Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Candy Japan got credit card fraud somewhat under control

candyjapan.com

Post reply on HN
Print view View original

41–50 of 128 posts

Re: How Candy Japan got credit card fraud somewhat under control

#41

Post by unfunco »

dangrossman wrote: post #39
cheeze wrote: post #5

I'm guessing this has been asked before, but why not just use a credit card processor that handles all of that stuff for you. Seems like they are in the business of selling Japanese candy, not preventing CC fraud. Am I being naive here?

Can you name a credit card processor that handles all of that stuff for you? Neither the old-school gateways (Authorize.net/etc) nor the new SaaSy stuff (Stripe/Braintree/etc) offer even risk scoring, let alone a comprehensive solution to fraud mitigation.

Stripe does offer fraud protection, based on machine learning algorithms using data from their customers.

https://stripe.com/docs/fraud

Re: How Candy Japan got credit card fraud somewhat under control

#42

Post by bduerst »

TylerE wrote: post #28
Osiris wrote: post #22

I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees. I ended up implementing a system using Braintree to do 1) Request an AUTHORIZATION for the amount 2) If the AUTHORIZATION fails, re…

Why not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?

A simple situational cost/benefit analysis can answer that.

If combating CC fraud is leading to negative profits in those countries then cut them. If not, continue the war.

Re: How Candy Japan got credit card fraud somewhat under control

#43

Post by talawahdotnet »

mikejarema wrote: post #3

So it appears that a combination of (1) removing instant feedback (not alerting fraudsters as to the success/failure of their charge) and (2) giving a grace period to review and cancel charges has given Candy Japan some breathing room. Though it does seem that this requires a manual step (2) before sending charges through, does anyone have experience using a fraud detection API, like Maxmind's minFraud [1] or any oth…

I currently use Maxmind's midfraud service. It is useful for identifying KNOWN fraudulent email addresses and proxy servers but not much else. It is just one of the signals that I currently use as a part of a fairly manual fraud review process.

I have evaluated a number of different options and I am about to start using Sift Science[1]. In addition to using standard ip address/email based information they also use social data and machine learning to identify fraud.

Their API/data model is the most well thought out and comprehensive one that I have come across and they allow you to back-fill up to 12 months of historical data for free to help improve your detection rates. They also have a console to assist with optional manual review workflows and store integration apis to allow full automation.

On top of all that they offer scalable pricing that works for both large and small business at 6c per transaction.

Obviously I can't vouch for their results yet, but what I have seen so far looks pretty good. If you have a fraud issue you should at least check them out.

[1]https://siftscience.com/

Re: How Candy Japan got credit card fraud somewhat under control

#44

Post by mrweasel »

dangrossman wrote: post #39
cheeze wrote: post #5

I'm guessing this has been asked before, but why not just use a credit card processor that handles all of that stuff for you. Seems like they are in the business of selling Japanese candy, not preventing CC fraud. Am I being naive here?

Can you name a credit card processor that handles all of that stuff for you? Neither the old-school gateways (Authorize.net/etc) nor the new SaaSy stuff (Stripe/Braintree/etc) offer even risk scoring, let alone a comprehensive solution to fraud mitigation.

Actually of the old-school most credit card processors will sell you fraud detection. It's just very expensive, to expensive for small businesses. Normally they're just resell something like ReD Shield, or MaxMind though.

The best option is to get a PSP that will let you do selective fraud detection. Then you funnel large order and first time orders through the fraud detection, and skip it on repeat customers. Otherwise it can become an expensive service.

Re: How Candy Japan got credit card fraud somewhat under control

#45

Post by siberianbear »

TylerE wrote: post #28
Osiris wrote: post #22

I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees. I ended up implementing a system using Braintree to do 1) Request an AUTHORIZATION for the amount 2) If the AUTHORIZATION fails, re…

Why not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?

I am a native-born American citizen living in Russia.

The amount of grief that your solution causes me is significant. I'm a legitimate customer who does nothing fraudulent. However, whole swaths of the internet treat me as if I have leprosy just because my IP address is in Russia.

Re: How Candy Japan got credit card fraud somewhat under control

#46

Post by mrweasel »

devicenull wrote: post #23
ape4 wrote: post #19

What if a real users mistypes their credit card number... your order was successful.

You check the card number via the Luhn algorithm, and tell them about it? That's not giving any data to fraudsters.

If you at any point have access to the customers credit card number, then your doing something horribly wrong. Unless you're the payment processor.

Re: How Candy Japan got credit card fraud somewhat under control

#47

Post by landryraccoon »

When I worked on an e-commerce website shipping physical goods we would only ship to the customer's billing address for credit card payments. Anyone shipping to a different address needed to call their credit card company to add the address (every credit card company I've dealt with would allow customers to have multiple valid addresses on file), or use a different payment method. We never had big issues with fraud and I don't recall a customer ever complaining about it. I think in 3 years we had 2 chargebacks due to fraud.

Re: How Candy Japan got credit card fraud somewhat under control

#48

Post by mrweasel »

3dfan wrote: post #7

Is there no service that does CC processing and fraud detection already? I would think it does not make sense for every ecommerce merchant out there to build their own solution. Bemmu, you say you use PayPal - isn't PayPal also accepting Credit Cards? Don't they do the fraud detection in this case? I would expect them to have a huge advantage. You only see the IPs and other metadata from a few customers. They see mil…

Most will sell to fraud detection for you, it's just expensive and typically not very good.

PayPal is an option, unless you have low margins, it's a very expensive way of accepting a credit card. It's also a terrible user experience for people in countries that aren't to familiar with PayPal.

Re: How Candy Japan got credit card fraud somewhat under control

#49

Post by nkrisc »

mjevans wrote: post #32
thaeli wrote: post #20

What's the best way to do "no immediate feedback" when you're selling something that is instantly delivered? (Site paywalls, for instance.)

My initial solution would be a restricted trial that is mandatory and lifts when the scheduled subscription date hits and is successful. The 'trial' period is advertising.

Depending on the specific nature of the content (news content comes to mind) you could even just grant access for 24 hours and revoke it if fraud detection fails. This solution wouldn't work well for all types of content where the feature could be abused to harvest static content.

Re: How Candy Japan got credit card fraud somewhat under control

#50

Post by dboreham »

mrweasel wrote: post #48
3dfan wrote: post #7

Is there no service that does CC processing and fraud detection already? I would think it does not make sense for every ecommerce merchant out there to build their own solution. Bemmu, you say you use PayPal - isn't PayPal also accepting Credit Cards? Don't they do the fraud detection in this case? I would expect them to have a huge advantage. You only see the IPs and other metadata from a few customers. They see mil…

Most will sell to fraud detection for you, it's just expensive and typically not very good. PayPal is an option, unless you have low margins, it's a very expensive way of accepting a credit card. It's also a terrible user experience for people in countries that aren't to familiar with PayPal.

You can use PayPal as a credit card processor, with the user having no idea they are involved.
Post reply on HN