Engineering manager for Stripe Radar here. Today’s update has been almost a year in the making and we’re excited to help Stripe businesses fight fraud more effectively. Here's more on what's new: https://stripe.com/blog/radar-2018 I (and the entire Radar team) are on hand to answer any questions you may have!
What prevented you from introducing changes incrementally rather than a “almost a year in the making” release? Edit: no polemic intended
Improved fraud prevention with Radar 2.0
51–60 of 83 posts
Re: Improved fraud prevention with Radar 2.0
#52Earlier quoted context omitted.
We’re really sorry that you ran into this. There are a couple things we can help you with: - We give users the ability to disable the default rules and mark transactions as safe if you write in to support@stripe.com (so in the example you gave of a user clearing transactions with his or her bank, if Radar incorrectly blocked a subsequent payment because of high card velocity, you could mark it as safe and subsequent…
> so the primary reason might be that the IP is in country X, but that doesn’t mean there’s a blanket ban on X—just that that reason combined with everything else we saw across thousands of signals resulted in our giving the payment a high score It might not be that one reason, but could it be something like the following two? Because that would be practically equivalent in terms of unacceptability: 1. Customer IP is…
A little more color: Stripe’s incentives are aligned with those of our users in that we want to let through as many legitimate customers as possible. We keep a very close eye on false positives.
Our machine learning models examine thousands of attributes for each payment and make predictions based on how frequently the observed attributes were associated with fraud in the past. The comparison here is never just on one or two or three attributes (as in your example), and no logic is hard-coded.
Re: Improved fraud prevention with Radar 2.0
#53Ok some really dumb questions if you don't mind, but how "fraud detection" works has always been one of those areas I am interested in, but not enough to seek out a practitioner and pin them down - until now ! - Any idea what the total fraud vs genuine transactions ratio is? And how that breaks down across industries? I am assuming that SaaS services don't get as much of this - i mean would people buy bingo cards wit…
Once you get your hands on someone else's card info, you bust out by buying as many prepaid Visa cards and store gift cards as their limit allows before the card gets shut down. Then you use them or fence them for cash by selling them on Craigslist.
Re: Improved fraud prevention with Radar 2.0
#54I really hope that this improves the false-positive rate, as mentioned in another comment. We've been hurt badly as a startup breaking into the US market and getting many of our genuine charges blocked by Radar (and at a "highest risk" level where it is not possible to disable rules). As a developer, I had the best possible impression of Stripe, as they provide easily the cleanest API and best documentation of any pa…
>We had one payment blocked by Radar due to it being from a "high risk location" This, to me, represents the worst that banking fraud protection has to offer. Just yesterday I (from the USA) tried to purchase a software license for a tool I've been using the free version of for a long time. My card was declined, so I used my American Express. About two hours later, I got a call from my bank's fraud department saying…
Re: Improved fraud prevention with Radar 2.0
#55Engineering manager for Stripe Radar here. Today’s update has been almost a year in the making and we’re excited to help Stripe businesses fight fraud more effectively. Here's more on what's new: https://stripe.com/blog/radar-2018 I (and the entire Radar team) are on hand to answer any questions you may have!
One of the issues that I faced during my short stint building ML models for fraud detection in debit card transactions was dealing with class imbalance. I was not completely convinced that over sampling techniques or under sampling techniques would work. My initial experiments just resulted in more false positives. Just curious if you guys faced similar problems. The other point I bring about is rather rhetorical - T…
Re: Improved fraud prevention with Radar 2.0
#56I really hope that this improves the false-positive rate, as mentioned in another comment. We've been hurt badly as a startup breaking into the US market and getting many of our genuine charges blocked by Radar (and at a "highest risk" level where it is not possible to disable rules). As a developer, I had the best possible impression of Stripe, as they provide easily the cleanest API and best documentation of any pa…
Got the some exact issues that you mention. Also in the US, not that much in Europe. Given the kind of company that we are, we lose way more from false-positives than from true-positives. With this system in place, Stripe is punishing legit users and businesses, with no way to change the default behavior. I enjoy using Stripe as the next guy, but this needs to radically improve. At least provide me as a merchant a bu…
Re: Improved fraud prevention with Radar 2.0
#57I really hope that this improves the false-positive rate, as mentioned in another comment. We've been hurt badly as a startup breaking into the US market and getting many of our genuine charges blocked by Radar (and at a "highest risk" level where it is not possible to disable rules). As a developer, I had the best possible impression of Stripe, as they provide easily the cleanest API and best documentation of any pa…
I was lucky that the particular merchant was a friend, so I could personally reach out and see his side of the accounts and submit it as evidence to my bank, but I didn't think for a second that I could trust Stripe to handle that despite their involvement.
Re: Improved fraud prevention with Radar 2.0
#58Earlier quoted context omitted.
Got the some exact issues that you mention. Also in the US, not that much in Europe. Given the kind of company that we are, we lose way more from false-positives than from true-positives. With this system in place, Stripe is punishing legit users and businesses, with no way to change the default behavior. I enjoy using Stripe as the next guy, but this needs to radically improve. At least provide me as a merchant a bu…
(PM on Radar here.) This button exists! You can mark a transaction as safe directly from the Stripe Dashboard. If you don’t see this feature for whatever reason, just email support@stripe.com and we’ll get you access.
But only manually and retrospectively, no? For an online subscription business with extensive automation, if one of us has to go to the dashboard to fix something like this, that sale was probably already lost anyway. More likely, that failed charge already resulted in cancelling the subscription and all that follows, with a relatively low chance the subscriber will start again later.
From various recent HN discussions, I get the feeling that the team at Stripe totally fail to understand how devastating these false positives are to the growth of an online subscription business. For example, I have one business where it's not unusual for the majority of the entire churn in a month to be due to unexplained card payment failures with Stripe. Based on a back-of-envelope calculation, that business would be around 50-100% bigger today if those charges had worked and everything else followed the usual patterns.
Re: Improved fraud prevention with Radar 2.0
#59Earlier quoted context omitted.
(PM on Radar here.) This button exists! You can mark a transaction as safe directly from the Stripe Dashboard. If you don’t see this feature for whatever reason, just email support@stripe.com and we’ll get you access.
You can mark a transaction as safe directly from the Stripe Dashboard. But only manually and retrospectively, no? For an online subscription business with extensive automation, if one of us has to go to the dashboard to fix something like this, that sale was probably already lost anyway. More likely, that failed charge already resulted in cancelling the subscription and all that follows, with a relatively low chance…
It’s possible you’re using our Billing product, which gives subscription logic out of the box. It’s also possible you’re not, and have rolled your own subscriptions.
If you’re using Billing:
We take into account that it’s a repeating charge and special-case that for fraud detection purposes, because it’s highly unlikely that a happy customer decides to become a credit card fraudster N months in. We can also do dunning (automated recovery of subscriptions) via email, so a single charge failure shouldn’t result in you losing the relationship.
If you’re not using Billing: we have a way to mark a charge as safe when you present it via the API, which you could do on e.g. established customers. (On the charge creation request, pass in {"fraud_details" : {"user_report" : "safe"}} or whatever the equivalent is in your language of choice.) You can do this for any charge where your business has prior knowledge regarding the transaction; we'll both a) respect the decision and b) update the fraud model accordingly. Note that your customer's bank is the ultimate authority on whether a charge goes through; they may decide to decline it for a variety of reasons even if you and Stripe believe the charge to likely be good.
You have a business decision to make regarding what you want to happen in the event that all automated systems fail to get a user back to a happily paying state. One option is to automatically cancel the subscription. I recommend you don’t do that in a subscriptions business, unless you have very, very tight margins (e.g. physical product not SaaS). We expose an option in our Billing product to keep the subscription active even if it isn’t being paid; we’d probably recommend you use that option and only cancel subscriptions on an explicit user request. This is a particularly important thing in B2B SaaS, where price points generally give you enough of a budget to get in contact with substantially everyone who churns and where it’s very easy for a single person associated with an account to e.g. ignore a few emails about it accidentally without having the intention to cancel.
Re: Improved fraud prevention with Radar 2.0
#60Earlier quoted context omitted.
Most of our ML stack has been developed internally given the unique constraints we have for Radar. Among other things, we need to be able to - compute a huge number of features, many of which are quite complex (involving data collected from throughout the payment process), in real-time: e.g. how many distinct IP addresses have we seen this card from over its entire history on Stripe, how many distinct cards have we s…
Broadly speaking, what approach do you use to "build simpler 'explanation models'" from the more complicated "core fraud models"? Do you learn the models separately over the training data, or does the more complicated model somehow influence the training of the simpler model?