Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Automatic fraud detection is making my life hell

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 406 posts

Re: Tell HN: Automatic fraud detection is making my life hell

#221

Post by matheusmoreira »

cj wrote: post #213
matheusmoreira wrote: post #206

Earlier quoted context omitted.

> I wish there were a way to detect fraud while never having a false positive. There is: networking. People you trust will tell you about candidates they know about. > it’s also not realistic to optimize for the 1% It's not about what's realistic, it's about what's right. Nobody should be falsely treated like a criminal. That 1% should carry enough legal liability to completely offset if not exceed the gains of preve…

It’s acceptable to reject a candidate because they’re not “a friend of a friend”, but it’s not acceptable to reject a candidate because they submitted an application with an IP address from Pakistan with a VOIP phone number?

In the first case, you're not rejecting candidates at all. Nor are you treating them like potential fraudsters.

Re: Tell HN: Automatic fraud detection is making my life hell

#222

Post by sneak »

Most people in the US don’t ever leave their home country, and when they do, it’s usually to a small number of other first world countries.

I came close to being bankrupted this year because my US health insurer doesn’t support customers remaining insured if they live a lifestyle that involves being away from paper mail delivery for a few months at a time. (I live elsewhere half the year and they cancelled my policy with only paper mail notice after my payment card on file expired.)

It’s really terrible.

Re: Tell HN: Automatic fraud detection is making my life hell

#223

Post by pxeboot »

k8svet wrote: post #126
0x38B wrote: post #117

Earlier quoted context omitted.

Not the same (it’s a debit card), but when Schwab locked my debit card after I tried to buy a transport pass in Poland, a quick phone call got me a human who apologized, put a travel alert on my account, and gave me $50 for the inconvenience. As for C1, they updated the app while I was in Ukraine, and it wouldn’t even let me log in; I had to use a VPN.

If Schwab would fix their account security to allow plain TOTP instead of the scam that is Symantec VIP, I would have nothing but good... well, there was the two times, yes, two times in a month that I had to spend hours on the phone telling them to stop letting people randomly transfer securities into my account without my consent. They assured me that (1) it would be illegal for me to refuse the request to take bac…

> If Schwab would fix their account security to allow plain TOTP instead of the scam that is Symantec VIP

Symantec VIP is just TOTP with a proprietary app/enrollment process. It has been reverse engineered [1], allowing you to use any TOTP app. I have been accessing Schwab and other banking sites this way for years.

[1] https://github.com/dlenski/python-vipaccess

Re: Tell HN: Automatic fraud detection is making my life hell

#224

Post by sneak »

spacebanana7 wrote: post #109
anish_m wrote: post #95

I worked on one of these Fraud detection systems at Airbnb. Statistically, You are in 1% population with the your usage patterns. For most part, all ML models which are used to detect fraud have to take a trade off between precision/recall - meaning how often they let good guys suffer vs let bad guys in. BUt what most of these systems are missing is the appeal and escape path.

> But what most of these systems are missing is the appeal and escape path. Are there any such systems that do have effective escape/appeal paths? If so, what do they look like?

Even if they exist, I am willing to bet they consume the limited time and energy of the people whose only crime was not living the same lifestyle as 99% of everyone else.

Re: Tell HN: Automatic fraud detection is making my life hell

#225

Post by uoaei »

Hackbraten wrote: post #100
uoaei wrote: post #19

I have completely lost access to my Amazon account because I had the audacity to use a correct login and password from a recognized machine in a different part of the world from my shipping address. I called customer service and they said the only thing I can do is create a new account with a different email.

How old was your account when you lost access to it?

At least 15 years, but the past 7 years or so I only used it when I would receive a gift card for Amazon or had no other option for a specific brand's product. I think the last time I used it was 2 or 3 years ago. I'm sure that was a factor, but not being able to recover the account with the email address it's tied to doesn't make sense to me.

Re: Tell HN: Automatic fraud detection is making my life hell

#226

Post by [deleted] »

matheusmoreira wrote: post #221
cj wrote: post #213

Earlier quoted context omitted.

It’s acceptable to reject a candidate because they’re not “a friend of a friend”, but it’s not acceptable to reject a candidate because they submitted an application with an IP address from Pakistan with a VOIP phone number?

In the first case, you're not rejecting candidates at all. Nor are you treating them like potential fraudsters.

[deleted]

Re: Tell HN: Automatic fraud detection is making my life hell

#227

Post by lotsofpulp »

qingcharles wrote: post #185
dreamcompiler wrote: post #131

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

I tried to place some online bets for a friend who is in prison. But the betting sites don't allow you to use an ethernet cable to connect to your router o_O (unless you also enable wifi.. except my desktop doesn't have wifi) https://helpcenter.il.betrivers.com/hc/en-us/articles/360049...

What is the heuristic they are checking for here? That problematic actors overwhelmingly will be unable to show an active wifi adapter?

Re: Tell HN: Automatic fraud detection is making my life hell

#228

Post by MrRolleyes »

cj wrote: post #137
dreamcompiler wrote: post #131

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…

[dead]

Re: Tell HN: Automatic fraud detection is making my life hell

#230

Post by hotnfresh »

ajb wrote: post #148
quags wrote: post #141

Earlier quoted context omitted.

All these can be the wrong assumptions for sure. Working in a space with some fraud though I can tell you the majority of users verify fine and there ate only the few percentage that don’t for any number of reasons some what you have given above. For smaller vendors though things to consider are - a charge back can come up to 6 months later. A loss of that is not only a loss of funds but a charge back fee - too many…

The problem is that it's not acceptable for online providers to converge on making life miserable for "a few percent" of people. This is a market failure: to save the cost of a few bucks, huge costs are imposed on these individuals. The answer is to have some mechanism whereby people who run into these issues can pay ( once ) the small cost of being validated in an alternative way (like, actually talking to a human a…

For small and mid sized players, it’s not to save a few bucks. If your fraud prevention isn’t locked down tight then you will draw enough fraud that it threatens your ability to take payments at all. This stuff can kill a business in a bad day or two.

Take it up with the payment providers. They provide fraud prevention but like to leave vendors guessing about how to configure it, and make it a premium add-on, which is kinda fucked up since they’ll boot you off for letting too much fraud through. It’s a protection racket on the vendor side—they’re also being screwed by this state of affairs.

Post reply on HN