Steal a Credit Card, Buy a Hoverboard | Hacker News Reader

Steal a Credit Card, Buy a Hoverboard

buzzfeed.com

16 pointsfirloop28 comments

"According to internal Stripe documents obtained by BuzzFeed News, online hoverboard purchases are plagued by fraud."

"Documents show that as of Dec. 7, Soulja Boy’s Stripe account held a balance of $-174,440.08. Between June 30, 2015, and Dec. 7, according to the same documents, more than 75% of all orders associated with that account were disputed after the fact."

I find the fact that someone at Stripe is leaking financial documents/information of customers (presumably for some sort of personal gain) to be HIGHLY disturbing. Maybe it's time they reviewed who has access to what sensitive information there.

Stripe has been known to be incredibly vulnerable to online fraud. They provide effectively 0 fraud prevention for their users. Any merchant using Stripe is just a sitting duck for an extreme spike in fraudulent purchases. Even as recently as 2 weeks ago lists of Stripe-based merchants float around.

Even worse, any bimbo with a SSN and bank account in the USA can sign up. If you've got someone's SSN and address you can open a Stripe and bank account in their name. Run up the Stripe balance with stolen cards and then disappear. Stripe holds initial payments for 7 days and a rolling 2-day period. Clearly from this article most people don't charge back for a long time, well over 7 days.

Stripe has a fraud problem. They've been denying it and IMO have failed to bring in fraud prevention experts. They should partner with MaxMind and create a single, easy to implement product.

I wonder how the vendor can be described as "unreputable". It seems like the vendor has the least possibilities of all those involved (banks, cc companies, stripe) to spot fraud.

The credit card companies also reap all the benefits of making it easy to use their cards (no pin, no 2FA) but apparently pass the losses from that policy on to the vendors.

Exactly what I was thinking. The whole point of using something like Stripe is to hide complexity, why should users have to roll their own fraud prevention?

Shouldn't Stripe be responsible for checking frauds and detecting them? Or shouldn't the credit card company deny the transaction for stolen cards? A low percentage of fraud is admissible, but the level mentioned in the article raises a few red flags.

I find it funny that an SV darling like Stripe offers its customers no anti-fraud measures like companies like Authorize.net do.

It's interesting that Stripe customers knowingly, or most likely unknowingly, have overlooked anti-fraud measures and taken on additional liability in exchange for a good user interface and easy setup.

True - and once you are a merchant eager to sell and make a living, you really don't pay attention or maybe don't realize that money charged and received is not yours yet to keep. One thing that all users should do is enable CVC check. Believe me it is better to deal with some user complaints and manual processing then refunding fraudulent payments and screwing with your cash flow.

Actually Stripe does have anti-fraud (https://stripe.com/docs/fraud) just unfortunately it is not that great. Speaking from experience - I would pick Stripe anytime, even if they are not perfect, the simplicity to start using them (and stop, if needed) + the all-over attitude and possibilities are way better then the old-school behemoths like authorize.net or braintree.

There is of course a "solution": 3DS. But it's so horrible that American card companies (VISA and MasterCard) only force it on the rest of the world, not on the US of A.

It actually works ok for me. I get an sms within 5 seconds and type in the code, done. Not sure if it could lead to problems in more complicated scenarios, i. e. when I'm not using a desktop computer in my home country.

Sending an SMS for every online authorization does not required 3DS.

But it's another solution that works, isn't it?

If you're cool as a user / ch with 3DS then it's an OK solution.

This is ridiculous, it is the responsibility of Merchant and card companies to provide some sort of guarantee that the cards used are valid.

Why do we even accept credit cards if they aren't better than someone saying I promise to pay you when I get your product.

So what's the connection between hover boards and fraud, I wonder? Why not something else?

Perhaps due to them being trendy? You use your stolen credit card to buy high value items with a resale value. Resell the item to someone else, and you have turned those numbers on a screen into cold hard cash.

How can they have this level of fraud with a physical product that has to be shipped somewhere?

My assumption here is that it is cost prohibitive to go after individuals so the loss is just written off.

cost prohibitive? Some of the losses in in the hundred of thousands, almost millions of dollars. Sure it might not be worth Stripe or the Credit Card companies going after the fraudsters because they get the merchant to pay. But for IO Hawk to just leave it and not follow up seems like business suicide. Even if they did it just to tighten up procedures in future to prevent future fraud it would be worthwhile. Perhaps they were all posted to reshippers, then you would ban reshippers from being the delivery address, or you make suspect requests wait longer for delivery, not even formally telling them, just adding in a 30 day shipping delay or soemthing.

Tricky part that nowadays you tend to optimize your business.. so if i would host e-store, stock all my things in fulfillment center, and automate it all. I would be left with empty warehouse, and negative balance in the stripe account... also - In stripe - if you refund and mark payment as fraudulent there are no fees. If someone disputes payment later on - there is a fee.. so.. as long as you are honest.. no extra fees occur.

They mention that in at least one case, most of the fraudulent purchases came from a single IP. Whomever it is has arranged a place to drop-ship the boards that will be untraceable. Perhaps they use addresses of unoccupied homes, then just pick up the packages from the doorstep. I know in the past, criminals have used fraudulent accounts at local mailbox rental stores, which they rent for a month and then dump.

Point is, there are plenty of ways to launder shipments, if you are doing it with a plan and at scale.

I get that, but multiple orders to the same address from the same IP should surely be raising some flags somewhere.

Reply on news.ycombinator.com