Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Candy Japan got credit card fraud somewhat under control

candyjapan.com

Post reply on HN
Print view View original

71–80 of 128 posts

Re: How Candy Japan got credit card fraud somewhat under control

#71

Post by bcoates »

thaeli wrote: post #20

What's the best way to do "no immediate feedback" when you're selling something that is instantly delivered? (Site paywalls, for instance.)

Allow anything that passes basic validity checks, then send a nice email a few days later asking for updated payment info. This is easiest if you're a subscription service as you'll want to have a process for recovering customers with expired CCs anyway. This is assuming you're in the usual case where the paywall is to stop free riders and not to reduce your costs.

Re: How Candy Japan got credit card fraud somewhat under control

#72

Post by kweks »

Osiris wrote: post #22

I have a website that processes a fairly small number of monthly credit card transactions, 1-4 per day. However, it didn't take long for the website to be used as a place for requests, mostly from Vietnam, to check the validity of CC numbers. It cost me a lot of money in chargeback fees. I ended up implementing a system using Braintree to do 1) Request an AUTHORIZATION for the amount 2) If the AUTHORIZATION fails, re…

We ran a fairly prominent online store for two years, and had huge amounts of fraud from the countries you mention.

We essentially stamped it out overnight by giving false positives. If we detected and order as fraudulent (and you can do it in a number of ways, that you seem to be doing) - we'd show a 'Successful Order' page and send them a success email.

The guys that were pre-testing cards had bad data, and the guys trying to fraud would have to wait .. weeks to find out nothing came in the mail, and then try again, unsure what got them caught in the first place.

Personally, I'd avoid trying to interract with their card. Authing / voiding is going to cost you money, and if it slips through, you'll get a chargeback.

We only ever had one 'false positive' (or false-negative..?) - the guy emailed us inquiring about his order, we took some extra steps to check his card, and the problem was solved.

Re: How Candy Japan got credit card fraud somewhat under control

#73

Post by omarchowdhury »

siberianbear wrote: post #45
TylerE wrote: post #28

Earlier quoted context omitted.

Why not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?

I am a native-born American citizen living in Russia. The amount of grief that your solution causes me is significant. I'm a legitimate customer who does nothing fraudulent. However, whole swaths of the internet treat me as if I have leprosy just because my IP address is in Russia.

So use a VPN, buddy.

Re: How Candy Japan got credit card fraud somewhat under control

#74

Post by rubber_duck »

siberianbear wrote: post #45
TylerE wrote: post #28

Earlier quoted context omitted.

Why not just refuse to do business with Vietnam, Nigeria, Russia, and other fraud havens entirely?

I am a native-born American citizen living in Russia. The amount of grief that your solution causes me is significant. I'm a legitimate customer who does nothing fraudulent. However, whole swaths of the internet treat me as if I have leprosy just because my IP address is in Russia.

Couldn't you use VPN ? On the other hand so could the scammers if you could.

Re: How Candy Japan got credit card fraud somewhat under control

#75

Post by duaneb »

tomp wrote: post #37
occamrazor wrote: post #34

Earlier quoted context omitted.

Mistyped card numbers can be identified client-side (CC numbers have a checksum digit). If the number is valid, but the transaction is declined, then fail silently (and possibly send a failure email after manual review of the transaction)

It could also be declined because of mistyped expiry date or address or name. Or simply declined because the customer is over their credit limit. In all of these cases, timely feedback is useful for genuine customers.

Nonetheless, this doesn't contradict the "failing silently" for chargebacks. It's not fraud if they enter the data poorly or there's no credit left so the charge is never made.

Re: How Candy Japan got credit card fraud somewhat under control

#76

Post by goodJobWalrus »

omarchowdhury wrote: post #73
siberianbear wrote: post #45

Earlier quoted context omitted.

I am a native-born American citizen living in Russia. The amount of grief that your solution causes me is significant. I'm a legitimate customer who does nothing fraudulent. However, whole swaths of the internet treat me as if I have leprosy just because my IP address is in Russia.

So use a VPN, buddy.

So, I use VPN, and order my stuff to arrive where? If someone doesn't ship to Russia, they don't ship to Russia, how can VPN help there?

Re: How Candy Japan got credit card fraud somewhat under control

#77

Post by jldugger »

stcredzero wrote: post #67
_gfrc wrote: post #56

Earlier quoted context omitted.

Blue Byte did something along the lines of your suggestion with the copyright protection of Settlers III. When the game detected that the DRM was broken, iron smelters would only produce pigs instead of iron. https://en.wikipedia.org/wiki/The_Settlers_III

Not bad, but even that reads like a bit of an FU from the devs. ("Pig Iron?") The best thing to do is to make it definitely seem like it was a bug introduced by the crack. (Maybe James Bond villains giving their secret projects suggestive code names and telling their entire plan isn't unrealistic?)

Well, if you want to convert a pirate user into a sale, you need to convince them that the bug isn't present in the retail copy.

So you're balancing making it hard for crackers to detect, and easy enough for players to encounter that shift behavior.

Re: How Candy Japan got credit card fraud somewhat under control

#78

Post by hellbanner »

viggity wrote: post #65
_gfrc wrote: post #56

Earlier quoted context omitted.

Blue Byte did something along the lines of your suggestion with the copyright protection of Settlers III. When the game detected that the DRM was broken, iron smelters would only produce pigs instead of iron. https://en.wikipedia.org/wiki/The_Settlers_III

reminds me of "Game Dev Tycoon", where if it detected it was cracked, the player had a hard time progressing because their virtual company kept getting ripped off by crackers. http://gameological.com/2013/05/inventory-9-games-with-creat... (it is the first one)

More specifically, the player's simualated video game company goes bankrupt, "due to piracy", according to the game.

More details & discussion from Game Dev Tycoon's developer blog: http://www.greenheartgames.com/2013/04/29/what-happens-when-...

Re: How Candy Japan got credit card fraud somewhat under control

#79

Post by Matt3o12_ »

josu wrote: post #61
optimiz3 wrote: post #27

Earlier quoted context omitted.

This also applies to customer service. Nice customers get fast response times. Toxic entitled customers (especially of the free plan) wait 2-3+ days before getting a response.

I'm not disagreeing with your point, but I love it when I get great customer support as a free/low value customer, and it definitely increases my chances of conversion.

Maybe op was referring to free customers that are rude, and impose big costs to you (way above the average support ticket).

But agreed, if I get bad support as a free customer, how can I know that the support will get any better if I start paying (except for services that sell support). When I get an instant response to a question from a friendly support, I would say that I'm far more likely to upgrade to their paid server.

Re: How Candy Japan got credit card fraud somewhat under control

#80

Post by kderbe »

stcredzero wrote: post #67
_gfrc wrote: post #56

Earlier quoted context omitted.

Blue Byte did something along the lines of your suggestion with the copyright protection of Settlers III. When the game detected that the DRM was broken, iron smelters would only produce pigs instead of iron. https://en.wikipedia.org/wiki/The_Settlers_III

Not bad, but even that reads like a bit of an FU from the devs. ("Pig Iron?") The best thing to do is to make it definitely seem like it was a bug introduced by the crack. (Maybe James Bond villains giving their secret projects suggestive code names and telling their entire plan isn't unrealistic?)

It's important not to disguise any anti-piracy measures as bugs, because pirates (or even reviewers playing pirated copies) will loudly proclaim that the game is buggy, and discourage legitimate buyers. This may have contributed to the closing of at least one development studio (Iron Lore, developer of Titan Quest)[1].

[1] http://www.quartertothree.com/game-talk/showthread.php?42663...

Post reply on HN