What if a real users mistypes their credit card number... your order was successful.
Typing the wrong credit card number would be a legitimate error, not evidence of fraud. You can show that error. It won't affect how you deal with the actual fraud.
How Candy Japan got credit card fraud somewhat under control
31–40 of 128 posts
Re: How Candy Japan got credit card fraud somewhat under control
#32What's the best way to do "no immediate feedback" when you're selling something that is instantly delivered? (Site paywalls, for instance.)
My initial solution would be a restricted trial that is mandatory and lifts when the scheduled subscription date hits and is successful.
The 'trial' period is advertising.
Re: How Candy Japan got credit card fraud somewhat under control
#33Earlier quoted context omitted.
Yeah I was just talking to an employee of a CC fraud prevention company and that was my thought: they proudly talk about how they can identify fraud and refuse the transaction, when my question was, why not just look like you're approving the order and then follow it right to the fraudster? Better to reliably catch the humans behind this and impose stringent legal penalties than allow them to keep guessing without a…
This may work nicely for a subscription business where you have 2 weeks to identify problematic orders. But what about everyone else? Should we silently fail on orders where a customer accidentally mistyped their CC#? Imagine all the extra work involved when you could have had them fix it on the spot.
You can report "failed checksum" or "not a valid account" to people, although you should rate limit - the problem is data that is valid but stolen.
Re: How Candy Japan got credit card fraud somewhat under control
#34Earlier quoted context omitted.
Yeah I was just talking to an employee of a CC fraud prevention company and that was my thought: they proudly talk about how they can identify fraud and refuse the transaction, when my question was, why not just look like you're approving the order and then follow it right to the fraudster? Better to reliably catch the humans behind this and impose stringent legal penalties than allow them to keep guessing without a…
This may work nicely for a subscription business where you have 2 weeks to identify problematic orders. But what about everyone else? Should we silently fail on orders where a customer accidentally mistyped their CC#? Imagine all the extra work involved when you could have had them fix it on the spot.
Mistyped card numbers can be identified client-side (CC numbers have a checksum digit). If the number is valid, but the transaction is declined, then fail silently (and possibly send a failure email after manual review of the transaction)
Re: How Candy Japan got credit card fraud somewhat under control
#35What's the best way to do "no immediate feedback" when you're selling something that is instantly delivered? (Site paywalls, for instance.)
Do paywalls face as much fraud? My understanding is that industries that provide digital goods or services see a much lower rate of fraud because there's little resale value involved (and the cost of stolen/returned goods is much lower).
It sounds like the biggest problem that OP is talking about is people using his service to validate credit card numbers. They don't particularly care about the candy, they just want to know if a number has been cancelled yet.
Re: How Candy Japan got credit card fraud somewhat under control
#36If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…
that why every social network does ghosting to trick spammers and trolls
Re: How Candy Japan got credit card fraud somewhat under control
#37Earlier quoted context omitted.
This may work nicely for a subscription business where you have 2 weeks to identify problematic orders. But what about everyone else? Should we silently fail on orders where a customer accidentally mistyped their CC#? Imagine all the extra work involved when you could have had them fix it on the spot.
Mistyped card numbers can be identified client-side (CC numbers have a checksum digit). If the number is valid, but the transaction is declined, then fail silently (and possibly send a failure email after manual review of the transaction)
It could also be declined because of mistyped expiry date or address or name. Or simply declined because the customer is over their credit limit. In all of these cases, timely feedback is useful for genuine customers.
Re: How Candy Japan got credit card fraud somewhat under control
#38What's the best way to do "no immediate feedback" when you're selling something that is instantly delivered? (Site paywalls, for instance.)
Do paywalls face as much fraud? My understanding is that industries that provide digital goods or services see a much lower rate of fraud because there's little resale value involved (and the cost of stolen/returned goods is much lower).
He's not concerned about fraud where he is out goods, he's concerned about fraud where he's being used as a card verification tool. Checking the validity of credit cards is expensive and hard for carders; They need to do so fast and in bulk, but without setting off the fraud detection on the other side and killing the card.
Re: How Candy Japan got credit card fraud somewhat under control
#39I'm guessing this has been asked before, but why not just use a credit card processor that handles all of that stuff for you. Seems like they are in the business of selling Japanese candy, not preventing CC fraud. Am I being naive here?
Can you name a credit card processor that handles all of that stuff for you? Neither the old-school gateways (Authorize.net/etc) nor the new SaaSy stuff (Stripe/Braintree/etc) offer even risk scoring, let alone a comprehensive solution to fraud mitigation.
Re: How Candy Japan got credit card fraud somewhat under control
#40So it appears that a combination of (1) removing instant feedback (not alerting fraudsters as to the success/failure of their charge) and (2) giving a grace period to review and cancel charges has given Candy Japan some breathing room. Though it does seem that this requires a manual step (2) before sending charges through, does anyone have experience using a fraud detection API, like Maxmind's minFraud [1] or any oth…
>does anyone have experience using a fraud detection API, like Maxmind's minFraud
We tried MaxMind, for our use case it was pretty useless. The feature that sort of worked which we considered using was the geo-location stuff. Our idea was to see how close a customer was to where the goods where to be sent. Sadly the countries we operate in are to small, and IP location is to inaccurate.
As a test we ran a couple of months worth of fraudulent order data through MaxMind, with a success rate of 100%.
The best solutions we found is: - Block cards not issued in the country where you operate. This shield us from poor credit card security in countries like the US. - Enabled 3D Secure. This blocks all the amateurs - Manually call customers ordering for large amounts.
Generally speaking it's very difficult to tell the difference between a fraudulent order and a first time customer.