Hacker News Reader

Comment by jliptzin | Hacker News Reader

I can think of some simple things FIs can do to prevent fraud. For example they could leverage your cell phone's GPS at the time you make a purchase to make sure you're actually in the store where the purchase is coming from. For online purchases, they could text you a confirmation that you were the one who made the purchase. Just some simple things that seem a lot less complicated than machine learning that we haven't tried yet.

View on HN

(Disclaimer: I'm an engineer at Sift Science).

For online purchases (card-not-present transactions), the merchant takes on all of the fraud risk. This means that the banks do not have much incentive to protect against fraud. The merchants must go on the information they have, which probably doesn't include the card holder's verified phone number.

Sift Science has been successfully protecting online businesses for over a year, and it turns out that machine learning is (unsurprisingly) a good tool for this sort of classification problem.

Interesting ideas, but I don't think these suggestions would be so simple. They would put a burden on consumers to always have a phone at the ready. What happens if your phone can't connect to GPS inside a store? What if you don't have your phone with you (or if you don't have a phone at all)? Buying goods and services would be far less convenient.

That's true, things that sound simple on the surface often turn out to be pretty complex in implementation. I think that the number of people making purchases without cell phones on them is converging towards zero and will be there soon, so I think it's safe to think about these systems now.

What about implementing a 2FA system for larger purchases (online or off), implemented in an app on the consumer's phone like google authenticator or sms? Swipe your card at checkout, if amount is > $XX (or otherwise suspicious according to current models), prompt the buyer for a one-time code from SMS or an app. I use the same system when logging into gmail, my bank account, etc - I'd have no problem (and would even welcome) a similar system when using plastic. It's at least a lot more convenient than having the txn declined and your card disabled until you call their security hotline. This way, thieves would need to steal your card and your phone to cause damage.

When fighting ecommerce fraud, you have to be careful that the cure isn't worse than the disease. You could absolutely institute procedures that would cut fraud down to nothing, but your conversion rate and fraud prevention costs may suffer.

Reply on news.ycombinator.com