Live data from Hacker News

Improved fraud prevention with Radar 2.0

stripe.com

51–60 of 83 posts

Re: Improved fraud prevention with Radar 2.0

#51
post #43
post #2

Engineering manager for Stripe Radar here. Today’s update has been almost a year in the making and we’re excited to help Stripe businesses fight fraud more effectively. Here's more on what's new: https://stripe.com/blog/radar-2018 I (and the entire Radar team) are on hand to answer any questions you may have!

What prevented you from introducing changes incrementally rather than a “almost a year in the making” release? Edit: no polemic intended

We’ve been working on Radar, and releasing updates and improvements, continuously since we first launched. What we’re announcing today is (1) a completely revamped machine learning system (which we couldn’t release in pieces—we needed to finish every layer of the stack before we could launch it, though we’ve been running it in beta for a percentage of users since late last year) and (2) a new package of features specifically designed for teams working on fraud prevention.

Re: Improved fraud prevention with Radar 2.0

#52
post #31

Earlier quoted context omitted.

We’re really sorry that you ran into this. There are a couple things we can help you with: - We give users the ability to disable the default rules and mark transactions as safe if you write in to support@stripe.com (so in the example you gave of a user clearing transactions with his or her bank, if Radar incorrectly blocked a subsequent payment because of high card velocity, you could mark it as safe and subsequent…

> so the primary reason might be that the IP is in country X, but that doesn’t mean there’s a blanket ban on X—just that that reason combined with everything else we saw across thousands of signals resulted in our giving the payment a high score It might not be that one reason, but could it be something like the following two? Because that would be practically equivalent in terms of unacceptability: 1. Customer IP is…

In short, no.

A little more color: Stripe’s incentives are aligned with those of our users in that we want to let through as many legitimate customers as possible. We keep a very close eye on false positives.

Our machine learning models examine thousands of attributes for each payment and make predictions based on how frequently the observed attributes were associated with fraud in the past. The comparison here is never just on one or two or three attributes (as in your example), and no logic is hard-coded.

Re: Improved fraud prevention with Radar 2.0

#53

Ok some really dumb questions if you don't mind, but how "fraud detection" works has always been one of those areas I am interested in, but not enough to seek out a practitioner and pin them down - until now ! - Any idea what the total fraud vs genuine transactions ratio is? And how that breaks down across industries? I am assuming that SaaS services don't get as much of this - i mean would people buy bingo cards wit…

> how does fraud get monetised? Once i have downloaded my millions of credit card numbers from Tor (or stolen my friends mothers wallet) I need to persuade a merchant to deliver me something - but it's always bugged me that they actually have to deliver it. to a physical address. that can presumably be traced.

Once you get your hands on someone else's card info, you bust out by buying as many prepaid Visa cards and store gift cards as their limit allows before the card gets shut down. Then you use them or fence them for cash by selling them on Craigslist.

Re: Improved fraud prevention with Radar 2.0

#54

I really hope that this improves the false-positive rate, as mentioned in another comment. We've been hurt badly as a startup breaking into the US market and getting many of our genuine charges blocked by Radar (and at a "highest risk" level where it is not possible to disable rules). As a developer, I had the best possible impression of Stripe, as they provide easily the cleanest API and best documentation of any pa…

>We had one payment blocked by Radar due to it being from a "high risk location" This, to me, represents the worst that banking fraud protection has to offer. Just yesterday I (from the USA) tried to purchase a software license for a tool I've been using the free version of for a long time. My card was declined, so I used my American Express. About two hours later, I got a call from my bank's fraud department saying…

I had something similar happen a few years ago when I bought a ReSharper license and had to call the bank to reassure them that JetBrains is a reputable company. I found it odd that they blocked the transaction based on location (Czech Republic) alone instead of bothering to do any research whatsoever into individual vendors. It would have taken them all of 30 seconds on Google to realize JetBrains should be whitelisted.

Re: Improved fraud prevention with Radar 2.0

#55
post #15
post #2

Engineering manager for Stripe Radar here. Today’s update has been almost a year in the making and we’re excited to help Stripe businesses fight fraud more effectively. Here's more on what's new: https://stripe.com/blog/radar-2018 I (and the entire Radar team) are on hand to answer any questions you may have!

One of the issues that I faced during my short stint building ML models for fraud detection in debit card transactions was dealing with class imbalance. I was not completely convinced that over sampling techniques or under sampling techniques would work. My initial experiments just resulted in more false positives. Just curious if you guys faced similar problems. The other point I bring about is rather rhetorical - T…

The problem with fraud openness is that you’re effectively teaching people how to commit fraud.

Re: Improved fraud prevention with Radar 2.0

#56
post #44

I really hope that this improves the false-positive rate, as mentioned in another comment. We've been hurt badly as a startup breaking into the US market and getting many of our genuine charges blocked by Radar (and at a "highest risk" level where it is not possible to disable rules). As a developer, I had the best possible impression of Stripe, as they provide easily the cleanest API and best documentation of any pa…

Got the some exact issues that you mention. Also in the US, not that much in Europe. Given the kind of company that we are, we lose way more from false-positives than from true-positives. With this system in place, Stripe is punishing legit users and businesses, with no way to change the default behavior. I enjoy using Stripe as the next guy, but this needs to radically improve. At least provide me as a merchant a bu…

(PM on Radar here.) This button exists! You can mark a transaction as safe directly from the Stripe Dashboard. If you don’t see this feature for whatever reason, just email support@stripe.com and we’ll get you access.

Re: Improved fraud prevention with Radar 2.0

#57

I really hope that this improves the false-positive rate, as mentioned in another comment. We've been hurt badly as a startup breaking into the US market and getting many of our genuine charges blocked by Radar (and at a "highest risk" level where it is not possible to disable rules). As a developer, I had the best possible impression of Stripe, as they provide easily the cleanest API and best documentation of any pa…

I didn't really think of it until I read this but it appears to highlight a situation I once had, and I assumed it was just down to a shitty Wordpress plugin implementation. I got 'declined payment' errors twice and, what's worse, the money was still taken from my account on both occasions! In one instance it was refunded five minutes later but the second failure didn't get the same treatment, so Stripe had rejected the payment after taking it, but my bank saw it as fulfilled.

I was lucky that the particular merchant was a friend, so I could personally reach out and see his side of the accounts and submit it as evidence to my bank, but I didn't think for a second that I could trust Stripe to handle that despite their involvement.

Re: Improved fraud prevention with Radar 2.0

#58
post #56
post #44

Earlier quoted context omitted.

Got the some exact issues that you mention. Also in the US, not that much in Europe. Given the kind of company that we are, we lose way more from false-positives than from true-positives. With this system in place, Stripe is punishing legit users and businesses, with no way to change the default behavior. I enjoy using Stripe as the next guy, but this needs to radically improve. At least provide me as a merchant a bu…

(PM on Radar here.) This button exists! You can mark a transaction as safe directly from the Stripe Dashboard. If you don’t see this feature for whatever reason, just email support@stripe.com and we’ll get you access.

You can mark a transaction as safe directly from the Stripe Dashboard.

But only manually and retrospectively, no? For an online subscription business with extensive automation, if one of us has to go to the dashboard to fix something like this, that sale was probably already lost anyway. More likely, that failed charge already resulted in cancelling the subscription and all that follows, with a relatively low chance the subscriber will start again later.

From various recent HN discussions, I get the feeling that the team at Stripe totally fail to understand how devastating these false positives are to the growth of an online subscription business. For example, I have one business where it's not unusual for the majority of the entire churn in a month to be due to unexplained card payment failures with Stripe. Based on a back-of-envelope calculation, that business would be around 50-100% bigger today if those charges had worked and everything else followed the usual patterns.

Re: Improved fraud prevention with Radar 2.0

#59
post #56

Earlier quoted context omitted.

(PM on Radar here.) This button exists! You can mark a transaction as safe directly from the Stripe Dashboard. If you don’t see this feature for whatever reason, just email support@stripe.com and we’ll get you access.

You can mark a transaction as safe directly from the Stripe Dashboard. But only manually and retrospectively, no? For an online subscription business with extensive automation, if one of us has to go to the dashboard to fix something like this, that sale was probably already lost anyway. More likely, that failed charge already resulted in cancelling the subscription and all that follows, with a relatively low chance…

Could you write to us to speak in more detail about the business seeing a majority of churn due to payment failures? That’s surprising to us; we’d love to help you debug it. My address is my HN username at stripe.com. We’re keenly aware of how SaaS math works and are as enthusiastic about your business growing as you are.

It’s possible you’re using our Billing product, which gives subscription logic out of the box. It’s also possible you’re not, and have rolled your own subscriptions.

If you’re using Billing:

We take into account that it’s a repeating charge and special-case that for fraud detection purposes, because it’s highly unlikely that a happy customer decides to become a credit card fraudster N months in. We can also do dunning (automated recovery of subscriptions) via email, so a single charge failure shouldn’t result in you losing the relationship.

If you’re not using Billing: we have a way to mark a charge as safe when you present it via the API, which you could do on e.g. established customers. (On the charge creation request, pass in {"fraud_details" : {"user_report" : "safe"}} or whatever the equivalent is in your language of choice.) You can do this for any charge where your business has prior knowledge regarding the transaction; we'll both a) respect the decision and b) update the fraud model accordingly. Note that your customer's bank is the ultimate authority on whether a charge goes through; they may decide to decline it for a variety of reasons even if you and Stripe believe the charge to likely be good.

You have a business decision to make regarding what you want to happen in the event that all automated systems fail to get a user back to a happily paying state. One option is to automatically cancel the subscription. I recommend you don’t do that in a subscriptions business, unless you have very, very tight margins (e.g. physical product not SaaS). We expose an option in our Billing product to keep the subscription active even if it isn’t being paid; we’d probably recommend you use that option and only cancel subscriptions on an explicit user request. This is a particularly important thing in B2B SaaS, where price points generally give you enough of a budget to get in contact with substantially everyone who churns and where it’s very easy for a single person associated with an account to e.g. ignore a few emails about it accidentally without having the intention to cancel.

Re: Improved fraud prevention with Radar 2.0

#60
post #30
post #19

Earlier quoted context omitted.

Most of our ML stack has been developed internally given the unique constraints we have for Radar. Among other things, we need to be able to - compute a huge number of features, many of which are quite complex (involving data collected from throughout the payment process), in real-time: e.g. how many distinct IP addresses have we seen this card from over its entire history on Stripe, how many distinct cards have we s…

Broadly speaking, what approach do you use to "build simpler 'explanation models'" from the more complicated "core fraud models"? Do you learn the models separately over the training data, or does the more complicated model somehow influence the training of the simpler model?

Why you so stubborn on IP address? Its not a holy grail! I use proxy for some years now and many times I want to buy something on the frontstore “powered by Stripe” and my card is declined due to “unknow error”. Moment I turn off my vpn, transaction goes thru. I can exect this to be a huge problem for Stripe or anyone deciding on fraud attempt greatly basing it on IP. These days if i find a cool product and see “powered by Stripe” I simply end up on Amazon purchasing same product for similar price. Worst part — your clients don’t even know!
Post reply on HN