Live data from Hacker News

Tell HN: Automatic fraud detection is making my life hell

news.ycombinator.com

271–280 of 406 posts

Re: Tell HN: Automatic fraud detection is making my life hell

#271
post #116
post #113

I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…

wise.com is pretty good for international card stuff. You send them a bit of money and they send you a card etc.

Yeah, they send verification codes via app notifications. I am so glad I got one before my international vacation this summer. Wise card worked where nothing else would.

Re: Tell HN: Automatic fraud detection is making my life hell

#272
post #113

I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…

Not sure if it works in Germany as a US citizen, but next time try walking into a bank, explaining the situation and asking for a prepaid card. (E.g. we have the Mastercard Red in Austria.) It will take some time, you'll have to show ID, but it may solve the 3 EUR annoyance.

Re: Tell HN: Automatic fraud detection is making my life hell

#273
this is why bitcoin and zcash is so important: your keys, your coins, period. as long as the bank or other card issuer or merchant is on the hook for stolen cards and identity fraud, they'll be paranoid about anything that looks 'suspicious' and cut off your access to your funds just in case

(of course if you want to keep your bitcoin in a 'bank' you can, but the important thing is that the choice is yours, not the government's; and merchants who accept bitcoin aren't at risk of incurring chargebacks)

online payment is coming one way or another; let's make sure it's self-sovereign, secure by design, and privacy-protecting. we've already gone a long way down a very dark road, and it's going to get a lot worse before it gets better, with oppressive governments freezing the funds of family members of dissidents and journalists, genocides, and targeted overseas assassinations facilitated by our insecure-by-design payment system

today bitcoin already solves the 'hard to carry cash from one country to another' problem pretty comprehensively; you can buy bitcoin in one country, write your electrum seed phrase on a slip of paper (or memorize it, or read it over the phone to a relative who writes it down), reinstall electrum on a fresh, trustworthy phone after you arrive, and change the bitcoin to local currency with a local counterparty. no cell phone for corrupt cops to copy keys from at the airport, no briefcases full of bills, nothing to declare at customs. and you don't have to care if the tiffin wallah accepts bitcoin (does he accept paytm yet?) because you just need to find one willing counterparty in the entire country

zcash is more difficult to use this way because there aren't as many counterparties

Re: Tell HN: Automatic fraud detection is making my life hell

#274
post #83

I am no longer allowed to buy anything at Ikea. The web site declines both my credit card and debit card. I called my credit card company, and no issues there. I called Ikea and tried to order through a person, but my cards were also declined that way. They can't give me any explanation. This happened in 2019 and again the next time I tried in 2021.

i know ikea doesn't accept bitcoin, but what happens if you pay cash

Re: Tell HN: Automatic fraud detection is making my life hell

#275

Earlier quoted context omitted.

What is the heuristic they are checking for here? That problematic actors overwhelmingly will be unable to show an active wifi adapter?

Almost everyone uses wifi for everything now. If you're using Ethernet there is a very high probability you are actually a proxy/vpn exit on a rack in some random residential location.

Well that's a shitty filter because now criminals will use wifi or fake using wifi. And then they will get right through. It's not that hard to fake. Security Theater.

Re: Tell HN: Automatic fraud detection is making my life hell

#276
Dealing with fraud detection is a real pain!

Every 3 months, I have to pay the school fee for my 3 kids. The amount is almost the same for all three. The first payment always goes off without a hitch. But, when I go to pay for the second kid, bam, it locks up the account. Our local branch is utterly clueless. Then we will have to jump through multiple hoops to get the account activated. This whole drama happens like clockwork every three months. It doesn't matter that it's just a school payment, and doesn't matter that thousands of parents are making payment around that time.

Friends holding accounts in other banks face the same issues. So, it is not isolated to my bank and changing banks will not help.

So, now, we've decided to take the one-kid-a-day approach. It's a bit more work, 'cause I have to remember to make those payments over three days, but it sure beats the headache of reactivating the account every time.

Re: Tell HN: Automatic fraud detection is making my life hell

#277
post #142

Earlier quoted context omitted.

Why would LEO satellite internet cause frequent change of IP addresses? Shouldn't all that moving-satellite stuff be handled on a lower level of the OSI Model (probably Layer 2: Data Link), and the IP stuff at Layer 3 isn't affected?

With Starlink, the downlink location determines your externally-visible IP address and that can change every 90 seconds or so based on where the closest satellite to you is at the moment. I'm in New Mexico and I frequenly see ads on web pages directing me to shops in Denver or Dallas because those are the downlink locations for me. You can see the issue better on this visualization: https://starlink.sx/

I think there must be something going on here. Changing your IP address would screw with all sorts of things. You never be able to do online gaming. Video streaming would stop working every time your IP changed. Anything that streams would just die and not recover for a while.

Re: Tell HN: Automatic fraud detection is making my life hell

#278

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

I'll add another to that list: -- People will never have a physical mailing address that contains "funny" numbers like "000", "420", "69420", or "80085".

-- No one was born on 4/20/69

-- Forced SMS based MFA should be used to protect logins for mobile phone accounts

Re: Tell HN: Automatic fraud detection is making my life hell

#279

>who are you (as a random online service) to assume you can act as my big brother? we're the people who suffer the consequences of the fraud. if your card gets used fraudulently, you call your bank and get the transactions cancelled, no big deal. if my website lets a fraudulent transaction through, my processing fees go up. if my website lets more than a couple fraudulent transactions through (or not even necessarily…

Wow nice of them to pass the responsibility on to you.

Re: Tell HN: Automatic fraud detection is making my life hell

#280
post #262

Earlier quoted context omitted.

If you get a list of wifi networks, you can look them up in various databases too check possible locations of the device.

... which reminds me of an experiment I keep meaning to run: Can I do a quick wifi survey (somewhere) and then replicate the SSIDs and channels in a completely different location and fool one of these SSID mapping functions ? What are these functions scanning for to perform the geolocation other than SSID and frequency and MAC addresses ? Relative or triangulated signal strength ?

Most routers these days default to auto channel assignment. And the triangulation near any thicker wall will break down anyway. I'd be surprised if they looked up more than SSID for a match and then adjusted the location slightly based on signal strength.
Post reply on HN