Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Candy Japan 2015 Year in Review

candyjapan.com

Post reply on HN
Print view View original

61–67 of 67 posts

Re: Candy Japan 2015 Year in Review

#61

Post by song »

tehwebguy wrote: post #15
jordanlev wrote: post #7

Earlier quoted context omitted.

How does one deem a purchase as legitimate or not? And how would you differentiate between a legit customer who mistyped their info versus a fraudulent attempt?

Some low hanging fruit: orders where the billing address is an exact match and it also matches the shipping address are probably the most likely to be legit. There are many more factors to consider though.

AVS which checks the billing address only really works in US. It's pretty much useless in any other countries in the world (it's partially supported by some banks in Canada and UK but that's it)

Re: Candy Japan 2015 Year in Review

#63

Post by gambiting »

thallium205 wrote: post #33

You should enable these services for the credit cards: Verified By Visa -> https://usa.visa.com/run-your-business/small-business-tools/... MasterCard SecureCode -> https://www.mastercard.us/en-us/consumers/features-benefits/...

Not everyone is from US.

Re: Candy Japan 2015 Year in Review

#64

Post by Xixi »

bemmu wrote: post #42

The initial post was just a draft I had neglected to make private, and wasn't finished (but thank you xixi for posting). I didn't spend the whole year solely battling CC fraud. I now wrote about other things that happened in 2015 now, so go back and refresh to read that part.

Sorry for publishing it too quickly!

Note that it was already very much indexed by Google: I was worried I was suffering from CC fraud on my Japanese tea subscription service [1], and so I was looking for the blog post that you published on the subject previously [2]. Instead I found this new blog post, so I thought it was ready for publishing.

[1] https://tomotcha.com/

[2] http://www.candyjapan.com/candy-japan-hit-with-credit-card-f...

Re: Candy Japan 2015 Year in Review

#65

Post by ripberge »

someone13 wrote: post #60
ripberge wrote: post #56

Earlier quoted context omitted.

Been using Stripe for years. There is no more fraud protection there than any other merchant credit card account.

Serious question (I haven't used a merchant credit card account): do regular accounts come with any fraud protection? The reason I ask is, I was sent a link to this a while ago, which seems to say that Stripe does do fraud protection: https://stripe.com/docs/fraud

It's hard to say, Stripe (or any other merchant account) may be blocking some charges, but you really don't have visibility into why a charge was blocked.

Regardless if they are blocking a lot or a little, they all let way too many fishy charges go through. They are just not incentivized to police fraud because in e-commerce its you who are on the hook for the charge back, not the bank or credit card company.

You cannot rely on your merchant bank (Stripe or anyone else) to do your fraud protection. You will get eaten alive.

Re: Candy Japan 2015 Year in Review

#66

Post by AlexMuir »

bemmu wrote: post #41
AlexMuir wrote: post #27

I think Facebook or Twitter logins would go s long way to solving credit card issues. A credit card purchase backed by a 10+ friend FB account is unlikely to be a scammer. Legit Facebook accounts probably sell for more than the cc being tested.

They would probably just start generating FB accounts, because a similar thing happened when I started requiring valid email addresses: they just went ahead and generated a bunch of gmail/hotmail accounts to use.

Generating Facebook accounts in bulk is not easy. I'm not suggesting that it's a panacea, but if you're looking for something to indicate a real purchase this would be strong. If someone logs in with Facebook and has 10+ friends then I'm going to say they are 99% legit. Plus you can look at their profile manually if you're in doubt. Of course you also offer email but those orders get more scrutiny. HN is an echo-chamber of hate for Facebook login but the real world (and I suspect your target market) does not share this.

Re: Candy Japan 2015 Year in Review

#67

Post by bRad389 »

loopbit wrote: post #43
gingerlime wrote: post #3

Interesting to read about those fraudsters. Really annoying when you're a small business. I remember reading something similar from Gittip[0], and also mentioned on the linked blog post, jsbin[1]. I wonder what other small startups are using to detect / prevent this kind of fraud? Are there any good services in this space? and why won't recurly/stripe et al bundle this in? (or maybe they do, and I just don't know abo…

All I can talk is from my personal experience, but as the founder of a startup that sells physical goods online, we've had no issue with fraudsters. At all. Granted, we are quite small and our volume of sales is not massive (Hey! Small startup with very little funding and mostly bootstrapped here), but still, I was expecting some kind of issue with this by now. Or at least people trying to get stuff for free. For the…

FYI You're actually more at risk than CandyJapan if you're shipping physical goods based on successful Auth and/or offer a low pricepoint item. Even without catching the uptick in orders, CandyJapan likely would be able to see some chargebacks or fraud advice before the bulk ship date (2x a month I believe).

One thing i've learned in my short time in the industry, fraudsters are great at finding weak merchants for card testing and triangulation schemes. What was 4 days worth of work for this fraudster, cost CJ thousands in fees, multiple days. How many late nights have been devoted to cleanups like this?

Also, a lot of payment processors are offering complex fraud solutions (ipGeo, proxyPiercing, device fingerprinting, etc) for pennies per Auth. definitely worth asking your processor and your processor's processor for more info. Beats being the lowest common denominator.

Post reply on HN