company would be liable.

Post reply on HN