Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Automatic fraud detection is making my life hell

news.ycombinator.com

Post reply on HN
Print view View original

261–270 of 406 posts

Re: Tell HN: Automatic fraud detection is making my life hell

#261

Post by OwenFM »

Waterluvian wrote: post #168
cj wrote: post #137

Earlier quoted context omitted.

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…

> The problem with many of these examples is that 99% of the time, it is a sign a fraud, and 1% of the time it’s a false positive. That’s the key. It may very well be the wrong business decision to care about this 1%.

Idk, if your aim is to find the "best talent", then what's the chance that they stumble along and you treat them like shit?

That's what's going to happen when you say "out of this other group, this 99% of people who I didn't want anyway, many of the Google Voice people were fraudsters".

Same thing for asking people to reverse a linked list on a whiteboard, or getting them to re-do their résumé, but in your HTML form instead of just emailing you their pdf. If you do ever get your dream candidate, you've pissed them off.

Re: Tell HN: Automatic fraud detection is making my life hell

#262

Post by rsync »

viraptor wrote: post #251
lotsofpulp wrote: post #227

Earlier quoted context omitted.

What is the heuristic they are checking for here? That problematic actors overwhelmingly will be unable to show an active wifi adapter?

If you get a list of wifi networks, you can look them up in various databases too check possible locations of the device.

... which reminds me of an experiment I keep meaning to run:

Can I do a quick wifi survey (somewhere) and then replicate the SSIDs and channels in a completely different location and fool one of these SSID mapping functions ?

What are these functions scanning for to perform the geolocation other than SSID and frequency and MAC addresses ? Relative or triangulated signal strength ?

Re: Tell HN: Automatic fraud detection is making my life hell

#263

Post by arp242 »

SuperNinKenDo wrote: post #101
Habgdnv wrote: post #44

I wholeheartedly support digitization, having been involved in the realms of development, system administration, and everything computer-related since my early days. However, what irks me is when I'm bound to use products or services from providers who fail to execute their roles properly despite being compensated for it. A recent incident at my child's school serves as a pertinent example. They transitioned from a t…

Well in my opinion, this is what it means to support digitisation. It means accepting that these situations will become more and more commonplace. It is simply the price you pay. In your other comment you mention that people handling email should be familiarising themselves properly with RFCs. Yeah. Maybe. Probably actually you're right. Putting aside the problem of ehether they actually _have to_ or _will_ for a sec…

In this case it's relatively benign; the worst result is that they'll have to create a (free) gmail account to forward to their domain. It's annoying and stupid, bit in the grand scheme of things, acceptable.

But in other cases the results are much more severe.

I got vaccinated for Covid. But I couldn't get a "Covid passport" because I didn't have the right government account and couldn't get one as I didn't have eligible housing. I literally had the "proof of vaccinations", but turns out that doesn't count as "proof". Great. You know what sucks more than a Covid lockdown? One where you see everyone else go out and have fun and you're allowed to do fuck all.

Re: Tell HN: Automatic fraud detection is making my life hell

#264

Post by rsync »

k8svet wrote: post #113

I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…

"I'm willing to pay $1000 yearly fee for a competent credit card company that sends me TOTPs over Email ..."

Just spend a few dollars per month on an MVNO SIM card and put a 2FA MULE on your desk back home:

https://kozubik.com/items/2famule/

Re: Tell HN: Automatic fraud detection is making my life hell

#265

Post by arp242 »

OkayPhysicist wrote: post #183
SuperNinKenDo wrote: post #101

Earlier quoted context omitted.

Well in my opinion, this is what it means to support digitisation. It means accepting that these situations will become more and more commonplace. It is simply the price you pay. In your other comment you mention that people handling email should be familiarising themselves properly with RFCs. Yeah. Maybe. Probably actually you're right. Putting aside the problem of ehether they actually _have to_ or _will_ for a sec…

Frankly, examples like GP's are a compelling argument for professional licensure for software developers, because "only accepting gmail addresses as valid emails" should be considered professional malpractice.

The effect will be marginal; it will just create a huge administrative bonanza, and the number of times where it will be used (i.e. software devs being "disbarred") will be few enough that it won't matter much in practice.

Re: Tell HN: Automatic fraud detection is making my life hell

#266

Post by TeMPOraL »

dreamcompiler wrote: post #243
cj wrote: post #137

Earlier quoted context omitted.

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…

I'm confused about what such applicants hope to gain by this. What's their business model? They're going to have to give you a SS# or EIN (if they're a self-employed consultant) before you can send them a paycheck, right? And the Social Security Administration has a website where you can verify SS numbers. So what's the play here?

The applicant is actually three people involved in a scam. One is an US person that can provide valid US SSN or other magic numbers, but otherwise doesn't know first thing about anything. Second is the person running the scam, located anywhere. Third is a person from low-cost country that's skilled enough to pass the interview pretending to be the first person, who might also be responsible for doing the actual job such the interviews succeed. The fat US salary is split between the three parties.

This is actually the case of a thing you mentioned, just sadly in reverse. A phone number may indeed not identify a single person. It may represent three unrelated individuals at the same time.

FWIW, I'm 100% with you on your list. Even if it's only 1% of false positives, it's a massive number of people at global scale, and frankly also a big percentage. Outside of tech, hardly anyone is allowed this kind of error rate.

Re: Tell HN: Automatic fraud detection is making my life hell

#267

Post by janosdebugs »

cj wrote: post #149
LoganDark wrote: post #143

Earlier quoted context omitted.

> US-only remote roles. The entire premise of remote is that it shouldn't matter where you work from, as long as you get the work done. This is extremely, incredibly harmful. I hope you know that.

To be clear, “US Only” means “eligible to work in the US”. The candidates that I’m calling fraudulent are answering “Yes” to a question on our applicant form asking if they’re eligible to work in the US. There’s absolutely nothing wrong with a US company wanting to hire US employees. (FWIW I also hire contract developers outside the US… have nothing against outsourcing, but I prefer to do so knowingly rather than bei…

> The candidates that I’m calling fraudulent are answering “Yes” to a question on our applicant form asking if they’re eligible to work in the US.

The dumb thing is that a lot (and I do mean a lot) of hiring platforms ask this question even when the job is advertized as not being in the US. It's hard to take seriously anymore.

Re: Tell HN: Automatic fraud detection is making my life hell

#268

Post by janosdebugs »

orangepurple wrote: post #253
qingcharles wrote: post #185

Earlier quoted context omitted.

I tried to place some online bets for a friend who is in prison. But the betting sites don't allow you to use an ethernet cable to connect to your router o_O (unless you also enable wifi.. except my desktop doesn't have wifi) https://helpcenter.il.betrivers.com/hc/en-us/articles/360049...

How do they scan for wifi?

The browser connection API maybe?

Re: Tell HN: Automatic fraud detection is making my life hell

#269

Post by nickt »

dreamcompiler wrote: post #131

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

— everyone has a USA taxpayer ID

Re: Tell HN: Automatic fraud detection is making my life hell

#270

Post by xyst »

notatoad wrote: post #242

>who are you (as a random online service) to assume you can act as my big brother? we're the people who suffer the consequences of the fraud. if your card gets used fraudulently, you call your bank and get the transactions cancelled, no big deal. if my website lets a fraudulent transaction through, my processing fees go up. if my website lets more than a couple fraudulent transactions through (or not even necessarily…

yet another reason why credit and debit card companies need to be surgically removed from our lives. They are parasites.
Post reply on HN