Live data from Hacker News

Tell HN: Automatic fraud detection is making my life hell

news.ycombinator.com

241–250 of 406 posts

Re: Tell HN: Automatic fraud detection is making my life hell

#241
post #148
post #141

Earlier quoted context omitted.

All these can be the wrong assumptions for sure. Working in a space with some fraud though I can tell you the majority of users verify fine and there ate only the few percentage that don’t for any number of reasons some what you have given above. For smaller vendors though things to consider are - a charge back can come up to 6 months later. A loss of that is not only a loss of funds but a charge back fee - too many…

The problem is that it's not acceptable for online providers to converge on making life miserable for "a few percent" of people. This is a market failure: to save the cost of a few bucks, huge costs are imposed on these individuals. The answer is to have some mechanism whereby people who run into these issues can pay ( once ) the small cost of being validated in an alternative way (like, actually talking to a human a…

This is secondary to the main topic, but:

The externalization of costs onto customers is something I've noticed hard with the pandemic. Going to get medication at the pharmacy while fewer and fewer people worked and hours were closed, and finding out after the pandemic it's shitty still with multiple pharmacy chains having workers walk out and protest these conditions. As a customer - waiting in line for a refill can be endless. Being on hold in a call center, because you won't pay people enough to work your shit jobs, and handle issues locally, meanwhile, the time-cost is externalized on to us in longer wait times.

Workers/Customers lose, somebody's winning, but it ain't us.

(Again, this is NOT the same issue and not a complaint about the main topic).

Re: Tell HN: Automatic fraud detection is making my life hell

#242
>who are you (as a random online service) to assume you can act as my big brother?

we're the people who suffer the consequences of the fraud. if your card gets used fraudulently, you call your bank and get the transactions cancelled, no big deal.

if my website lets a fraudulent transaction through, my processing fees go up. if my website lets more than a couple fraudulent transactions through (or not even necessarily frauddulent, but transactions that the issuing banks classify as high-risk) the credit card companies shut off my ability to process payments and my business shuts down. so yeah, sorry if it inconveniences you, but accepting a payment from some random guy who even slightly matches some fraud characteristics isn't worth risking my business over.

Re: Tell HN: Automatic fraud detection is making my life hell

#243
post #137

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…

I'm confused about what such applicants hope to gain by this. What's their business model? They're going to have to give you a SS# or EIN (if they're a self-employed consultant) before you can send them a paycheck, right? And the Social Security Administration has a website where you can verify SS numbers. So what's the play here?

Re: Tell HN: Automatic fraud detection is making my life hell

#244

Earlier quoted context omitted.

I tried to place some online bets for a friend who is in prison. But the betting sites don't allow you to use an ethernet cable to connect to your router o_O (unless you also enable wifi.. except my desktop doesn't have wifi) https://helpcenter.il.betrivers.com/hc/en-us/articles/360049...

What is the heuristic they are checking for here? That problematic actors overwhelmingly will be unable to show an active wifi adapter?

Almost everyone uses wifi for everything now. If you're using Ethernet there is a very high probability you are actually a proxy/vpn exit on a rack in some random residential location.

Re: Tell HN: Automatic fraud detection is making my life hell

#245
post #113

I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…

> Yes, let me put cash into the non-existent train ticket machines, or to the non-existent train attendants

Insisting on paying cash is how you prevent those machines from disappearing.

That's why it's important.

Re: Tell HN: Automatic fraud detection is making my life hell

#246
post #129
post #113

I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…

> Or let's me use a Security Key. In my region of the world there's currently one bank that lets you register such a device. And that apparently is some sort of ground breaking innovation.

Because SMS delivery exhausts location data, but dedicated TOTP devices don't.

Re: Tell HN: Automatic fraud detection is making my life hell

#247
post #137

Earlier quoted context omitted.

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…

> US-only remote roles. The entire premise of remote is that it shouldn't matter where you work from, as long as you get the work done. This is extremely, incredibly harmful. I hope you know that.

One boring but absolutely valid reason you might want to hire remote people in the same country is that they're within a few time zones of everybody else so you can have online meetings during normal business hours.

Re: Tell HN: Automatic fraud detection is making my life hell

#248
post #113

I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…

Get a Google Voice account to accept the SMSes for you, it's free and Capital One will complain about the number but accept it.

I permanently live overseas but with US bank accounts and cards, and all my cards go through cycles and phases. Sometimes they want to send SMSes for months to verify account access, then they stop. Same for transactions. Some will refuse to work on Amazon.de for months, then start working. Some physical cards will work on contactless terminals then completely stop working or become unreliable. (The workaround is to add them to Google Wallet).

One interesting thing is that even when banks insist you notify them that you're OS, if you keep using your card OS they will just accept it and ignore the period you've stated as being OS.

Re: Tell HN: Automatic fraud detection is making my life hell

#249
post #116
post #113

I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…

wise.com is pretty good for international card stuff. You send them a bit of money and they send you a card etc.

I wanted to use them, but they'd only accept payment via Plaid, that ridiculous service where I have to hand my banking password to a third party -- you know, the exact thing that we all know to never ever do. That's a nope for me, sadly.

Re: Tell HN: Automatic fraud detection is making my life hell

#250
post #137

Earlier quoted context omitted.

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…

I'm confused about what such applicants hope to gain by this. What's their business model? They're going to have to give you a SS# or EIN (if they're a self-employed consultant) before you can send them a paycheck, right? And the Social Security Administration has a website where you can verify SS numbers. So what's the play here?

Maybe they provide credentials for a stolen identity?
Post reply on HN