News for hackers. Stuff that matters.

A comment on How Candy Japan got credit card fraud somewhat under control.

Re:How Candy Japan got credit card fraud somewhat under control by stcredzero on Tuesday April 05, 2016 @01:36PM (#11432515)
If you suspect an order is fraud, don't go out and say to the criminal "hey, I declined your super suspicious order!". Instead, play dead. Pretend they got you. Tell them "thank you for your order", behaving exactly the same way as if it really was a successful order.

The name of the game is to make things cost more for your enemies than they cost for you. Removing instant feedback is key. Instant feedback is great. Delayed feedback is costly.

This is in large part why most DRM and anti-cheat failures happened. Companies and developers need to think about the economics of what's going on. It's not the side with the trickiest mechanism that wins. It's the team with economics on their side.

(Amateurs: tactics, pros: logistics)

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by lis on Tuesday April 05, 2016 @03:46PM (#11433723)
Blue Byte did something along the lines of your suggestion with the copyright protection of Settlers III. When the game detected that the DRM was broken, iron smelters would only produce pigs instead of iron.

https://en.wikipedia.org/wiki/The_Settlers_III

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by viggity on Tuesday April 05, 2016 @04:37PM (#11434153)
reminds me of "Game Dev Tycoon", where if it detected it was cracked, the player had a hard time progressing because their virtual company kept getting ripped off by crackers.

http://gameological.com/2013/05/inventory-9-games-with-creat... (it is the first one)

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by hellbanner on Tuesday April 05, 2016 @05:55PM (#11434863)
More specifically, the player's simualated video game company goes bankrupt, "due to piracy", according to the game.

More details & discussion from Game Dev Tycoon's developer blog: http://www.greenheartgames.com/2013/04/29/what-happens-when-...

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by Symbiote on Tuesday April 05, 2016 @06:43PM (#11435180)
For a much older example, Sim City gave continual disasters after about 10 minutes if the version was detected as pirated. This was 1990 or so.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by stcredzero on Tuesday April 05, 2016 @04:47PM (#11434263)
Not bad, but even that reads like a bit of an FU from the devs. ("Pig Iron?") The best thing to do is to make it definitely seem like it was a bug introduced by the crack. (Maybe James Bond villains giving their secret projects suggestive code names and telling their entire plan isn't unrealistic?)
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by kderbe on Tuesday April 05, 2016 @06:00PM (#11434900)
It's important not to disguise any anti-piracy measures as bugs, because pirates (or even reviewers playing pirated copies) will loudly proclaim that the game is buggy, and discourage legitimate buyers. This may have contributed to the closing of at least one development studio (Iron Lore, developer of Titan Quest)[1].

[1] http://www.quartertothree.com/game-talk/showthread.php?42663...

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by eps on Tuesday April 05, 2016 @06:13PM (#11434985)
This must be specific to the games, because they do tend to be buggy on their own.

With non-gaming software the situation is completely different. When a cracked version craps out the prevailing sentiment is always that it was a bad crack. Always.

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by stcredzero on Tuesday April 05, 2016 @09:02PM (#11435864)
It's important not to disguise any anti-piracy measures as bugs, because pirates (or even reviewers playing pirated copies) will loudly proclaim that the game is buggy, and discourage legitimate buyers.

I'm wondering why there isn't a service that lets you search for people encountering your crack-penalty. A really sneaky company would disguise itself as a hacker group, then offer a copy of the game that doesn't have that "bug." (But has another one.)

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by sleepychu on Wednesday April 06, 2016 @03:21AM (#11437195)
Green Heart Games did basically that. http://www.greenheartgames.com/2013/04/29/what-happens-when-...
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by jldugger on Tuesday April 05, 2016 @05:50PM (#11434819)
Well, if you want to convert a pirate user into a sale, you need to convince them that the bug isn't present in the retail copy.

So you're balancing making it hard for crackers to detect, and easy enough for players to encounter that shift behavior.

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by stcredzero on Tuesday April 05, 2016 @09:03PM (#11435868)
So have a web search that finds people talking about the fake bug, then take appropriate action.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by Kephael on Tuesday April 05, 2016 @08:04PM (#11435621)
Bohemia Interactive have their games "degrade" if they detect they are pirated. Weapons become increasingly inaccurate and your character turns into a bird.

https://en.wikipedia.org/wiki/FADE

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by optimiz3 on Tuesday April 05, 2016 @02:09PM (#11432834)
This also applies to customer service. Nice customers get fast response times. Toxic entitled customers (especially of the free plan) wait 2-3+ days before getting a response.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by josu on Tuesday April 05, 2016 @04:14PM (#11433956)
I'm not disagreeing with your point, but I love it when I get great customer support as a free/low value customer, and it definitely increases my chances of conversion.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by Matt3o12_ on Tuesday April 05, 2016 @05:56PM (#11434867)
Maybe op was referring to free customers that are rude, and impose big costs to you (way above the average support ticket).

But agreed, if I get bad support as a free customer, how can I know that the support will get any better if I start paying (except for services that sell support). When I get an instant response to a question from a friendly support, I would say that I'm far more likely to upgrade to their paid server.

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by optimiz3 on Tuesday April 05, 2016 @07:18PM (#11435367)
The point is that toxic customers tend to sap your bandwidth. If you impose a time cost on them it throttles their ability to do so.

One way or another the problem works itself out, which lets you focus on the paying (i.e. actual customers).

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by SilasX on Tuesday April 05, 2016 @01:54PM (#11432700)
Yeah I was just talking to an employee of a CC fraud prevention company and that was my thought: they proudly talk about how they can identify fraud and refuse the transaction, when my question was, why not just look like you're approving the order and then follow it right to the fraudster?

Better to reliably catch the humans behind this and impose stringent legal penalties than allow them to keep guessing without a cost for being wrong.

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by kyle6884 on Tuesday April 05, 2016 @02:07PM (#11432818)
This may work nicely for a subscription business where you have 2 weeks to identify problematic orders. But what about everyone else? Should we silently fail on orders where a customer accidentally mistyped their CC#? Imagine all the extra work involved when you could have had them fix it on the spot.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by pjc50 on Tuesday April 05, 2016 @02:17PM (#11432921)
You can report "failed checksum" or "not a valid account" to people, although you should rate limit - the problem is data that is valid but stolen.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by occamrazor on Tuesday April 05, 2016 @02:18PM (#11432930)
Mistyped card numbers can be identified client-side (CC numbers have a checksum digit). If the number is valid, but the transaction is declined, then fail silently (and possibly send a failure email after manual review of the transaction)
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by tomp on Tuesday April 05, 2016 @02:27PM (#11433023)
It could also be declined because of mistyped expiry date or address or name. Or simply declined because the customer is over their credit limit. In all of these cases, timely feedback is useful for genuine customers.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by pc86 on Tuesday April 05, 2016 @03:22PM (#11433520)
Which is why it says in the article that these countermeasures almost always come at a cost to customers as well. It is a trade off.

In some instances it is worth it to make the experience marginally worse for customers because the savings by preventing a percentage of fraud are so large.

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by duaneb on Tuesday April 05, 2016 @05:47PM (#11434794)
Nonetheless, this doesn't contradict the "failing silently" for chargebacks. It's not fraud if they enter the data poorly or there's no credit left so the charge is never made.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by fweespee_ch on Tuesday April 05, 2016 @02:02PM (#11432779)
> Yeah I was just talking to an employee of a CC fraud prevention company and that was my thought: they proudly talk about how they can identify fraud and refuse the transaction, when my question was, why not just look like you're approving the order and then follow it right to the fraudster?

You can get disposable physical addresses as well.

It is part of why some companies flag a mailing address I use as a fraudulent order. I primarily use it to avoid handing out my RL address on domains that don't allow whois protection.

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by brightball on Tuesday April 05, 2016 @05:10PM (#11434489)
100% agree. They care about ROI also.

At my last company I build systems specifically designed around wasting the time of people that we "caught". We used to keep a dashboard with the top abusers on a wall in the office once they'd be caught to show how much of their time we were wasting. It was therapeutic.

[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by Lavel on Wednesday April 06, 2016 @07:39AM (#11438062)
Valve will sometimes delay banning CS:GO hackers to confuse them about just what triggered the ban.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by groaner on Wednesday April 06, 2016 @06:21PM (#11442664)
What happens if you have a very small false positive rate for fraud, and end up stiffing the customer? You could easily land in deep trouble with consumer protection laws after falsely satisfying their order.
[ Parent | on HN ]
Re:How Candy Japan got credit card fraud somewhat under control by paulpauper on Tuesday April 05, 2016 @02:25PM (#11433010)
that why every social network does ghosting to trick spammers and trolls
[ Parent | on HN ]