How Candy Japan got credit card fraud somewhat under control
1–10 of 128 posts
Re: How Candy Japan got credit card fraud somewhat under control
#2http://d.pr/i/x0JD+ vs http://d.pr/i/16wJh+
Not sure what the rules are, but I thought it might help.
Re: How Candy Japan got credit card fraud somewhat under control
#3So it appears that a combination of (1) removing instant feedback (not alerting fraudsters as to the success/failure of their charge) and (2) giving a grace period to review and cancel charges has given Candy Japan some breathing room.
Though it does seem that this requires a manual step (2) before sending charges through, does anyone have experience using a fraud detection API, like Maxmind's minFraud [1] or any other, in an attempt to avoid having to review each charge?
Re: How Candy Japan got credit card fraud somewhat under control
#4So it appears that a combination of (1) removing instant feedback (not alerting fraudsters as to the success/failure of their charge) and (2) giving a grace period to review and cancel charges has given Candy Japan some breathing room. Though it does seem that this requires a manual step (2) before sending charges through, does anyone have experience using a fraud detection API, like Maxmind's minFraud [1] or any oth…
My friend runs a similar candy subscription box called https://boxfromjapan.com/ and reported having a good experience with Signifyd. I might try integrating something like that next.
Re: How Candy Japan got credit card fraud somewhat under control
#5I'm guessing this has been asked before, but why not just use a credit card processor that handles all of that stuff for you. Seems like they are in the business of selling Japanese candy, not preventing CC fraud.
Am I being naive here?
Re: How Candy Japan got credit card fraud somewhat under control
#6I'm guessing this has been asked before, but why not just use a credit card processor that handles all of that stuff for you. Seems like they are in the business of selling Japanese candy, not preventing CC fraud. Am I being naive here?
Yes.
At $DayJob we have a similar process [e.g. Accept any card that passes the checksum, hand out rejections on a 24 hour delay after we've handled our fraud signals and processed the charge with the gateway]
The credit card processors aren't particularly interested in handling this for you and you [the merchant] pay the price if you gave the processor stolen card numbers.
Services like these:
https://www.signifyd.com/pricing/ [1% per transaction]
https://www.maxmind.com/en/minfraud-services [ $0.005 ]
would have no customers if you could get a reliable partner to handle this all for you for free-ish.
Re: How Candy Japan got credit card fraud somewhat under control
#7Is there no service that does CC processing and fraud detection already?
I would think it does not make sense for every ecommerce merchant out there to build their own solution.
Bemmu, you say you use PayPal - isn't PayPal also accepting Credit Cards? Don't they do the fraud detection in this case? I would expect them to have a huge advantage. You only see the IPs and other metadata from a few customers. They see millions and should be able to do way better fraud protection.
Re: How Candy Japan got credit card fraud somewhat under control
#8So it appears that a combination of (1) removing instant feedback (not alerting fraudsters as to the success/failure of their charge) and (2) giving a grace period to review and cancel charges has given Candy Japan some breathing room. Though it does seem that this requires a manual step (2) before sending charges through, does anyone have experience using a fraud detection API, like Maxmind's minFraud [1] or any oth…
This can be largely automated using something like minFraud, Signify, etc.
However, you still need to use the same basic process:
Step #1 - No instant feedback
Step #2 - Your antifraud SaaS provider / process / whatever
Step #3 - Reject anyone who fails step #2 after ~24 hours.
Re: How Candy Japan got credit card fraud somewhat under control
#9We exclusively use PayPal as they kindly cover all of our transaction fees. However, we still experience fraud which creates work for accounting and Customer Service.
A rules-based approach has helped, but we've also been playing around with SiftScience[1] and I've seen it do wonders for some sites, so we'll likely be implementing it. The key problem is keeping the false positive rate down, as we don't want to inadvertently block our legitimate users.
Re: How Candy Japan got credit card fraud somewhat under control
#10Is there no service that does CC processing and fraud detection already? I would think it does not make sense for every ecommerce merchant out there to build their own solution. Bemmu, you say you use PayPal - isn't PayPal also accepting Credit Cards? Don't they do the fraud detection in this case? I would expect them to have a huge advantage. You only see the IPs and other metadata from a few customers. They see mil…
Yep, PayPal is awesome at this. I originally intended to go on a long tirade about how PayPal had dealt with this, but cut it out as the post was starting to get a bit long.
---
Peter Thiel on PayPal: "In mid-2000, we had survived the dot-com crash and we were growing fast, but we faced one huge problem: we were losing upwards of $10 million to credit card fraud every month. Since we were processing hundreds or even thousands of transactions per minute, we couldn't possibly review each one - no human quality control team could work that fast.
So we did what any group of engineers would do: we tried to automate a solution. First, Max Levchin assembled an elite team of mathematicians to study the fraudulent transfers in detail. Then we took what we learned and wrote software to automatically identify and cancel bogus transactions in real time. But it quickly became clear that this approach wouldn't work either: after an hour or two, the thieves would catch on and change their tactics. We were dealing with an adaptive enemy, and our software couldn't adapt in response."
They ended up going with a hybrid approach where their algorithm would flag suspicious transactions, which would then be manually reviewed.