Live data from Hacker News

Candy Japan 2015 Year in Review

candyjapan.com

31–40 of 67 posts

Re: Candy Japan 2015 Year in Review

#31

Before people suggest bitcoin--and I love bitcoin--it probably wouldn't solve this guy's fraud problem. Yes, it would stop the fraud, but there are simply too few people willing to pay in bitcoin.

Who the truck would suggest bitcoin? Most people would suggest the services he is already using like PayPal.

Re: Candy Japan 2015 Year in Review

#32

I think Facebook or Twitter logins would go s long way to solving credit card issues. A credit card purchase backed by a 10+ friend FB account is unlikely to be a scammer. Legit Facebook accounts probably sell for more than the cc being tested.

How would you price 'legit' facebook accounts?

Re: Candy Japan 2015 Year in Review

#34
post #16

Earlier quoted context omitted.

I think there are bitcoin escrow payment systems.

The Bitcoin protocol supports multisig transactions. You can use it to implement escrow by including a third party public key and require 2 of 3 parties to sign the transaction.

So the mechanics are somewhat supported directly by bitcoin, but, how does the bitcoin customer get their money back even if the escrow company agrees that the terms of the sale weren't met? (added [1])

And then you still have a question of whether the parties agree to a mutually trusted escrow service to actually administer the signoff. I imagine that credit cards are somewhat partnered closer to the customer/card holder, but with bitcoin escrow it could be either the vendor or the customer?

Not meaning to criticise here, just a walking through unfamiliar territory.

Edit: Partially answered my own question (example 2 at link [1])

[1] https://en.bitcoin.it/wiki/Contract#Theory

Re: Candy Japan 2015 Year in Review

#35
post #5

I think someone else mentioned this in another post about this. Thought it was a great idea so I'll repeat it here: To prevent fraudsters from using you to authenticate their stolen credit cards, set it up so that every purchase automatically redirects to a 'order successful' page. After seeing that a few their credit card numbers all seem to work on your site, the fraudster will realize they can't use your site to t…

Would a simple delay in confirmation be enough to dissuade them? e.g. 10 mins? an hour? There's probably some critical threshold where it's not worth it for the criminal/s.

Since the candy can't be dispatched instantly anyway, you could arrange it to not affect delivery times.

Though of course, delayed confirmation would also put off genuine customers. So you could faux-confirm it instantly, and follow-up later if there's a problem. i.e. same as parent, but fully automated.

Re: Candy Japan 2015 Year in Review

#36

I think Facebook or Twitter logins would go s long way to solving credit card issues. A credit card purchase backed by a 10+ friend FB account is unlikely to be a scammer. Legit Facebook accounts probably sell for more than the cc being tested.

Trustev was a startup that did this. Indeed trivial to spoof though unless you do complex behaviour analysis of the account which seems hard to handle in the edge cases of mainstream users who aren't active in social media.

Re: Candy Japan 2015 Year in Review

#37
post #12
post #5

I think someone else mentioned this in another post about this. Thought it was a great idea so I'll repeat it here: To prevent fraudsters from using you to authenticate their stolen credit cards, set it up so that every purchase automatically redirects to a 'order successful' page. After seeing that a few their credit card numbers all seem to work on your site, the fraudster will realize they can't use your site to t…

There are several stages of CC validation. EX: http://www.experian.com/decision-analytics/credit-card-verif... M = Full match P = Partial match C = Match, but account is closed L = Match, but card is lost or stolen E = Invalid card number X = No record or security alert N = No match IMO, you can display an error page for some types of issues without helping scammers. However, for physical goods it's a good idea to wa…

Additionally if a customer is a repeated customer you may want to "whitelist" them, assuming they ever need to update their info (card expiration). Just a small tweak so they get feedback right away if they keep coming back.

Re: Candy Japan 2015 Year in Review

#38
Probably, one criminal found this site, then told others about it, who adopted it.

I wonder if the techniques for promoting adoption can be used in reverse, to deter adoption?

While keeping it familiar and convenient so as not to deter customers.

Re: Candy Japan 2015 Year in Review

#39
post #8

Earlier quoted context omitted.

Best reply, but... How often is a typo made (1:1000?), how much time for support staff is needed and how many lost orders due to a ~24 hour delay in some orders being placed. Also, easy to flood the system with bad orders that need to be manually sorted, like a fake order DDoS.

If a typo is made 1:1000 times Candy Japan would have had.. 2? At this small scale it's probably worth it - the loss of a customer isn't as big a problem as loss of physical goods.

Not to mention that you can verify the Luhn checksum on CC numbers and immediately catch ~90% of all typos (and 100% of single-digit typos). Don't even need a server call.

Re: Candy Japan 2015 Year in Review

#40
post #19

Earlier quoted context omitted.

Thanks, next year I want to get back and try to fix the situation. I fell back to PayPal only and have been losing customers since.

I'm not sure how strict you should go, we have gone to the absolute maximum - and have to deal with customer service issues / abandoned checkouts daily. But even requiring the ZIP code to be correct made a big difference. We're also using shopify which has helped quite a bit with their built in fraud analysis (Not 100% but I think it's either signifyd or kount providing the data). Alternatively, you could use Paypal…

I'm considering a bit going to some platform like Shopify, because I'm writing way more Python doing my own platform anyway. Integrating some solution would be just a few clicks if I were on some platform that they already support, instead of another API integration.
Post reply on HN