Hacker News Reader

Comment by ikeboy | Hacker News Reader

>When DoNotPay’s system got that ping, an algorithm the team spent six months building looked at the code request to see if the purchase was for a free trial. Determining that it was, the system approved my transaction. When I tried to use it to buy a $48 pair of Thinx period-proof underwear on that company’s website, it was declined. You can't use this card to make real purchases.

if (chargeamount>0){ decline()}

View on HN

Half lf the time I see "AI" or "complex algorithm we spent 2 decades on", it's literally just that.

Still technically "artificial" and a form of "intelligence"!

I've seen a charge amount of 0.01 for a free trial. I'm pretty sure it was just a pre-auth, i.e. they didn't follow up and actually complete the charge.

This is presumably an actually hard problem despite the comments. A pre-auth allows the acquiring merchant to capture that authorization and charge you. Sometimes these can be for $1 or more, depending on how aggressive the service is. Pre-authorizations are subtracted from your available credit/balance.

If the card approves the pre-auth, they are (presumably, AFAIK) on the hook for that $1 if the merchant captures the pre-auth. If many (unpaying?) users start charging you $1...

A reasonable heuristic might be:

- if less than 0.05, approve (as no merchant would actually charge a transaction for that amount, as they'd spend more than 5 cents on fees)

- if more than 5 cents but less than 1 USD, approve it only if the merchant is already known to offer free trials

You could be fancier:

- match on amount+merchantID combo, not just merchantID

- learn a model to deal with previously-unseen merchants

I'd guess they allow small pre-auths (up to $3 say), and then keep a blacklist of merchants who actually capture the charge.

Merchants on the blacklist have all charges denied.

Any 'free trial' who actually captures a dollar from their clients will cause lots of chargebacks from their customers, so would go out of business quickly... (A chargeback costs a business ~$15 in fees)

Was it against a bank (ie, debit) account? If so, it's a pre-note test, fairly standard in the industry to ensure a direct-debit or direct-credit can be assumed safe.

This unit tests both the debit (of e.g. $.01) and a credit of the same amount against the target. They can also vary the amount, then ask the recipient to report the amount posted (so you can prevent additional fraud that way - attacker may have your bank account/routing details but no login to your statement/transaction listing).

No, it was against a UK-issued MasterCard.

It was definitely processed through the MC network, and not via Direct Debit (the closest UK equivalent to pulling funds via ACH).

I know this because the vendor didnt have my bank account number, because Direct Debits are processed in batch (not instantly), and because the app associated with the account showed it as a card transaction.

Reply on news.ycombinator.com