Hacker News Reader

Comment by UnoriginalGuy | Hacker News Reader

IP based "fraud" detection is fucking annoying.

I live in the UK and want to have stuff shipped to family in the US. I've had vendors of all sizes turn away my business because either they didn't like my IP or wouldn't let international addresses order at all.

Amazon(.com) has literally earned themselves thousands in additional sales because they happily accepted my UK payment to a US address without fuss or hassle.

You might say this is a niche situation but money is money, and I've had lot's of small vendors lose out because they were "US only!"

I now also have a "flower guy" because they're the only one in the city who will do international flower orders...

PS - Specific example, NewEgg, wanted to buy a several hundred dollar laptop - couldn't. Used Amazon instead.

View on HN

I hope that's not what the article is suggesting. The way I read it, it's more like what Google and Facebook do: very sophisticated tracking of multiple factors (your IP, geolocation, browser identity, second-factor, etc) to find out if it's really "you" logging in, or someone who's just got your password.

The problems are:

(1) This will never work for a single vendor (unless it's a massive vendor like Amazon, and they're already doing it). It's something the bank has to do so it can tie together all the information about you.

(2) Banks have proven to be totally useless at online security in the past, and I don't see that changing any time soon.

(3) Google-style security can be a bit annoying when you really are logging in from an internet cafe in a foreign country.

That's exactly it. It's important to look at a whole bunch of factors. For example, fraudsters tend to go directly to the payments page, whereas good users will browse around the site before making a purchase. There are tons of little signals like that which allow you to distinguish legitimate users from the fraudsters.

We don't do things like two-factor auth -- in general, we believe in minimizing friction. It's a better user experience, and if you can prevent fraud without burdening the user, why not?

We have more information with some examples of signals our system uses here: https://siftscience.com/large-scale-machine-learning

Isn't the first rule of fraud detection not to talk about rules you use to detect fraud? ;)

A long time ago we decreased fraud by a significant amount simply by putting a little message on our payment form that we detected fraud. Stolen numbers and identities are really valuable to fraudsters, they tend to prey on merchants they think they can get it by.

It is. If you spill the beans that you are checkin staying on site and browsing before buying, and it'll take a week till there's a tool for simulating that.

There is no security through obscurity only illusions of it.

Will people please stop saying that in this context?

Merchant-side fraud prevention schemes are not security. They are heuristics for reducing the number of bad transactions that the vendor has to handle.

Algorithms should be air-tight. Yes, the best way to ensure that they are is to make them public. Heuristics by definition are not airtight. The best way to get utility from them is to keep their nature hidden from parties trying to abuse the system.

It's analysing behaviour for patterns. If you let out what patterns you're looking for then those patterns change.

Wouldn't the patterns change after the fraudsters realize they are not working?

I'm not saying something like that will hold forever. It might take 2 months to figure out that sites check for that, and 2 weeks (/days) to code it up. If you make the information on your heuristic public, those 2 months just drop out straight.

It's a trap.

Maybe you could add the predictable human irrationalities as an input signal. For example decision paralysis - I'd expect legit customers to take a bit longer for pages that require a decision. Or the way people react to discounts - a fraudster wouldn't care, but a legit customer would be happier and thus less a little bit less focused.

Re: the first point. . .no one can go directly to the payment page, don't you have to have something to purchase first? And if, as a user, I've been to the site before, I might select one item and then go directly to payment.

The idea behind machine learning is that no single data point does the changing. It's about modelling you with a computer and determining if the model matches current models of fraudsters. If you do go directly to the payment page, you use tor for your browsing, you auto-delete cookies, and whatever else they check for, you become more clearly likely to be committing fraud. This does not mean, still, that you are committing fraud, only that you probably ought to be inquired about.

It's the same thing with, say, shoplifting. If you own a thrift store, and you see someone come in with a heavy coat, you might think nothing of it. But if that person acts suspiciously and holds his hands in his pockets, you may inquire as to whether that person is shoplifting. Of course, people do walk around suspiciously with hands in the pockets of big coats who are not shoplifting, but false positives like that are removed when the human element steps in at the last stage.

To play devil's advocate, if I click through x pages while preparing to defraud your website, I'm okay according to (one of) your metrics?

That doesn't seem very defensible.

That's only one of several signals they are tracking. There's also what you're ordering, where you're coming from, if you have a history on the site or not. Each one of those getting a pair of scores (likely_fraud, likely_legit) and the decision being made on the balance of probabilities at the time of purchase.

And remember that the goal isn't to absolutely eliminate fraud, it's to reduce it to the point where it has negligible impact on profitability.

On that note changing the form to require more information as your estimated risk goes up seems to be the ideal compromise.

Except that enables people to gain information about your fraud detection system.

Threatmetrix assigns a fraud risk/score based on multiple factors, including the geolocation, IP, & browser. Additionally (to your point #1), they anonymize data across their customers and alert if a device has been flagged in a fraudulent transaction elsewhere. On top of their own customers, they partner with Cybersource so there is quite a network of data behind their fraud analysis.

(I don't work for Threatmetrix- but I do use their product as provided via Cybersource.)

Hey Tom -- I'd love to see if we could help with fraud even above and beyond what Cybersource/TM do. Feel free to e-mail me: brandon@siftscience.com!

Google's bogon detection is also annoying if you (legitimately) use proxy/VPN services.

Seriously, they blocked the entirety of Linode's IPv6 range and there's absolutely nothing you can do about it.

Well, you can submit a false flag report, but Google customer support for suspected bots isn't great.

It's not IP based, it's billing address based.

Amazon has a UK presence so it's only natural they accept payments from there. But it's very myopic to insist all other vendors do the same since many don't have the resources to pursue fraud cases overseas. They barely manage to get through locally.

I used to work at a fashion house that didn't ship outside the U.S. simply due to our AVS not being able to valiate addresses outside the 50 states. Losing thousands of dollars to fraud during a bleak economy isn't how people stay in business.

I wasn't talking about shipping stuff outside of the US.

Amazon UK has nothing to do with the transaction. It is all through Amazon (US/.Com).

I wasn't either. I'm talking about the billing address, which for most vendors must be in the U.S. for their AVS to work.

Edit: Let me clarify further...

U.S. Businesses rent services here that let their AVS take advantage of anti-fraud measures. Many of these services don't even bother looking at the shipping address, but do look at the billing to make sure the card number matches the account holder information. These services often times have no information on overseas card holders so they have no means to verify whether the actual card holder made the purchase.

Now you also have some vendors who make sure the billing address == shipping address as that's a cheap way to prevent fraud (or at least reduce it). That's not what I was talking about.

What you're saying makes no sense.

If someone uses a stolen credit card with a working address then the AVS has done nothing to mitigate the fraud, if they use a non-working address then it bounces up-stream and the AVS has done nothing, and if there is no fraud then the AVS has done nothing...

So explain to me exactly what the AVS's point is? And how it saves companies money? Isn't it up to the bank to decide what is and is not a valid address for usage with the card?

All you're doing is hitting real customers (including international ones).

You need to read up on what AVS actually does :

http://en.wikipedia.org/wiki/Address_Verification_System

AVS doesn't work all that well outside the U.S. (Amex declines it outright) And services that do work outside are often value added (read: expensive) and for businesses that primarily cater to U.S. customers, isn't worth the price. AVS isn't just a "bank service". It's only available to merchants that use a gateway that supports it (same for CVV/2) : https://support.mivamerchant.com/supportsuite/index.php?/Kno...

And of those gateways, some don't support AVS outside mainland U.S. or only partially.

Those businesses aren't "losing money" by not catering to you. On the contrary, they're saving quite a bit by focusing on local customers.

If your shipping a physical good then it works well, different billing and shipping address can be a red flag. Depending on where the billing address is then it can be easy to stop fraud.

If the causes us to miss out on a few sales it is small price to pay compared to getting hit with chargebacks.

Also AVS works fine in the UK as well as the US.

> Now you also have some vendors who make sure the billing address == shipping address as that's a cheap way to prevent fraud (or at least reduce it).

I use a PO box as my billing address. I never have anything shipped to my billing address. Also, my PO box shows up nowhere in my wallet, so, if it gets stolen, at least the thief won't have a valid billing address to use with my cards. And merchants who check billing address will decline his order when it comes through with my driver's license address.

I've never had a problem with an online merchant using the tactic you advocate. However, if I did, I would be royally pissed and bad-mouth the vendor online. Far from reducing fraud, your tactic would serve to increase it!

Refusing to ship a physical product to a first-time customer at anything other than the address where their card is registered seems a sensible practice, and it is certainly in fairly common use here in the UK.

If you tried to order from one of those companies and failed their check, sure, they might lose your order, but it's a game of probabilities and you're making yourself a statistical outlier.

As for going on-line and bad-mouthing a vendor who uses this technique to reduce fraud, that's between you and your conscience, but if you in any way claimed that they were insecure and cost them business, don't be surprised if it becomes between you and their lawyers.

Perhaps you should think about the number of times you've entered a new shop to find some present for someone. Refusing the first sale because the shipping address is different equals to saying FU to most gift orders in my opinion.

As a side note, the most heavy handed and dumb fraud detection processes I ever saw where fom very small shops who would for instance try to hand mail or phone you to have you fax them some doc.

It's a real PITA, but since someone taje time to communicate with you in a people to people level, usually I wouldn't just cancel, and try to make it work out.

>Refusing to ship a physical product to a first-time customer at anything other than the address where their card is registered seems a sensible practice

Knowledge of the billing address is a means of authentication, as is knowledge of the expiration date and the CVV2. A different billing address enhances security, since a typical thief would be expecting the billing address to match whatever fleeting knowledge of the customer he gleaned during the theft. I've done many transactions using a PO box billing address and a street shipping address, all without a problem.

> As for going on-line and bad-mouthing a vendor who uses this technique to reduce fraud, that's between you and your conscience, but if you in any way claimed that they were insecure and cost them business, don't be surprised if it becomes between you and their lawyers.

My conscience says, you inconvenience me, I tell others!

As they say in Texas, Bring It On. In the United States of America, truth is an absolute defense! That means, even if you go out of business because your story was told, you've got no case unless you can prove the story teller lied deliberately while knowing the truth.

Knowledge of the billing address is a means of authentication, as is knowledge of the expiration date and the CVV2.

Right, but requiring that physical products are only ever sent to an address that is known to be associated directly with the card holder, at least the first time when you don't "know" the card holder yet, reduces the likely gain from fraud to near zero for third parties. That is a far more effective deterrent than any minor hurdle in the authentication process.

As they say in Texas, Bring It On. In the United States of America, truth is an absolute defense!

And which truth would that be? If you caused serious damage to a business by claiming this practice made them less secure, I expect they would have no difficulty at all lining up expert witnesses who say they have a very different idea of what makes things more secure. They would have the added advantage that this is a field where lots of people look very carefully at real numbers, so they could probably bring a mountain of statistical data in support of their position.

Smart fraud detection will use IP as one of a hundred or so checks. I know of at least one service in the UK that would OK your transaction if it could match your billing info to those US addresses through previous purchases with any of a number of different retailers.

The goals the larger retailers have here are to reduce the number of manual approvals (things like phone follow ups) needed without compromising the fraud rate, not to turn down transactions, so there's a lot of competition for more intelligent detection.

Neweggs policies on card related issues are insane imho. I've actually had my account banned because my wife used my CC to buy something on her newegg account once. The next time I went to make a purchase my account was banned because the CC i wanted to use was listed in another account. It's worth noting that they didn't have any problems processing `her` order which is where you would want that kind of action to actually happen!

I run an ecommerce site and we sell about 50% in the US and 50% overseas and have a lot of fraud attempts pretty much daily (more outside of the US, but plenty in the US). A couple months ago I built some simple checks that dramatically reduced our handling time of fraud cases. The checks include:

1. Has the credit card been used by any other account holder? 2. Has the shipping address been used by any other account holder? 3. Has the phone number been used by any other account holder? 4. Has the billing address been used by any other account holder?

If any of those are true a warning or info notice is shown depending on the situation. For example, if the shipping address is used by multiple accounts an info notice is shown as there are plenty of times the same address would be used by multiple accounts (freight forwarder, sending parts to a repair shop, etc...). It reminds the order processor to check it out and verify the order is legit.

If the billing, credit card or phone number match it throws a warning as that is far less likely to happen legitimately - which is what you experienced. We don't automatically decline like Newegg did to you, but we do investigate the order thoroughly and if we aren't comfortable with it we will decline or require funds be sent via a verified papal account or wire transfer.

We use a lot of other methods for checking fraud; IP, AVS, etc... but these really simple checks have been really helpful because we get hit by the same people over and over again. They try the same card with multiple accounts or use the same shipping address on multiple accounts, etc...

If an order has been marked as fraud and any of those checks above hit then the new order is automatically marked as fraud too.

I actually would have no problem with them just telling me "hey you can't use this card because it's in another account." It was the severity of the action that was the most frustrating part. I'm still not sure why when the card was in my account to start with it let my wifes purchase go through, that just doesn't make any sense at all to me.

Would you use an api service that aggregated addresses and could tell you if a given address was known to be associated with fraud? And that let you add addresses to the 'blacklist'.

I would certainly look at it with much interest. Being able to add an address to the list would be fantastic as well since small retailers like us can't combat fraud alone very efficiently.

I've never had this problem. I've used the same CC on multiple accounts for the past few years.

I totally agree with you.

I use dirt-cheap VPS servers to tunnel web traffic over SSH socks proxies. Why? For fun. Because I can. To thwart ISP packet inspection and Google profiling my IP. To screw up IP-based ad targeting. Whatever.

I often sign up for a new VPS service while relaying from another one. I will often make it through the entire sign-up process, going through the PayPal info and everything, only to be told something like, "Your new account has been suspended due to suspicion of fraud." This only happens when I'm using a proxy. So they must be doing geo-IP lookups and flagging IP space that is a certain variance from your billing address.

I don't know how many VPS providers have lost my business due to this practice.

Well they are probably doing it to avoid headaches later. Maybe your business would be innocuous, but others doing the same thing might have some dirtier business in mind later.

Having dealt with this on the VPS provider end, sadly most orders which come in from hosting company IP ranges (not residential) are fraudulent.

'It seems like you are accessing our site using a proxy; we will therefore only accept payments in bitcoin to reduce chargeback risk.'

I had to move services running on my VPS because their "fraud detector" would portscan it and find an "open proxy". It's the stupidest thing ever implemented in a payment system.

Why do you think it is "IP based"? It sounds more like traditional fraud checks requiring the billing and shipping address to be located in the same country.

probably because of this quote:

On the internet, everything is measurable, and fraudsters leave behind tracks they’re not even aware of. What IP address is the user coming from?

edit: oh, you probably mean 'why do you think (random business) refusal is IP based'.

His example of NewEgg is a bad one. They straight up say they don't ship international orders on their FAQ page.

Reply on news.ycombinator.com