How to Sniff Out Online Fakers
gigaom.com
gigaom.com
It's been crazy to see how far fraudsters will go to create fake accounts. We've seen people in the Phillipines use Twilio accounts, for example, to fool SMS verification and look like a U.S. user. People scripting the creation of thousands of accounts. People distributing malware via Chrome extensions to take over legitimate users' accounts.
Are any of you out there are dealing with malicious user behavior -- fraudsters, spammers, account takeover, etc.? I'd be happy to answer questions!
One of the most amazing things about running a search engine was getting a look at what bad people look for (like php exploits or out of date Wordpress themes).
I keep wondering if there is an opportunity for a 'fraudster alert' service like the Realtime Black Hole lists where members could share IP addresses from which has originated fraudulent or hostile traffic, seems like it would make suppression easier.
I wonder if services like these count as consumer credit services (and hence are governed by all sorts of fairness laws)
* You're defrauding a fraud management service, which will catch on pretty soon when zero risk transactions get flagged by you as fraud, and close the account for abuse.
* Doing what you asked is illegal in several ways, and tied to your real identity -- MinFraud costs money, and being a fraud management service, paying with a prepaid debit card, connecting over a proxy, and verifying your account with a SIP phone will all be detected and flagged -- getting an account not traceable to you is quite hard.
This is the same Sh!t banks use to deny poor, black people credit and healt companies use to deny sick people coverage.
The people running these biz ideas fighting alledged XYZ (~corruption) do so out of the motive/incentive of there own personal greed and self interest, not the public good.
Don't kid yourself.
We combine data across all of our customers, so that if we find a fraudster on one site, we can alert every other site where the person has an account. I think there's a lot to learn by having sites aggregate all their knowledge about bad actors.
Secondly, as I was reading your privacy policy I noted that your condition on non-collection of data is for users to not use any products or services that "utilize the Service". That is all well and good, but you only "encourage [your] customers to describe their use of the Service and other technologies that collect user information in privacy notices that are displayed to users." [1]
If one of your customers chose not to disclose the fact that they are using your service what recourse does a user have? Is there any 'opt-out' option that lets me choose to not be tracked by you (with the understandable restriction I _can't_ use your customer's services)??
One of my services, TweetingMachine, used to have a massive problem with spammers going out of their way to abuse it. However, before a user can schedule a tweet, they have to select their timezone.
Problem solved! There are three or four specific timezones always chosen by the bad guys, and every ten minutes a script ran through the database banning users whose timezones fell into this list.
The surprisingly thing for me was that given the effort of constantly trying to get past my other detection scripts, the spammers either never worked out what was happening, or simply didn't choose a different timezone.
In hindsight, it's quite a cute test, and one that it looks like few of the bad guys bother to adjust (i.e. the time their browser reports via JS) or are aware of.
Still not nice to know that I'm treating people like second-class Internet citizens. At the same time, my available time is extremely limited, so lessor or two evils - for me - it is.
I'm going to guess this is an autocorrect error.
Do you have anything to say to those users, as an operator of a large SaaS provider that deals with fraud/spammers daily?
Heh, as I alluded to in my reply to your other comment, for TweetingMachine at least, I have zero intent of scaling; tt's a small tool, and will remain a small tool (can't even remember if I've done any work on it in the whole of 2012) whilst I focus my energies elsewhere.
So, being quite so harsh was a means to an end. At the same time, if I experience abuse of any of my other services, it'll definitely be a marker I'll use for more manual investigation.
A quick point of order: I am definitely not "an operator of a large SaaS provider" ;)
Now, affected users can get in touch directly with me - the owner of the website - and I generally respond in a matter of minutes. That's way better than a lot of the big companies out there, but I recognise it's a result of my small size.
I agree that it sucks for the legitimate users, but for reasons I won't go into, the site in question is never going to scale to anything mass market.
Also, as I said, my time is limited, and I'd much rather be spending my time on stuff that improves services for users and makes a better product than on writing systems to tell the difference between spammers and legitimate users. Remember, my scale is tiny and, frankly, if I lose a few customers because of this, that's money well spent.
Our hope is that by pooling data and technology across all sites on the internet, we can build a better system that keeps the bad users out without causing "collateral damage" and harming perfectly legitimate users.
And in response to the grandparent, we absolutely look at timezone! It's a great signal. We've found 3am is the most popular time to create a fake account. But note that creating an account at 3am, all by itself, is not enough to condemn you. It has to be combined with many other behavioral signals.
How do you deal with false positives?
Dealing with fraud and abuse takes up a good percentage of the time and other resources at any successful online service. If you don't budget for that and automate it as much as you can then you will possibly fail even though the rest of your service is doing fine.
As for the criteria named in the featured article, I work late every night, and I use Yahoo Mail for almost all "casual" account signups to catch spam, unwanted newsletters, and other notifications that I would rather not deal with in my other email inboxes. I would hate to see these be used as an excuse to target me for more intrusive registration steps or deny me access to various sites or services.
Interestingly, the 2011 top 10 countries by # of reported complaints of net fraud are: 1) United States 90.99% 2) Canada 1.44% 3) United Kingdom 0.97% 4) Australia 0.66% 5) India 0.50% 6) Puerto Rico 0.22% 7) South Africa 0.22% 8) France 0.19% 9) Germany 0.19% 10) Russian Federation 0.17%
Source: Internet Crime Complaint Center (FBI) www.ic3.gov/media/2012/120511.aspx
I don't.
Criminals are minority of the Nigerian population, but that minority spends an inordinate amount of their energy trolling online and looking for new venues that regular Nigerians are not likely to visit.
Therefore if you're a US based and targeted company, the majority of YOUR Nigerian traffic IS likely to be fraud. It isn't most of the fraud that you've got to deal with, but it is likely to be so ridiculously obvious and easy to deal with that you'd be a fool not to.
(Of course this is widely enough known that Nigerian scammers use proxies to hide their origin.)
Nonetheless, Sift Science's claim is at best poorly worded because it gives armor to the false and unfair interpretation that the majority of regular Nigerians folks are fraudulent, which by itself begs the question.
It was a black hole sink. And since it was at best marginal to that business, that piece eventually got shut down.
That explains point 1, 2, 3, 5 and possibly even point 4. (working time difference, and cheap equipment.)
The key to detecting fake accounts is tractability. That's why FB logins are gold. You can look at the account and - most of the time - it is easy to tell if it's real or fake.
The problem is that many sites want volume, not quality. They just let anyone "add content". This is a an easily solvable problem that most sites do not actually care to solve.
Is it really that hard for you to tell a fake FB/twitter account from a real one that you couldn't code the logic?
You don't even have to code it. You just need to link it. If someone is reading the review, they can go back to the person that wrote it and judge for themselves.