Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Candy Japan got credit card fraud somewhat under control

candyjapan.com

Post reply on HN
Print view View original

91–100 of 128 posts

Re: How Candy Japan got credit card fraud somewhat under control

#91

Post by dw23 »

aandon wrote: post #58

PM from a fraud detection company here. One thing I didn't see mentioned on this thread is Device ID, which is very common on fraud detection platforms. When a user comes to your website or mobile app, you have access to hundreds of signals from their device. Some like IP address are easy to spoof. Others like whether the user has changed their phone alarm from the default settings are often ignored by fraudsters but…

Interesting ... If u have a device id running on ur site , how do u tie a 'suspicious user' it flags with the orders made by that user ? I read abit about ur product and it's not clear how a web shop like candy Japan would integrate quick and dirty with this

Re: How Candy Japan got credit card fraud somewhat under control

#92

Post by fweespee_ch »

DiabloD3 wrote: post #87
bjano wrote: post #85

Earlier quoted context omitted.

There seems to be a huge conflict of interest here: as card processors slap you with an extra chargeback fee for the fraudulent transactions (in addition to the amount they take back anyway) it's difficult to believe that they would work very hard to help you avoid this.

Why? They have a profit motive for you to get scammed.

They do, to a point, but since you are the one who bears the fee they do the amount they can cost effectively which is frankly marginally effective.

Re: How Candy Japan got credit card fraud somewhat under control

#93

Post by optimiz3 »

Matt3o12_ wrote: post #79
josu wrote: post #61

Earlier quoted context omitted.

I'm not disagreeing with your point, but I love it when I get great customer support as a free/low value customer, and it definitely increases my chances of conversion.

Maybe op was referring to free customers that are rude, and impose big costs to you (way above the average support ticket). But agreed, if I get bad support as a free customer, how can I know that the support will get any better if I start paying (except for services that sell support). When I get an instant response to a question from a friendly support, I would say that I'm far more likely to upgrade to their paid…

The point is that toxic customers tend to sap your bandwidth. If you impose a time cost on them it throttles their ability to do so.

One way or another the problem works itself out, which lets you focus on the paying (i.e. actual customers).

Re: How Candy Japan got credit card fraud somewhat under control

#94

Post by aandon »

dw23 wrote: post #91
aandon wrote: post #58

PM from a fraud detection company here. One thing I didn't see mentioned on this thread is Device ID, which is very common on fraud detection platforms. When a user comes to your website or mobile app, you have access to hundreds of signals from their device. Some like IP address are easy to spoof. Others like whether the user has changed their phone alarm from the default settings are often ignored by fraudsters but…

Interesting ... If u have a device id running on ur site , how do u tie a 'suspicious user' it flags with the orders made by that user ? I read abit about ur product and it's not clear how a web shop like candy Japan would integrate quick and dirty with this

Normally an order on your back-end is linked to our device ID with a session ID. However our device ID can also accept user-generated data within fields on your website/mobile app. So if your customers enter their email address during your checkout process, that email will be tied to device ID and you can then look up suspicious orders by their email address.

Re: How Candy Japan got credit card fraud somewhat under control

#95

Post by [deleted] »

Guvante wrote: post #35
awesomerobot wrote: post #30

Earlier quoted context omitted.

Do paywalls face as much fraud? My understanding is that industries that provide digital goods or services see a much lower rate of fraud because there's little resale value involved (and the cost of stolen/returned goods is much lower).

It sounds like the biggest problem that OP is talking about is people using his service to validate credit card numbers. They don't particularly care about the candy, they just want to know if a number has been cancelled yet.

[deleted]

Re: How Candy Japan got credit card fraud somewhat under control

#96

Post by hibikir »

3dfan wrote: post #7

Is there no service that does CC processing and fraud detection already? I would think it does not make sense for every ecommerce merchant out there to build their own solution. Bemmu, you say you use PayPal - isn't PayPal also accepting Credit Cards? Don't they do the fraud detection in this case? I would expect them to have a huge advantage. You only see the IPs and other metadata from a few customers. They see mil…

I'd be surpised if any online CC processor didn't do at least some fraud detection already. Stripe does, for instance.

Re: How Candy Japan got credit card fraud somewhat under control

#97

Post by askldfhjkasfhd »

jackvalentine wrote: post #90
siberianbear wrote: post #45

Earlier quoted context omitted.

I am a native-born American citizen living in Russia. The amount of grief that your solution causes me is significant. I'm a legitimate customer who does nothing fraudulent. However, whole swaths of the internet treat me as if I have leprosy just because my IP address is in Russia.

I don't know how to say this without coming off harsh, so I'll say it and ask you to use the principle of charity when reading it. If the Russian state refuses to stamp out crime that is causing negative externalities, then people should rightly stop dealing with people inside Russia as a logical response.

Replace "Russian state" with "African American culture", and I think the problem with this attitude becomes more obvious.

Re: How Candy Japan got credit card fraud somewhat under control

#98

Post by jackvalentine »

askldfhjkasfhd wrote: post #97
jackvalentine wrote: post #90

Earlier quoted context omitted.

I don't know how to say this without coming off harsh, so I'll say it and ask you to use the principle of charity when reading it. If the Russian state refuses to stamp out crime that is causing negative externalities, then people should rightly stop dealing with people inside Russia as a logical response.

Replace "Russian state" with "African American culture", and I think the problem with this attitude becomes more obvious.

Please point me to the representative "african american culture" government apparatus and you'll have a point.

Re: How Candy Japan got credit card fraud somewhat under control

#99

Post by ivthreadp110 »

I wrote a similar system for an ecommerce site-

attached session data, "remora data", tracked IP's, (in fact trace routed all IP's looking for suspicious proxy flags like going through Ghana), browser meta data- etc etc. I'm proud of how robust it ended up being. Constantly recursively crunching shipping addresses, CC numbers, IPs, all that jazz and accounts- so if someone tried several different cards their account would be flag, which would flag their IP which would then trickle down the system.

Of course never letting an attempted scammer know the system was on to them- in fact encourage them to keep using more cards and try different combinations so the flagging system would grow over time. Sure we got some false positives, but drastically cut down on repeat scammers. :)

In which case we just encouraged a phone call and solid proof of information for an account override.

It was war! Good article!

Re: How Candy Japan got credit card fraud somewhat under control

#100

Post by Kephael »

stcredzero wrote: post #67
_gfrc wrote: post #56

Earlier quoted context omitted.

Blue Byte did something along the lines of your suggestion with the copyright protection of Settlers III. When the game detected that the DRM was broken, iron smelters would only produce pigs instead of iron. https://en.wikipedia.org/wiki/The_Settlers_III

Not bad, but even that reads like a bit of an FU from the devs. ("Pig Iron?") The best thing to do is to make it definitely seem like it was a bug introduced by the crack. (Maybe James Bond villains giving their secret projects suggestive code names and telling their entire plan isn't unrealistic?)

Bohemia Interactive have their games "degrade" if they detect they are pirated. Weapons become increasingly inaccurate and your character turns into a bird.

https://en.wikipedia.org/wiki/FADE

Post reply on HN