51–60 of 128 posts
Earlier quoted context omitted.
You check the card number via the Luhn algorithm, and tell them about it? That's not giving any data to fraudsters.
If you at any point have access to the customers credit card number, then your doing something horribly wrong. Unless you're the payment processor.
Earlier quoted context omitted.
You check the card number via the Luhn algorithm, and tell them about it? That's not giving any data to fraudsters.
If you at any point have access to the customers credit card number, then your doing something horribly wrong. Unless you're the payment processor.
Earlier quoted context omitted.
Mistyped card numbers can be identified client-side (CC numbers have a checksum digit). If the number is valid, but the transaction is declined, then fail silently (and possibly send a failure email after manual review of the transaction)
It could also be declined because of mistyped expiry date or address or name. Or simply declined because the customer is over their credit limit. In all of these cases, timely feedback is useful for genuine customers.
In some instances it is worth it to make the experience marginally worse for customers because the savings by preventing a percentage of fraud are so large.
Earlier quoted context omitted.
Yep, PayPal is awesome at this. I originally intended to go on a long tirade about how PayPal had dealt with this, but cut it out as the post was starting to get a bit long. --- Peter Thiel on PayPal: "In mid-2000, we had survived the dot-com crash and we were growing fast, but we faced one huge problem: we were losing upwards of $10 million to credit card fraud every month. Since we were processing hundreds or even…
I've heard Max Levchin describe Paypal as a "credit card fraud detection system that also accepts payments".
I have occasionally wondered how many of those foaming at the mouth tirades come from people who were actually scamming people and are angry that their take was locked away.
Earlier quoted context omitted.
If you at any point have access to the customers credit card number, then your doing something horribly wrong. Unless you're the payment processor.
Luhn algorithm can be done client-side - all it needs is the number.
Having the credit card field, where you can access it, means that you become a target for people wanting to inject javascript into your site. Perhaps you're safe, but what about all the third party javascript libraries or tracking/remarketing/tracking script most sites have?
Sorry, it's a really bad idea. Let you credit card processor deal with the that hassle.
If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…
Earlier quoted context omitted.
Most will sell to fraud detection for you, it's just expensive and typically not very good. PayPal is an option, unless you have low margins, it's a very expensive way of accepting a credit card. It's also a terrible user experience for people in countries that aren't to familiar with PayPal.
You can use PayPal as a credit card processor, with the user having no idea they are involved.
If you happen to have a link handy I would very much like see how they do it.
Earlier quoted context omitted.
You can use PayPal as a credit card processor, with the user having no idea they are involved.
Really? While still leaving all the input of credit card numbers to PayPal? I mean you'd still have to have some "landing page" with Paypal. If you happen to have a link handy I would very much like see how they do it.
What if a real users mistypes their credit card number... your order was successful.
You check the card number via the Luhn algorithm, and tell them about it? That's not giving any data to fraudsters.
But, ok, what about an innocent CCV typo.
You need to give real users errors when they make mistakes.