Hacker News Reader

> This post seem to blame victims for the problem, and that is not fair.

Indeed, the scammers are the bad guys. At the same time, what about people that still fall for Nigerian princes or go through their spam folder for "sex in your area" or "penis enlargement pills"?

> ...verified it would gather information from Google, Dropbox sign, the bank receiving the funds...

While I agree that our banking system should evolve past the high-trust model that it has organically grown out of, this sounds absolutely dystopian to me. I would much rather live in a world where the resolution is "sorry, you got scammed, that sucks, learn from it" rather than "our corporate overlords will collaborate to ensure your safety." Even if real-time 2FA of fund transfers existed everywhere, people (including everyone in the right state, sure) would still click those things. Technology doesn't solve social problems.

> At the same time, what about people that still fall for Nigerian princes or go through their spam folder for "sex in your area" or "penis enlargement pills"?

Those people are also victims.

Wait until you get older and have cognitive issues, or have a relative that gets caught up in these scams. It's easy to say "tough up" until it happens to you.

Let's aim for a better middle ground maybe?

^ this.

I was scammed about EUR 1500 some 7 years ago. It didn’t seem a scam: the price for an item was low but not too low, the identity of the seller I could verify. But the item ultimately didn’t arrive, and I didn’t know that for italian law it’s considered an “unfulfilled contract” rather than fraud, and requires a civil rather than a criminal case, which would turn out far too costly.

But the point is: I didn’t recognize some warnings because I just had my first kid and I was stressed, overworked and sleep deprived. Shit happens.

That's not nearly the same thing as what the other poster is talking about.

I once had something similar happen when I purchased Prince of Qin off Ebay (10-15 years ago I think?). Package never arrived.

That is in a wholly different class than these scams where they're asking you to cash a check and wire the money back, nigerian prince, etc.

What the other poster ISN'T considering is that there are still large segments of the population that are old enough that they're just not internet savvy. It's just the nature of life.

But their point stands as is, it's not reasonable for younger generations to be falling for these scams.

> or italian law it’s considered an “unfulfilled contract” rather than fraud

That's crazy, but the same binary outcomes also exist in US law. Some states make very clear (to civil litigants' chagrin) that closing a sale with no intent to perform is a fraud; others haven't made that so clear; and, always, it's how you explain your situation to the gatekeeper that determines whether you might qualify for one side or the other.

As a general rule convicting someone of fraud requires you somehow prove their state of mind. A person must set out to deliberately defraud someone for it to be considered fraud.

Of course proving a persons state of mind is extremely difficult. As a consequence it’s unlikely that police or prosecutors are going to take an interest in fraud that only involves small sums of money (less than a few million $).

However proving that a contract is unfulfilled is pretty trivial, and generally cut-and-dry. But failure to fulfil a contract obviously isn’t a criminal offence, so your only option is to file a civil suite. Thankfully most countries have small claims courts that cheap and very accessible, but with limits on how much you can claim. Just because the amount of money you’ve lost is above the small claims court amount, doesn’t prevent you from suing of an amount within the purview of a small claims court.

Beyond that, use a credit card. If credit card networks have provided any value in this world, it’s in the form of generally consumer friendly chargeback processes. It’s in there interest to make sure that people feel safe using their credit cards to buy stuff, more purchases means more transaction fees for them.

That's what small claims court is for. Hopefully it doesn't happen to you again but if it does you can take them to small claims court. You don't need to pay a lawyer. It costs far less than €1500.

That's what it's called in the UK anyway. I assume Italy has something equivalent.

All that does though is maybe get you a judgment. It doesn't put the money in your hands.

I've never done it but if they don't pay up you can apparently ask the court to send bailiffs:

https://www.gov.uk/make-court-claim-for-money/enforce-a-judg...

As an aside, this is one of the users I think everybody should design for:

> I just had my first kid and I was stressed

I often think back to when my nephew was tiny and imagine my brother trying to work a particular interface with one hand while holding a crying baby in the other.

> Not everybody is mentally sharp 100% of the time to identify a scam attack and fight it back.

Exactly. A point made over and over in "The Field Guide to 'Human Error'" [1] is that when looking at failure, you can't use your current knowledge and state of mind when evaluating the circumstance. You have to look at it with the actual knowledge and state of mind at the time. If you don't, you will fail to find the actual problems and correct them.

Take this, for example:

> You would think that by now every human being that walks the earth would know

I would not think that! That's an unevidenced assumption. It's less a statement about the world than it is a declaration of ignorance. It makes it hard to engage curiously with the reality of the circumstances. Even if it were true, it assumes that having heard something once is the same thing as being able to apply it in all circumstances and all cognitive conditions. If people just stop there, we will never improve things.

Indeed, I think it's worth asking why victim-blaming is such a common reaction to stories of scams. One part is the just world fallacy [2]. Another is the fundamental attribution error [3]. And one that I have definitely been guilty of is that it lets me feel smart. "I, a genius, recognize the specific scam pattern. They, those helpless fools, never see it coming. Ergo, I have once again proved my mental superiority." It's hogwash, of course. But satisfying, comforting hogwash. It took me a long time to realize that it was incorrect and that pursuing feelings of smartness often made me effectively stupider.

[1] A book I strongly recommend to everybody in software: https://www.amazon.com/Field-Guide-Understanding-Human-Error...

[2] https://en.wikipedia.org/wiki/Just-world_hypothesis

[3] https://online.hbs.edu/blog/post/the-fundamental-attribution...

> This post seem to blame victims for the problem

I interpreted the parent post as describing a mere "contributing cause", but you seem to be saying the post is assigning moral guilt to the victims. Why? And how can we discuss preventative measures that potential victims of any crime (or accident) can take, if the two are so often conflated?

E.g. is teaching people self-defense equivalent to blaming them for successful physical assaults upon them?

You're relying on the idea that all foreign governments care about their citizens scamming Americans. And it literally takes only one government that doesn't care (or isn't able to enforce for whatever reason) for your strategy to be impossible.

I'm sure the US government could think of one or two things to put enough pressure on such countries, if it cared to do that.

Let's assume the scams are coming from North Korea or Cuba or Russia. You really think that there's more pressure the US apply that will make these countries go "you're right we shouldn't let our citizens scam your citizens"

The root issue it archaic payment systems and banks where a check can take 7 days to clear. In this age a bank check should clean in seconds and funds should not be available in your account until it clears. It should be on the bank to not lie to you about funds in your account.

People always say Russian scammers are safe if they do Cc fraud etc. This is absolutelly not true, maybe some government collaborators get away with it because it is sanctioned, but the regular joseph will absolutelly go to prison, or be recruited for a war zone.

Why would Russia care if people scam Americans?

They do not, but the financial system is the same everywhere in the world, you do not want to be labelled as a high risk jurisdiction by the banks, acquirers and PSPs.

Let us use an example, Moldovian fraudsters using stolen credit cards and kyc docs online, this leads to chargebacks etc. None of these cards are issued in Moldova, they are issued by american, british, new zealand, spain etc.

These banks often have offices in the countries where the fraudsters reside and they will absolutelly go for the fraudsters, if the word is that their cards and products can be compromised without consequences, they will lose a lot of revenue, customers, trust and reputation.

The government will not tolerate them becoming a high risk jurisdiction because of some carder kiddies, they will totally look them up.

I have friends who know many russian(many are coming to southern europe and russian friendly countries like serbia) friends who tried some stuff like that out of pure desperation, none of them made big money, but all of them eent to prison.

I work in finance and had personal correspondence with some fraudster groups, if you explain to them how you are going after them preciselly, step by step, they will immediatelly offer a truce. I am talking about really highly sophisticated groups here.

They know to not fly too close to the sun.

He said wistfully.

I consider myself pretty quick to detect scams, having worked in cybersecurity, though probably no quicker than the average HN commenter. And yet 15 years ago I fell for the “sell products that are no longer available” scam.

There was a keyboard I really wanted but it was no longer being made. However, I found an online shop that had them in stock! I ordered, paid, got my confirmation, and waited about two weeks before complaining that it hadn’t shipped.

Ended up with some dude from the usual geography for this stuff, yelling at me and threatening me over the phone. At which point I realized it was all fake, told him where to stick it and hung up. It was only $100 or so and I was lucky they didn’t do anything creative with my credit card.

The point being, there are lots of circumstances that can make you let your guard down. Thinking you’re too smart to be at risk is probably not the safest position to take.

usual geography being india?

It’s not really relevant other than that it’s anywhere beyond the reach of the law right?

It's relevant as a red flag alongside other information that should raise one's level of suspicion.

if you're in the US you can reverse the charge, whether debit or credit card, although with a debit card you'll have to be re-issued a new one.

If enough people do chargebacks the payment processor will drop them because the ACH operator representing them will 100% fine the shit out of them if they don't. It's all contractual.

My point is, if you want to put a dent in stuff like this, do a chargeback. Like a union, the power isn't in your action, it's in the action of many.

---

But also, this is why I'm very picky and have quite often refused to purchase something I wanted. I'll trust Walmart.com in a way I won't trust momandpop.com. Unless they're using a payment process that isn't handled by them (CC via paypal, for example) I just flat won't use them.

What's worse is most people don't even consider the risk to calling in an order from a local restaurant for delivery (chinese, for example). They may or may not save your CC information and you have no idea how well those systems are secured. They're probably using a 3rd party, but you don't know who that 3rd party is so you can't even begin to assess that risk.

I'm not a fan of doordash by any means, but they do offer a service here in terms of risk assessment.

> What's worse is most people don't even consider the risk to calling in an order from a local restaurant for delivery (chinese, for example).

if you review your monthly statement, the "risk" is the possible inconvenience of having your card replaced. I don't let it stop me from ordering my favorite takeout, but you do you.

yeah... because ... you know, they'll only charge once in a first month and do nothing else.

No but you'll get all of their charges reversed and then get a new card.

I honestly don't understand your threat model here. from the post I originally replied to, it's clear that you already understand that you can easily reverse unauthorized charges to a credit card. if you're already reviewing your monthly statements (which you really should be, as part of sane budgeting), this is basically a non-issue. you tell your cc issuer you suspect someone has stolen your credit card info, they cancel the card, and you can probably even get them to ship you a new one overnight. it's unlikely things even get to this stage though. card not present with no cvv is already the most highly scrutinized type of cc transaction by the processor.

I guess someone could probably treat themselves to their own monthly takeout order without me noticing for a while, but at least to me, this minuscule risk does not seem worth the mitigations you are taking.

I challenge you to quote me saying I don't order takeout.

Furthermore, many people use debit cards backed by an actual bank account and the vast majority of people can't afford to have those drained in any meaningful fashion without experiencing some severe consequences.

And thirdly, when the equifax breach happened I didn't bother doing anything. Why? Because I do NOT have the attitude that it's ok to be defrauded of money since someone else will pay for it. There was nothing for them to go after.

I let my guard down once, because of a third party survey from actually Apple. Then actually Apple allowed the third party to funnel me onto their third party site. And that's where I suddenly found myself subscribed to a $15 fun recurring weekly quiz. I trusted them, because it's Apple, right? Except it wasn't Apple anymore. And, well, it wasn't fun to me so I un-subbed pretty quickly, but the first $15 were already payed. When I looked into it, they'd hidden themselves through layers of proxies so it wasn't possible to find an office address. And there was ofc no help to get from Apple, because they assured that they were only responsible the third party survey, and not what happened when you where funnelled onwards. I still think this is pretty crappy customer service from Apple, and that cooperating with such a scammy company reflects very poorly on them. Oh, and I still want my $15 back! (Don't worry, it's nothing compare to what I lost on FTX...)

I'm guessing Apple would have investigated more had a reporter asked them.

How did you pay? Did you let it go because "only $100"? Because if you paid by a non-sketchy method (paypal or credit card) the chargeback should be straightforward.

Good point, but at the time I didn’t think of that. I’ve never done a chargeback, which is probably a testament to my banks’ fraud detection.

For $100-ish, and a good couple weeks since I made the payment, getting my money back wasn’t the main thing on my mind. Which, again, is an example of circumstances clouding your judgement. I was mostly just pissed I wouldn’t be getting the keyboard.

I did try a complaint to the BBB since the shop was (probably not really) listed there… from which I learned how useless the BBB is, so I guess in the end I got something for my money after all.

> This post seem to blame victims for the problem, and that is not fair.

Guilt is not zero-sum. A killer gets 20 years, but a group of 10 people conspiring to a murder get 20 years each, not 2 years each.

It's perfectly possible the scammers are culpable to the maximum extent, while at the same time there is a smaller but consistent culpability on the part of the victim.

Totally not blaming the victim, just surprised that knowledge about these scams and how they work isn't as widespread as I'd have expected. We are grateful OP posted here and spread that knowledge a little further. It's a shame that these things don't just get taught to schoolchildren--too many people learn these things for the first time as a result of being victimized.

Suggesting people arm themselves with knowledge and use that knowledge for prevention is not really the same thing as assigning blame.

> The problem is not victims, the problem is scammers

but the solution isn't on the scammers side only, there are a series of circumstances on both sides involved that cause these things to happen.

if people weren't desperate for money, running out of alternatives, they wouldn't need to perpetrate these crimes, nor would they fall for them as often.

> if people weren't desperate for money, running out of alternatives, they wouldn't need to perpetrate these crimes, nor would they fall for them as often.

It's naive to think only the destitute perpetrate or fall victim to scams. By that logic, people like Bernie Maddoff or (allegedly) Sam Bankman-Fried wouldn't exist.

there's always the romanticized idea of the 'cat burglar' who spends more money trying to steal something that the actual pay off from the heist...

that's fraud like an art form... maybe mr. bankster-"cooked in oil" should play that defense: "It was an art project that got out of hand"...