Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Candy Japan got credit card fraud somewhat under control

candyjapan.com

Post reply on HN
Print view View original

61–70 of 128 posts

Re: How Candy Japan got credit card fraud somewhat under control

#61

Post by josu »

optimiz3 wrote: post #27
stcredzero wrote: post #13

If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…

This also applies to customer service. Nice customers get fast response times. Toxic entitled customers (especially of the free plan) wait 2-3+ days before getting a response.

I'm not disagreeing with your point, but I love it when I get great customer support as a free/low value customer, and it definitely increases my chances of conversion.

Re: How Candy Japan got credit card fraud somewhat under control

#63

Post by comex »

jandrese wrote: post #54
michaelbuckbee wrote: post #17

Earlier quoted context omitted.

I've heard Max Levchin describe Paypal as a "credit card fraud detection system that also accepts payments".

This is also where the majority of "PayPal sux!" type posts come from. People who get caught up in the hyper vigilant fraud detection stuff and get their account locked. I have occasionally wondered how many of those foaming at the mouth tirades come from people who were actually scamming people and are angry that their take was locked away.

As someone who went through PayPal hell a few years ago, I'd say there is a lot they could do/have done to improve their customer service without impacting their fraud protection capability. I experienced issues like being bounced between different phone representatives offering different explanations for why my account was locked, a slow and duplicative process of uploading scans of identification documents, etc.. Just saying.

Re: How Candy Japan got credit card fraud somewhat under control

#64

Post by [deleted] »

jandrese wrote: post #54
michaelbuckbee wrote: post #17

Earlier quoted context omitted.

I've heard Max Levchin describe Paypal as a "credit card fraud detection system that also accepts payments".

This is also where the majority of "PayPal sux!" type posts come from. People who get caught up in the hyper vigilant fraud detection stuff and get their account locked. I have occasionally wondered how many of those foaming at the mouth tirades come from people who were actually scamming people and are angry that their take was locked away.

[deleted]

Re: How Candy Japan got credit card fraud somewhat under control

#65

Post by viggity »

_gfrc wrote: post #56
stcredzero wrote: post #13

If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…

Blue Byte did something along the lines of your suggestion with the copyright protection of Settlers III. When the game detected that the DRM was broken, iron smelters would only produce pigs instead of iron. https://en.wikipedia.org/wiki/The_Settlers_III

reminds me of "Game Dev Tycoon", where if it detected it was cracked, the player had a hard time progressing because their virtual company kept getting ripped off by crackers.

http://gameological.com/2013/05/inventory-9-games-with-creat... (it is the first one)

Re: How Candy Japan got credit card fraud somewhat under control

#66

Post by 77pt77 »

mrweasel wrote: post #40
mikejarema wrote: post #3

So it appears that a combination of (1) removing instant feedback (not alerting fraudsters as to the success/failure of their charge) and (2) giving a grace period to review and cancel charges has given Candy Japan some breathing room. Though it does seem that this requires a manual step (2) before sending charges through, does anyone have experience using a fraud detection API, like Maxmind's minFraud [1] or any oth…

>does anyone have experience using a fraud detection API, like Maxmind's minFraud We tried MaxMind, for our use case it was pretty useless. The feature that sort of worked which we considered using was the geo-location stuff. Our idea was to see how close a customer was to where the goods where to be sent. Sadly the countries we operate in are to small, and IP location is to inaccurate. As a test we ran a couple of m…

> Block cards not issued in the country where you operate

Please, don't do this. It's so annoying.

> Enabled 3D Secure

Yes, this is a really good idea.

Re: How Candy Japan got credit card fraud somewhat under control

#67

Post by stcredzero »

_gfrc wrote: post #56
stcredzero wrote: post #13

If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…

Blue Byte did something along the lines of your suggestion with the copyright protection of Settlers III. When the game detected that the DRM was broken, iron smelters would only produce pigs instead of iron. https://en.wikipedia.org/wiki/The_Settlers_III

Not bad, but even that reads like a bit of an FU from the devs. ("Pig Iron?") The best thing to do is to make it definitely seem like it was a bug introduced by the crack. (Maybe James Bond villains giving their secret projects suggestive code names and telling their entire plan isn't unrealistic?)

Re: How Candy Japan got credit card fraud somewhat under control

#68

Post by thesimon »

unfunco wrote: post #41
dangrossman wrote: post #39

Earlier quoted context omitted.

Can you name a credit card processor that handles all of that stuff for you? Neither the old-school gateways (Authorize.net/etc) nor the new SaaSy stuff (Stripe/Braintree/etc) offer even risk scoring, let alone a comprehensive solution to fraud mitigation.

Stripe does offer fraud protection, based on machine learning algorithms using data from their customers. https://stripe.com/docs/fraud

I'm working on a side project using Stripe and at least most comments on the internet are saying that the fraud prevention provided by Stripe is rather weak. Adding additional providers like SiftScience looks like a good idea.

Full Disclosure: Not based on first hand experience, as the project is not launched yet.

Re: How Candy Japan got credit card fraud somewhat under control

#69

Post by brightball »

stcredzero wrote: post #13

If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order. The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great.…

100% agree. They care about ROI also.

At my last company I build systems specifically designed around wasting the time of people that we "caught". We used to keep a dashboard with the top abusers on a wall in the office once they'd be caught to show how much of their time we were wasting. It was therapeutic.

Re: How Candy Japan got credit card fraud somewhat under control

#70

Post by bcoates »

TylerE wrote: post #28
Osiris wrote: post #22

I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees. I ended up implementing a system using Braintree to do 1) Request an AUTHORIZATION for the amount 2) If the AUTHORIZATION fails, re…

Why not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?

Because it's trivial for Vietnamese carders to pretend to be from any country they need to be if you're checking? They don't even need to actually get your delivery to win, they're just tasting for validity.
Post reply on HN