Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Automatic fraud detection is making my life hell

news.ycombinator.com

Post reply on HN
Print view View original

291–300 of 406 posts

Re: Tell HN: Automatic fraud detection is making my life hell

#291

Post by creer »

tracerbulletx wrote: post #170
dreamcompiler wrote: post #131

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

It has nothing to do with wrong assumptions, it has everything to do with the statistical similarity to fraudulent transactions and acceptable failure rates.

Or laziness? "Quick and dirty" is so tempting.

Re: Tell HN: Automatic fraud detection is making my life hell

#292

Post by corbezzoli »

I am glad I found a bank (N26) that rarely if ever blocks my payments online. I travel frequently and my previous credit card would block all kinds of payments regularly.

If possible, find yourself a bank that enables you to spend money and leaves “security” in your hands. My 2FA is via app, never SMS.

Side note: someone stole and used my card number and the bank immediately refunded me. Can’t get any better than this.

Re: Tell HN: Automatic fraud detection is making my life hell

#293

Post by toast0 »

rsync wrote: post #262
viraptor wrote: post #251

Earlier quoted context omitted.

If you get a list of wifi networks, you can look them up in various databases too check possible locations of the device.

... which reminds me of an experiment I keep meaning to run: Can I do a quick wifi survey (somewhere) and then replicate the SSIDs and channels in a completely different location and fool one of these SSID mapping functions ? What are these functions scanning for to perform the geolocation other than SSID and frequency and MAC addresses ? Relative or triangulated signal strength ?

Almost certainly. I'd guess most of these services are usinf BSSID (more or less mac address of the access point) instead of SSID and not using channel number or signal strength.

If you report GPS position and BSSIDs anytime you see them, you can probably approximate a location when you only have a BSSID. IIRC, precision is fairly low for wifi approximated position, but maybe it's gotten better since I last looked.

If you want to do a test, I'm happy to send you BSSIDs or whatever you need by email (address in profile) and you can geospoof to my house. I run too many APs, so it should work with just mine, but I can sometimes see neighbor APs as well.

Google's api documentation [1] has only the macAddress as a required field, and that you need at least two addresses; but it does accept a signal strength measurement, as well as channel and snr. Other apis may vary.

[1] https://developers.google.com/maps/documentation/geolocation...

Re: Tell HN: Automatic fraud detection is making my life hell

#294

Post by dalyons »

pm24601 wrote: post #160

I use cash for so so so much. I will bring a couple of thousand USD on a trip and convert it to the local currency to avoid exactly this hassle. Not just for me but for the merchant as well. Cash is king-many, many times.

Not really a solution, as there’s plenty of countries now (eg Australia, nz) where cash is not useful anymore, because many physical merchants no longer accept it. The number grows every year.

Re: Tell HN: Automatic fraud detection is making my life hell

#295

Post by dboreham »

tim333 wrote: post #116
k8svet wrote: post #113

I have such immense disdain for Capital One and MasterCard for how they implement 3DS. I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number. Their "solution" is to have a family member in the US add their number to my account, wake up in the…

wise.com is pretty good for international card stuff. You send them a bit of money and they send you a card etc.

Except the card won't work as they say it should as chip-n-pin in Europe (signature required every time and of course it doesn't work for transit). At least not if you're me. Spent hours going back and forth with their support to be finally told that I should try requesting a new card.

Re: Tell HN: Automatic fraud detection is making my life hell

#296

Post by nirvdrum »

thedougd wrote: post #180
cj wrote: post #137

Earlier quoted context omitted.

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…

I use my Google Voice number for everything that’s not family or friend.

Likewise. It's amazing how much SMS spam I get on Google Voice number relative to my primary number. Google Voice makes it easy to blackhole numbers and at least some form of spam filtering. If it's going to rule out potential employers, so be it.

Re: Tell HN: Automatic fraud detection is making my life hell

#297

Post by dboreham »

orangepurple wrote: post #258
mitthrowaway2 wrote: post #249

Earlier quoted context omitted.

I wanted to use them, but they'd only accept payment via Plaid, that ridiculous service where I have to hand my banking password to a third party -- you know, the exact thing that we all know to never ever do. That's a nope for me, sadly.

That's not true at all. You can move money via ACH.

Are you sure? My USD Wise "account" has no sort code nor account number (unlike other currency accounts I hold), so nobody can initiate an ACH transfer into it. There is a button to initiate an ACH transfer "in" but it has to come from my linked bank account. Linked with the aforementioned Plaid.

Re: Tell HN: Automatic fraud detection is making my life hell

#298

Post by chinchilla2020 »

cj wrote: post #137
dreamcompiler wrote: post #131

Wrong assumptions programmers make about fraud prevention: -- A mobile phone number uniquely identifies a single person. -- Every person has a mobile phone number and they only have one mobile phone number. -- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. -- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under…

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive. > If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud. I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discov…

The cost of the false positives are much higher than the false negatives.

Temporarily slowing down down 99 scammers is not worth stranding one normal person in a foreign country with no means to access their money and no means to recover their account.

The reality is that most lockdown-type protection schemes are just a roadbump, not a solution. They slow down the attacker. In fact, hackers are employing account lockouts to lock security teams and management out of their own accounts when they launch an attack.

I'm with OP on this one. The banks have completely failed to protect against fraud while causing massive economic damage with their clueless security design.

Re: Tell HN: Automatic fraud detection is making my life hell

#299

Post by viraptor »

toast0 wrote: post #293
rsync wrote: post #262

Earlier quoted context omitted.

... which reminds me of an experiment I keep meaning to run: Can I do a quick wifi survey (somewhere) and then replicate the SSIDs and channels in a completely different location and fool one of these SSID mapping functions ? What are these functions scanning for to perform the geolocation other than SSID and frequency and MAC addresses ? Relative or triangulated signal strength ?

Almost certainly. I'd guess most of these services are usinf BSSID (more or less mac address of the access point) instead of SSID and not using channel number or signal strength. If you report GPS position and BSSIDs anytime you see them, you can probably approximate a location when you only have a BSSID. IIRC, precision is fairly low for wifi approximated position, but maybe it's gotten better since I last looked. I…

You can find bssid and other details from around the world at https://wigle.net/map

Re: Tell HN: Automatic fraud detection is making my life hell

#300

Post by dboreham »

EVa5I7bHFq9mnYK wrote: post #188
didip wrote: post #103

To quickly solve some of your pain, pay a VPN node in America and just proxy requests through it. Small amount of money compared to the stress.

VPN is a #1 sign of a fraudster, you will quickly learn this truing to use a VPN.

Parent may mean a VPN in the traditional (before wall to wall shills on YouTube) sense. Where you tunnel to your own network: home or office.
Post reply on HN