Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Candy Japan hit with credit card fraud

candyjapan.com

Post reply on HN
Print view View original

51–60 of 208 posts

Re: Candy Japan hit with credit card fraud

#51

Post by stevoski »

I commented this on yesterday's jsbin article, and I'll write it again.

Don't implement the payment processing code yourself. (And using Stripe is _still_ implementing it yourself - they supply only one part of the process.)

Writing this code will take time that you are not using to develop and market your product. (cf opportunity cost). Your code will be buggy. Your code will be weak. Your code will not support the various alternative payment options popular in, say, Holland. (Yes, this is a thing, and it is called iDEAL.) Your code will sooner or later be exposed to a campaign of fraudulent transactions.

Use FastSpring, or your alternative of choice. Yes, it costs more, if you don't put value on your weeks of time to create and support an alternative, and if are comfortable having a weak fraud detection, if any.

When your business becomes successful, when the fees to FastSpring start to dwarf the costs of implementing a payment system yourself, then - perhaps - consider re-doing it yourself.

There are indeed weaknesses in using FastSpring, which after seven years are becoming a pain for me. I'll be writing about that soon. But this is not an issue for a one-person endeavor getting started.

Re: Candy Japan hit with credit card fraud

#52

Post by CyberThijs »

SyneRyder wrote: post #39
chli wrote: post #27

Earlier quoted context omitted.

Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure I have to use it with most online shops here in Switzerland.

3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will fr…

Here in Belgium 3D-Secure is also commonplace, and the experience provided by my bank has significantly improved throughout the years. I also don't think it hurts the conversion of webshops around here because everybody is used to performing these extra steps.

It works as follows:

- Merchant redirects me to his payment provider

- I enter my debit/credit card number into the payment provider screen

- I am redirected to my bank website, and am able to verify the URL (no iframes anymore!)

- My bank has two methods of verification: scanning a QR-code with the mobile banking app on my phone, or logging into the online banking website (with a Vasco DIGIPASS 836, which requires a debit card+pin to generate a OTP)

- I verify the amount and creditor in the mobile/online banking app, and sign the transaction with my mobile pin/digipass.

- I am redirected back to the merchant.

All in all, I think it costs me 30 seconds to complete the extra 3D-Secure steps when using my mobile banking app.

Re: Candy Japan hit with credit card fraud

#53

Post by Nullabillity »

SyneRyder wrote: post #39
chli wrote: post #27

Earlier quoted context omitted.

Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure I have to use it with most online shops here in Switzerland.

3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will fr…

Sure, banks can do it really horribly (most of them), but some use it to force proper 2FA. For example, Nordea asks you to open their phone app and confirm the purchase (with a message that includes the total price) on there.

Re: Candy Japan hit with credit card fraud

#54

Post by Reason077 »

SyneRyder wrote: post #39
chli wrote: post #27

Earlier quoted context omitted.

Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure I have to use it with most online shops here in Switzerland.

3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate: https://news.ycombinator.com/item?id=10235328 That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will fr…

These verification mechanisms don't freak people out once people are used to them. Pretty much anyone who uses credit cards to buy anything online in Europe will have encountered this system before and will be more suspicious if they don't see it!

Using customers birthdate is indeed a very poor authentication mechanism, but even that is going to defeat the majority of fraudsters who are simply trying to bulk-authenticate a list of CC numbers. Personally, I don't give my real birthdate to any website unless they have a very good reason for knowing it.

My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc.

But since the actual authentication mechanism is left up to the card issuer, there's nothing to prevent them using more advanced systems - like 2-factor authentication, hardware tokens, etc.

Re: Candy Japan hit with credit card fraud

#55

Post by stevoski »

byron_fast wrote: post #11

Clearly, card companies are going to have to adjust their policies for failed transactions. It's not like it costs real money to decline a fraud attempt; stop punishing merchants.

Alternatively, small companies started by developers should stop thinking they can implement the payment and order handling code themselves, and learn that instead they should use a service that does this for them.

Re: Candy Japan hit with credit card fraud

#56

Post by jasontan »

markgavalda wrote: post #15

Currently we're integrating Sift Science to avoid this otherwise serious and annoying issue. I think it happens to everyone who's directly accepting credit cards online. Does anyone have experience with Sift Science or similar services? (I know MaxMind has one but that, to me, seems inferior to SS's.)

Hi Mark, CEO of Sift Science here. Thanks for giving us a shot. Please don't hesitate to ping me if you need any help or we're not delivering to your expectations. jason at siftscience dot com

Re: Candy Japan hit with credit card fraud

#57

Post by Reason077 »

foota wrote: post #22
Reason077 wrote: post #17

Earlier quoted context omitted.

Presumably, it would at least involve implementing "Verified by Visa", which protects online transactions by requiring a password or PIN. Mastercard and Amex have equivalent services, and these are all widely implemented by websites and card issuers in Europe and other countries. I suppose they are not so widely deployed in the USA or Japan, but at the very least, you'd protect yourself against fraud involving cards…

I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")

The actual authentication mechanism is left up to the card issuer. But using the card's PIN would be considered insecure due to the risk of malware/key-loggers intercepting it.

My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers.

Re: Candy Japan hit with credit card fraud

#58

Post by angusb »

byron_fast wrote: post #11

Clearly, card companies are going to have to adjust their policies for failed transactions. It's not like it costs real money to decline a fraud attempt; stop punishing merchants.

Yeah, I agree. I guess their argument is that it's difficult to catch every single fraud attempt, and in this case the behaviour was just not picked up by the processor's inbuilt fraud detection systems. Still, it should be the processor's responsibility.

GoCardless (Direct Debit, EU only at the moment) is one company that doesn't charge a fee for chargebacks. They take on all the risk themselves.

Re: Candy Japan hit with credit card fraud

#59

Post by jasontan »

beilabs wrote: post #24
markgavalda wrote: post #15

Currently we're integrating Sift Science to avoid this otherwise serious and annoying issue. I think it happens to everyone who's directly accepting credit cards online. Does anyone have experience with Sift Science or similar services? (I know MaxMind has one but that, to me, seems inferior to SS's.)

Came here to recommend a sift science type solution. I've previously integrated fraud systems like Cybersource (clunky interface, wouldn't recommend)

Thank you for the recommendation!

Re: Candy Japan hit with credit card fraud

#60

Post by rwmj »

foota wrote: post #22
Reason077 wrote: post #17

Earlier quoted context omitted.

Presumably, it would at least involve implementing "Verified by Visa", which protects online transactions by requiring a password or PIN. Mastercard and Amex have equivalent services, and these are all widely implemented by websites and card issuers in Europe and other countries. I suppose they are not so widely deployed in the USA or Japan, but at the very least, you'd protect yourself against fraud involving cards…

I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")

3D Secure can use 2 factor authentication, using a dongle supplied by your bank. Unfortunately there are so many other problems with 3D Secure that I wouldn't trust it except on high profile websites or for very technically competent users who are able to check the originating site and certificate of the iFrame used (ie. very few people indeed).
Post reply on HN