Hacker News Reader

Comment by Osiris | Hacker News Reader

Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score is too high, I void the auth and decline the transaction. This has saved me a lot of chargeback fees, though it's still not perfect. I prefer PayPal because a "not authorized" just reverses the transaction; there is no chargeback fee.

View on HN

Definitely definitely definitely use something like Minfraud from Maxmind. The cost is negligible. We set the score we block transactions at rather low, and manually approve anything over that.

It's super cheap and has saved us tons of money and headaches!

Seems like this should be on the credit card processor to deal with?

Unfortunately for merchants, no, the legal responsibility for fraudulent transactions rests entirely with the merchant.

Not only that, but processors routinely penalize merchants who fail to screen fraudulent transactions sufficiently with fines and eventually banishment from the processor.

A few processors might provide something like this as a paid value-added service, but it's unusual. The next-gen all-in-one card processors would make a lot of money if they offered this.

By "all-in-one card processors" do you mean payment gateways? The majority of them do offer built-in fraud protection, though the efficacy varies a lot. In fact, Stripe also offers it: https://stripe.com/docs/fraud

But if you think about the case he describes in the article, there is very little distinguishing a fraudulent purchase to test the validity of a credit card vs a legitimate one, unless they are completely careless and initiate multiple transactions from a russian IP, in the middle of the night.

The biggest problem is the very expensive chargeback fee from Stripe. It looks like he could avoid some of them by, for example, reporting accounts that had no activity as fraudulent and refunding the purchase before being hit with a chargeback claim, but I don't see how putting such a burden on businesses makes sense to begin with. A fee that grows in proportion to the % of chargebacks the company generates would be more fair.

risk score means the possibility of a transaction being fraudulent. here's another way you can do this for cards issued in Europe: if the risk score is too high start a 3D secure transaction. if the risk score is acceptable then start a normal transaction. a full 3D transaction will never mean it is not fraud however you will have no liabilities when a chargeback is issued by the card holder. many of your US customers, if not all, will fail to pay via 3D-secure because god knows why tons and tons of US card holders or issuing banks are not enrolled in 3D-secure system.

As a US customer, I'm hesitant to use 3D Secure because:

1) The implementations by Visa and MasterCard have security weaknesses, terrible usability and look like phishing: http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf

2) My understanding is that my bank shifts liability to me for 3D Secure transactions. Why would I want extra liability?

Yeah, "Verified by Visa" is exactly like phishing. Good paper.

Fortunately here in the USA I haven't been asked for my credentials in at least 10 years. So it seems to have died the death it so richly deserved.

Do people encounter this on a daily basis?

It's ages since I've seen it used in the UK, although not 10 years. More like three or four.

(The redirect sometimes happens, but it's automatically approved.)

I used it the other day. It did say 3d secure will change soon.

I'm in France -- I still see it for almost 100% of the purchases I make online if the merchant is here in France, and a decent number of them when the merchant is in the UK. The last purchase I made with my bank card that got the interstitial page was about half an hour ago.

It sends a text to my mobile for me to plug into the form to approve the txn -- thus, not like phishing in this case. But for a while this was a real nightmare because my mobile number changed, and I couldn't figure out how to convince my bank to store the new number (it turned out after many months and phone calls I was sending the requisite paper form to the wrong address for my type of account...).

in turkey, any purchase online over 300 turkish liras must be 3D-secure. all debit and credit cards issued in turkey are automatically enrolled in the 3D-secure system. all 3D-secure transaction pages are hosted by issuer banks. they send us an SMS including a OTP and we enter it on the page and that's all.

Norwegian here. It's very common. It doesn't say "3D-secure" or "verified by visa", but logging in with your bank credentials (Bank-ID) sometimes feels like it's more common than not.

Visa and co. are big—really big—so I've never understood why they've not just leaned on the OS manufacturers and browser makers to provide them some form of unique, unforgeable signal to users that they're interacting with a real bank.

There could be, say, an HTML5-exposed API capable of triggering "super-modal" forms (like OS UAC does) if-and-only-if the page is being served from a secure origin cross-signed by some "Web Banking Working Group Certificate Authority" that all the banks and OS makers are members of.

Well, the more you rely on a strong signal like that, the easier it is to get phished by sufficient approximations.

Eh they don't even bother with a real-looking domain name or a non-phishy form. Seems like they are too out of touch or simply not paying attention.

The better way to do this would be some sort of two-factor thing – e.g. imagine if the physical card had the equivalent of an embedded RSA-style one-time code generator or, better, a U2F USB/NFC device – which would be resistant to UI spoofing or, in the U2F case, phishing.

Unfortunately the banks have less motivation to invest in this as long as the costs of fraud are pushed onto merchants and all of the major players charge similar fees. If something like Apple Pay starts to catch on, perhaps we'll see that change once the banks’ main concern is avoiding a single vendor getting too much market share.

Something similar was used in the UK for online banking, using a small reader [1]. It's a feature of EMV (chip) cards.

[1] https://c2.staticflickr.com/2/1218/1438197131_1e0d474266_b.j...

One of my Swedish banks uses a chip-and-pin reader for 3DSecure. You insert your card, authenticate with your PIN, and then sign a nonce to validate your transaction. https://farm4.staticflickr.com/3237/2486214902_8feafd8200_b....

Another one uses a smartphone 2FA app.

How about OTP-enabled credit cards? [1]

For every transaction the customer must enter the OTP. It wouldn't serve much for subscriptions, though.

[1] http://web.deepnetsecurity.com/products2/PocketID.asp

"with one (UK-government-owned) bank, two wrong password attempts simply lead to an invitation to set a new password."

Good lord! Reading through this document is like reading a primer in how not to make a secure form.

Wait, what? Like, [Microsoft Bob][1] style?

[1]: https://channel9.msdn.com/Blogs/TheChannel9Team/Ben-Armstron...

in turkey, banks automatically enroll your debit or credit cards to 3d secure networks so you don't have to do it yourself. all you have to do is to enter a one time password sent to your mobile phone during payment.

with full 3d secure payments the liability shifts to the customer and you will have no liability. because the customer verified the payment him/herself by hand with the otp.

p.s. i am yet to read that link.

many of your US customers, if not all, will fail to pay via 3D-secure because god knows why

As I mentioned in another reply, "Verified by Visa" is a stupid joke. Which, fortunately, I don't think I've seen anymore in at least 10 years. The paper linked in the other reply to you provides more details of how stupid this thing is.

IIRC basically the first time you encounter it you get a popup asking you to create an account. Yeah, right, I'm on some random website and I'll just start entering all sorts of security information into a popup. NOT! I did some checking when I first encountered it, and decided it was legit. But 99% of people won't. They'll just say "fuck this, I don't need this shit". They will then go elsewhere.

I encountered it a few more times after I first signed up. And it would have maybe a 50% success rate of actually "verifying" my transaction. I'd enter the information and nothing would happen.

It's the antithesis of the friction-free way that Amazon does business. I probably use Amazon once every few years but they still have all my info saved. I don't have to enter an address, I don't have to enter a CCV, I don't have to enter a credit card number. It only takes a few mouse clicks to complete an order on Amazon.

So, which payment method would the average person prefer?

Edit: look at what Wikipedia has to say, it generally makes the same points as the paper. Why would anyone voluntarily want to use this? https://en.wikipedia.org/wiki/3-D_Secure#General_3-D_Secure_...

I've been bugged by the "Verified by Visa" thing in the last month when trying to add Skype credit for my parents. Completely stupid implementation that didn't even work; I clicked "cancel" and my Skype transaction still went through.

Are the details of Maxmind's algorithm available to you? I'm wondering what factors increase risk.

> The minFraud service determines the likelihood that a transaction is fraudulent based on many factors, including whether an online transaction comes from a high risk IP address, high risk email, high risk device, or anonymizing proxy. One of the key features of the minFraud service is the minFraud Network, which allows MaxMind to establish the reputations of IP addresses, emails, and other parameters.

- https://www.maxmind.com/en/minfraud-services

So not a full list of factors, but some of them...

Reply on news.ycombinator.com