Hacker News Reader

Comment by tyingq | Hacker News Reader

"Fraud orders are usually easy to spot by shipping addresses"

You can find some of these by searching the shipping address and seeing if it's a freight forwarder or an obviously vacant home (listed on MLS with empty room pictures). Those kinds of shipping addresses have a pretty high fraud rates.

But, if you mean seeing that the shipping address doesn't match the billing address on the card via AVS... That's trickier, especially for B2B spaces where a business owner buys with a credit card tied to their home address, but ships to their business.

View on HN

> You can find some of these by searching the shipping address and seeing if it's a freight forwarder

Am a legitimate user of a freight forwarder, this attitude makes me sad.

It's not really an attitude. I get that legitimate orders go that direction too. It's a flag to check into the order further. Same for vacant-looking addresses, mail-shop boxes, and so on...many are legit orders, many aren't.

With credit card fraud, the merchant holds 100% of the liability. They lose the item they shipped, the shipping costs, the associated revenue, then some chargeback fees on top too. So, they check on things that could be fraud.

doesn't 3DS or other types of SCA shift the liability off of the merchant?

I believe this is further along in other countries, but in the US, you lose a lot of sales as legit customers don't remember their 3DS passwords. I see stats quoting pretty high 3DS adoption in the US (30+%), which seems odd to me personally as I've never been prompted to use it.

3DS to me is still a Nintendo handheld game platform. I've never been asked to use anything other than 2FA — usually pretend 2FA in the form of a text to a mobile number. My hardware 2FA mostly sits unused, because almost nobody asks for it.

I would assume the payment provider should handle those analytics, not the vendor

Outside of 3DS, they aren't liable for the fraud. So there's an incentive problem. They also don't have all the context. Their APIs generally want the billing address and don't have a provision to pass the shipping address...as one example. It's not the only piece of context they don't have and don't have a way to pass.

Reply on news.ycombinator.com