Hacker News Reader

Comment by nchelluri | Hacker News Reader

Interestingly enough I found this subthread from an HN Post earlier today to be very relevant: https://news.ycombinator.com/item?id=10234561

> Regarding his fraud issue, I found that my website was being used in the same way when I added a credit card payment form. I implemented a system that first does an "Auth". If that passes, then I pass details to MaxMind and get back a response with a "riskScore". If the score is too high, I void the auth and decline the transaction. This has saved me a lot of chargeback fees, though it's still not perfect. I prefer PayPal because a "not authorized" just reverses the transaction; there is no chargeback fee.

- Osiris (HN user)

IMO, there's more worth reading in that subthread. It's an interesting topic, at least to me. I feel sympathy for any merchant that has to go through this kind of pain.

View on HN

This issue is so costly and prevalent that I feel its a huge disservice for companies that offer credit card services to merchants to not either 1) mention this issue and recommend a fraud check service, or 2) include fraud protection in their service.

I actually ran into an issue a little while ago in that I allowed my MaxMind account to run out of queries. Not realizing this, I saw a few days of higher than normal sales but just assumed it was a good day. When the first chargeback came through, I immediately noticed the problem, bought more credits, then began to go through each transaction one and a time and noticed a pattern in the email addresses (all two words followed by 3 numbers @hotmail.com) and individually refunded each and every one of them.

I still got chargebacks but I was able to dispute them by showing that the transaction had already been refunded.

My ideal credit card would be on where the physical card has e-paper on it with a 6-digit PIN that changes periodically, like 2-factor auth, and that PIN could be required for purchases to be authenticated. The new smart-chip cards don't help at all with online purchases, only point of sale.

On a side note, I found that nearly all of my fraudulent purchases came from Vietnam to the point that at one time I put in an IPTABLES rule to block the entire country.

All of mine seemed to come from Mexico. Either IP being in Mexico or the shipping address being there.

Still many orders originating from Mexico seemed like they might be genuine, as the customers had filled in the questionnaire with their favorite animes etc. valid looking answers, so I didn't want to block the entire country.

My theory is that there really was some kind of media mention there, which resulted in some real orders but also some fraudster happened to hear about the service that way as well. it seemed possible that I had been mentioned in some local

   Since pro accounts initially cost £6 for month, it turns 
   out that this is low enough that it won't send red flags 
   to stolen cards

That's interesting (scary). What is the minimum transaction that Visa actually gives a monkeys about? And why, if a card is stolen, does not any activity flag up?

Edit: more importantly I never even thought Inwoukd need to implement fraud detection - is there a primer on "things you never thought of when selling on line - from VATMOSS to Vampires"?

It's not normally a single transaction that triggers the fraud detection, but a small initial transaction (say <$20) then one that's much larger - the first transaction validates the card works, the second one is the money grab.

So if you sell something small, you'll be used to validate newly bought cards before they go off and buy $1000 of something else.

>all of my fraudulent purchases came from Vietnam to the point that at one time I put in an IPTABLES rule to block the entire country.

I can never work this out; it seems that scammers from different countries (or using hacked servers / proxies?) are attracted to different sites or types of ecommerce sites.

For example:

- One of my sites has huge fraud from Ukraine and Russia

- Another from Indonesia

- Another's problem country is Pakistan

I typically use https://siftscience.com to identify fraud, plus country-level blocks where it makes sense.

Damned shame that all the legitimate users from a given country get blocked thanks to the fraudsters!

Thanks for using us! If you need extra help feel free to email me - jason at siftscience dot com

Nobody seem to know or mention : https://en.wikipedia.org/wiki/3-D_Secure

I have to use it with most online shops here in Switzerland.

3D Secure was mentioned in the other thread. Folks recommended avoiding 3D Secure / Verified By Visa because so many banks implement it insecurely, and the redirect model is easy for phishing scams to imitate:

https://news.ycombinator.com/item?id=10235328

That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will freak some people out. Consider that some banks make the Verified By Visa password the customer's birthday (ie something easily researched) and you quickly realize it's a horrible system.

Here in Belgium 3D-Secure is also commonplace, and the experience provided by my bank has significantly improved throughout the years. I also don't think it hurts the conversion of webshops around here because everybody is used to performing these extra steps.

It works as follows:

- Merchant redirects me to his payment provider

- I enter my debit/credit card number into the payment provider screen

- I am redirected to my bank website, and am able to verify the URL (no iframes anymore!)

- My bank has two methods of verification: scanning a QR-code with the mobile banking app on my phone, or logging into the online banking website (with a Vasco DIGIPASS 836, which requires a debit card+pin to generate a OTP)

- I verify the amount and creditor in the mobile/online banking app, and sign the transaction with my mobile pin/digipass.

- I am redirected back to the merchant.

All in all, I think it costs me 30 seconds to complete the extra 3D-Secure steps when using my mobile banking app.

Sure, banks can do it really horribly (most of them), but some use it to force proper 2FA. For example, Nordea asks you to open their phone app and confirm the purchase (with a message that includes the total price) on there.

These verification mechanisms don't freak people out once people are used to them. Pretty much anyone who uses credit cards to buy anything online in Europe will have encountered this system before and will be more suspicious if they don't see it!

Using customers birthdate is indeed a very poor authentication mechanism, but even that is going to defeat the majority of fraudsters who are simply trying to bulk-authenticate a list of CC numbers. Personally, I don't give my real birthdate to any website unless they have a very good reason for knowing it.

My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc.

But since the actual authentication mechanism is left up to the card issuer, there's nothing to prevent them using more advanced systems - like 2-factor authentication, hardware tokens, etc.

How do you use the collected birthdate to reduce fraud?

Nobody collects the birthdate. It would be validated by the card issuer against their account records. The merchant doesn't see anything that happens during the 3D-secure part of the transaction.

> My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc.

How can the bank know what any of the letters in your password are unless they are storing it insecurely?

They could be storing a hash for each trigram in the password (assuming he meant three consecutive characters starting from a random offset). Although it might still leak information that could improve a brute force, I suppose.

It's not a good solution anyway. A phishing page could easily claim the entered password was wrong and ask for another one (starting at another offset). Most passwords are probably <= 9 characters, so you'd have the full password after 3 attempts.

It's not consecutive characters, it's a random set of three. One time it might ask me for the 1st, 6th, and 8th characters. The next time for the 6th, 7th, and 9th. Passwords are required to be at least 8 characters and contain a mix of letters and numbers.

Fishing attacks are difficult because the attacker would have to be able to determine which bank a card was issued by, and present the correct 3D secure interface specific to that issuer. Many issuers also add a customer-personalised image or message to the interface to further reassure customers of authenticity.

This further suggests to me your bank is storing your password in plaintext or reversibly encrypted, which is not secure at all.

The only alternative I can think of is that they'd also create and store a hash of every possible three-letter combination based on your password which does not seem likely.

Well, I used to be rather critical of 3D Secure until a few months ago. My wife's card (on our shared account) got compromised and a 300 euros or so payment was made with it. No 3D Secure enabled for her because she had not given her cell phone number to the bank.

Our bank refunded it alright, though it took about a month, but the next week I received an SMS with a 3D Secure confirmation number for a similar payment, in HKD, with my own card (by the way, the only place we used both cards for payments was Taobao). I was able to call my bank which blocked the card and quickly issued me a new one. At least in this case it both saved us, our bank and some unknown online shop, time and money.

Also, I think the smart way to do 3D Secure is what capitainetrain.com does, they use it only for the first payment of a customer (and explain what's going to happen during the payment process) and all subsequent purchases don't go through it (since the customer has already been verified as being legitimate). It only works when you expect customers to come back regularly, though.

Re: Conversion rates, as a consumer I have got used to it and it does not affect conversion for me at all.

Everyone uses it now in the UK and you always get redirected to the exact same page. I expect it, it doesn't put me off buying.

So it's a bad objection to the system, because once everyone's using it, it becomes the norm. Yes, there will be a dip in conversions to begin with as consumers are scared by the new page, but it will recover. Some people's implementation sucks, but that's a different matter.

I loathe verified by visa. I'll still buy from that site, but only in unusual circumstances. Verified by visa means I'd rather buy from somewhere else.

I'm in the UK and I'm used to it - used to it being a crock of shit.

It's a complete flip of a coin whether the dodgy collection of forwards and cookies and iframes will go wrong somewhere, and such failures are always handled in the most user-hostile ways. I can completely understand why Amazon and so many other retailers just don't bother with it.

Unfortunately the link I'm sharing here is outdated, but Verified By Visa is absolutely a conversion hit, even in the UK. The conversion rate hit was anywhere from 6% to 60% initially.

https://econsultancy.com/blog/3887-verified-by-visa-a-conver...

Visa's own documents now recommend only using Verified By Visa on transactions that look suspicious after running risk analysis, and cite that using it on all transactions was resulting in a 3 - 5% Abandonment rate in the UK.

"Higher conversion rates – following the implementation, abandonment dropped from over 4% to under 1%"

http://www.visaeurope.com/media/images/44933_visa_vbv_case_s...

Some banks implementing 3D Secure/Verified By Visa/MasterCard do it by asking for a separate password.

Given how few sites actually implement it, it becomes a pain to use if you have to dig out the password or set it up on first use.

Let me say I vastly appreciate the honesty in your blog series having caught up just now. It's good to hear others have these worries and can learn - if painfully !

Good luck

> My ideal credit card would be on where the physical card has e-paper on it with a 6-digit PIN that changes periodically, like 2-factor auth, and that PIN could be required for purchases to be authenticated. The new smart-chip cards don't help at all with online purchases, only point of sale.

The banks and companies like Visa/MasterCard in Turkey use something called 3D Secure [1], in which you are directed to your bank's 3D secure page and enter a code that is sent to you via SMS and your CVC number so they have 2-factor auth. Most of the merchants I used in Turkey supported 3D Secure but I don't know the situation with other countries.

Banks in Turkey still support the processing system that is currently used worldwide however some banks have an option where you can cancel all non-3D-Secure online transactions.

Also the chip-and-PIN standard was conceived in 1990s AFAIK so the smart-chip cards are not new at all, they are just not adopted in some countries like US.

[1]: https://en.wikipedia.org/wiki/3-D_Secure

You may be interested in the system I use with my bank in the Netherlands.

The old system worked like this: The bank gave me a device they called a "Random Reader". To make a payment, I had to insert my card into the device, enter my pin, enter a (random?) number that the payment site gave me, and enter the amount. It then gave me a number back that I had to give the website, which authenticated me.

These days I use a "Rabo Scanner", which works the same except instead of entering a code and the amount it has a camera on there that scans a kind of barcode on the screen that contains that information.

So it does use the smart-chip, and the (8-digit) pin changes every time you make a payment. You do have to take the device with you, but it isn't very big.

I was using VeriSign for years. Then my site got hit with a "carding" [1] attack. VeriSign was simply not interested in helping with it, the merchant bank I had coupled it with was not interested either.

So I cancelled VeriSign and the merchant account, and use paypal and Amazon Payments instead.

I did make the rounds of a few banks, all were eager to set me up with a new merchant account. All gave me blank stares when I asked if they had any means of preventing carding attacks or other frauds.

[1] A carding attack is when there's an attempt to buy something for $0.00, just to see if it is rejected or not. I was getting one every minute or so. I got charged for every one of those, and so soon had racked up a grand in charges.

Osiris' info was useful. I really also need to put in some fraud detection like that. But there are so many companies providing that service, I'm not sure which one to go with. How involved is it to integrate these?

It's not my idea of fun to try look at these transactions manually, so until I get a motivation boost to go through with the integration it'll probably be PayPal-only.

>I'm not sure which one to go with. How involved is it to integrate these?

I really like https://siftscience.com.

The important thing is to not over-think things; it's rarely that case that you truly, honestly, really need real-time automated fraud detection.

Start with implementing the absolute bare minimum. You'll then receive emails from e.g. Sift when a bad user is identified, and you can manually refund the transaction, cancel the order, and block the user.

I'm thinking about integrating with siftscience. How trustworthy are they? It looks like you need to send them information about your users and give them script access on your page in order to help identify fraudulent transactions. (which is completely reasonable but still requires a lot of trust on our part)

Hi Ben, CEO of Sift Science here. Happy to share what we do to secure and protect your data - jason at siftscience dot com

Something like a simple proxy / VPN IP detection should be used because I assume most of the "carders" don't use their home IPs. There are decent free solutions online like W I T C H and GetIPIntel.

Reply on news.ycombinator.com