News for hackers. Stuff that matters.
Re:How Humble Bundle stops online fraud by fpgaminer on Friday July 22, 2016 @05:42PM (#12146975)
This is one of the big casualties of the American credit card conglomerates' failure to focus on reducing fraud. They get paid regardless of whether a transaction is fraudulent or not, so they have no incentive to improve. The result is that this burden gets dropped on merchants, requiring both man-hours and cost, and it disproportionately affects smaller companies. It basically amounts to a tax by the merchant processors on small businesses, for no benefit to anyone but themselves.

I've seen the discussions crop up on Hacker News before* of people starting commercial websites, getting hit with massive amounts of fraud, and either having to just shutdown completely or shell out more of their margin for a third party fraud prevention service. It's disgusting.

From the consumer's perspective it is nice that credit cards are easy to use, and that we are protected from bad merchants, thieves, etc. But we're putting a strangle on small business with this system. There are better ways that would both reduce fraud overall, thus saving consumers money, and not disproportionately penalize small businesses. It wouldn't make credit cards any harder to use.

On a tangent, Humble Bundle stopped accepting Bitcoin a year or two ago. Considering that Bitcoin can have a 0% fraud rate it makes it a somewhat odd move, especially since Humble Bundle is a really great target for fraud (the goods are easy to move). And no, I don't view Bitcoin as an ideal solution (as it exists today); it's on the opposite side of this problem, foisting fraud prevention onto the consumer. But from Humble Bundle's perspective (and any business, small or big) it is the perfect solution to preventing fraud.

* The ones I'm recalling are even more sad. They were getting hit by fraudsters who were just using their site to test the cards, before moving on to the actual fraud target(s). The end result is the same, though.

Re:How Humble Bundle stops online fraud by jeff18 on Friday July 22, 2016 @07:14PM (#12147449)
Humble founder here.

Bitcoin would be a great topic for another blog post, we have a really long love-hate relationship with it. Don't worry, Bitcoin support will hopefully return to our store and gaming bundles eventually. We know what we need to do to turn it back on (more or less, hook it into our SMS verification system) but we have many higher priority tasks work on. We are hiring if you know anyone: https://jobs.humblebundle.com/careers/ :)

While bitcoin is great for preventing chargebacks, it is inherently anonymous. That is good for certain use cases, but when you are trying to enforce a strict per customer limit, it is a nightmare. We invested a lot of resources into doing what we can to combat it, but eventually we figured that we had more important things to do and had to tap out. Almost 100% of the bitcoin traffic was bad actors, and even so it was such a tiny fraction of our sales, like under 0.05%.

There are a lot of diehard bitcoin users, like yourself, and I would love to support your preferred payment method again, but it is an incredible amount of work to do safely.

Re:How Humble Bundle stops online fraud by akavel on Friday July 22, 2016 @07:19PM (#12147471)
Curious how do you know they were bad actors, given the anonymity? Were those some known stolen bitcoin wallets or something? Sorry if the answer is obvious, I'm not a bitcoin user.
Re:How Humble Bundle stops online fraud by jeff18 on Friday July 22, 2016 @07:30PM (#12147533)
Good bitcoin purchases:

  $22 [email protected]
  [30 minutes later]
  $50 [email protected]
  [30 minutes later]
  $15 [email protected]
  etc.
Bad bitcoin purchases:

  $1.00 [email protected] [1 second later]
  $1.00 [email protected] [1 second later]
  $1.00 [email protected] [1 second later]
  $1.00 [email protected] [1 second later]
  $1.00 [email protected] [1 second later]
  etc.
(queue removal of bitcoin)
Re:How Humble Bundle stops online fraud by ThatPlayer on Friday July 22, 2016 @08:04PM (#12147648)
Have you considered allowing them if you have a valid credit card on file. For example, I'm currently a Humble Monthly subscriber which already gives me a one click purchase options through the credit card on file.

Vultr, a VPS Host, accepts Bitcoins but started to require a valid credit card or Paypal purchase before accepting Bitcoins to prevent ToS violators who used Bitcoin.

Re:How Humble Bundle stops online fraud by kevindong on Friday July 22, 2016 @09:11PM (#12147878)
But would that not defeat the purpose of Bitcoin (don't need to interact with the massive financial institutions, anonymity, etc.)?
Re:How Humble Bundle stops online fraud by samb1729 on Friday July 22, 2016 @09:41PM (#12147957)
It's not necessarily the case that someone would want to use Bitcoin for anonymity, it might just be a more convenient payment method or something else. Doesn't hurt to give people more places to spend their Bitcoin even if the circumstances are less than ideal.
Re:How Humble Bundle stops online fraud by kevindong on Friday July 22, 2016 @09:52PM (#12147983)
In what way can Bitcoin be considered a meaningful alternative (however you define it) if you also have to input a valid credit card number (that, presumably, the merchant will run the traditional $1 verification charge on)?

The reality is that Bitcoin is less convenient than using a regular credit card (because, realistically, you're not going to be mining Bitcoin but rather you'll be buying Bitcoin using your regular credit card/bank account). I would argue that Bitcoin is also worse in every way (no chargebacks, wild fluctuations in the valuation of a unit of Bitcoin, etc.) if you also don't care about anonymity and the product you're buying is fully legal.

Re:How Humble Bundle stops online fraud by rtpg on Saturday July 23, 2016 @12:26AM (#12148333)
CC serves as verification. Bitcoin has less fees.

So it's like "providing an ID", and then paying. Even if bitcoin is not "anonymous" (pseudonymous), there's still the decentralised+cheap nature of it that's worthwhile.

Re:How Humble Bundle stops online fraud by traviscj on Saturday July 23, 2016 @02:04AM (#12148551)
Fees argument doesn't really hold water because authorizations costs money too, even if subsequently voided.
Re:How Humble Bundle stops online fraud by ryan-c on Friday July 22, 2016 @08:32PM (#12147748)
Sad to see it go - I've used it to pay for humble bundles a couple of times.
Re:How Humble Bundle stops online fraud by gggggg11111 on Saturday July 23, 2016 @07:12AM (#12149142)
Yeh they lost a customer there, anyways can buy from Steam now direct with bitcoin most of time there are great offers there too.

edit: oh look downvoted for speaking my mind, go HN groupjerk

Re:How Humble Bundle stops online fraud by akavel on Friday July 22, 2016 @08:28PM (#12147740)
Ok, I think I understand - that you mean some more general money laundering of bitcoin? where source of the money need not be known, because behavior shows that it just has to be money laundering. Tx!
Re:How Humble Bundle stops online fraud by jsprogrammer on Friday July 22, 2016 @08:46PM (#12147792)
How exactly does the laundering happen in this scheme? Isn't the money just being sent to Humble, never to return to the person who sent it?
Re:How Humble Bundle stops online fraud by TylerE on Friday July 22, 2016 @09:41PM (#12147955)
The keys get sold on sketchy scam websites like G2A
Re:How Humble Bundle stops online fraud by chii on Friday July 22, 2016 @11:38PM (#12148226)
shouldn't/couldn't the publisher who own the key then just deactivate the key if the source of the money is found to be a laundered source?
Re:How Humble Bundle stops online fraud by sliverstorm on Saturday July 23, 2016 @01:58AM (#12148540)
I imagine they'd rather avoid the whole mess entirely
Re:How Humble Bundle stops online fraud by Jarwain on Saturday July 23, 2016 @05:06AM (#12148890)
Sender gets game keys from Humble and resells the keys for profit.
Re:How Humble Bundle stops online fraud by crishoj on Friday July 22, 2016 @09:05PM (#12147861)
The flow of money doesn't terminate at Humble.
Re:How Humble Bundle stops online fraud by jsprogrammer on Friday July 22, 2016 @09:46PM (#12147965)
Wouldn't Humble need to be in on the laundering then? Or are the launderers able to be in cahoots with the publisher of games?
Re:How Humble Bundle stops online fraud by nathancahill on Friday July 22, 2016 @07:24PM (#12147503)
Typically "bad actors" in this situation are bad in regards to the company, it's not a definition of their person or the source of their money (although those often coincide).
Re:How Humble Bundle stops online fraud by luchs on Friday July 22, 2016 @07:28PM (#12147522)
I'd guess that they track keys which appear on reseller sites. So the "bad actor" comes from later use, not from e.g. stolen Bitcoins.
Re:How Humble Bundle stops online fraud by ploxiln on Friday July 22, 2016 @09:55PM (#12147994)
ahhhh ... it's because of the "name your own price" model and offering of steam keys.

You want to limit to one super-cheap steam-key per person. So that's more of a "promotion" than a classic exchange. Corner case ;)

Re:How Humble Bundle stops online fraud by al_chemist on Saturday July 23, 2016 @09:57AM (#12149463)
"Name your own price" and "Humble" in the name are just marketing gimmicks. It's just a business like any other - they want you to be generous, pay more than other people. If you take "name your own price" honestly, they try to block you. Under $1? "Sorry, minimal name your own price is $1." Paying under average price? "Sorry, please try our captcha roulette or increase your 'name your price'". I can't believe they don't require scan of passport and utility bills to "assure better quality of service".
Re:How Humble Bundle stops online fraud by blhack on Friday July 22, 2016 @10:15PM (#12148047)
The bitcoin die-hards will lynch me for saying this, but: I think this is a good example of where using a side-agreement (sortof a sidechain, I guess?) would be a good thing.

So: don't accept bitcoin payments, accept coinbase payments, but only one per coinbase account.

Re:How Humble Bundle stops online fraud by StavrosK on Saturday July 23, 2016 @10:09AM (#12149492)
I'd be happy to verify my phone number if it meant I could buy anything with Bitcoin afterwards. There are other payment solutions that work, too, I just really really like the UX of Bitcoin and the fact that it's pretty much cash. I don't need permission from my bank to transact.
Re:How Humble Bundle stops online fraud by Datguysteven on Saturday July 23, 2016 @01:52AM (#12148530)
Have you used websites that detect proxy & bad ips like getipintel.net? I'm curious if there's a correlation between abuse and proxy ips.
Re:How Humble Bundle stops online fraud by Retric on Friday July 22, 2016 @05:44PM (#12146985)
The fact they removed Bitcoin may suggest it's less useful than you might think. The reasons for this are complex, but sadly it's just worse than Credit cards for most merchants.

What's annoying as a customer is many companies flag legitimate transactions, wait a few days to say so, and then handle it poorly after the fact.

Re:How Humble Bundle stops online fraud by fpgaminer on Friday July 22, 2016 @06:03PM (#12147096)
> What's annoying as a customer is many companies flag legitimate transactions, wait a few days to say so, and then handle it poorly after the fact.

If by this you mean they don't notify you that the transaction was flagged until a few days later, that's (probably) part of the fraud prevention system. There was a post on HN similar to this one awhile back about how another site handled fraud prevention. One of the most successful techniques is they found was to delay notification. Fraudsters are less likely to target you if it takes them a long time to find out their transaction was declined. Credit card fraud is very much a hit and run operation, as the card is likely to quickly get flagged and blocked by the issuer within a few hours of the fraudsters using it.

That said, a few days is pretty bad and I imagine it really only takes a few hours delay to make the technique effective.

Re:How Humble Bundle stops online fraud by ThatPlayer on Friday July 22, 2016 @06:17PM (#12147169)
>The fact they removed Bitcoin may suggest it's less useful than you might think.

They have not removed Bitcoin. You can check the current Book bundles which do have Bitcoin enabled. In my experience, it tends to be disabled on publisher bundles like the current 2K and Revelmode Bundles. Probably the publishers not accepting Bitcoins.

Re:How Humble Bundle stops online fraud by StavrosK on Friday July 22, 2016 @06:58PM (#12147366)
I wonder why, though. The publishers don't need to accept Bitcoin, HB just gives them dollars in the end. I would like to hear from an official source on this, because Bitcoin seems like the best payment method for them (and me, because I love how easy it is to use).

I completely fail to understand why they seem to rather dislike it.

Re:How Humble Bundle stops online fraud by yannyu on Friday July 22, 2016 @07:08PM (#12147420)
It's possible that HB doesn't want to be liable for the conversion of BTC to USD, and therefore the two parties are unable to come to an agreement as to how the royalties and compensation works for BTC sales. In the absence of an agreement on how to process BTC, it's easiest to simply not accept BTC for all parties.
Re:How Humble Bundle stops online fraud by StavrosK on Saturday July 23, 2016 @07:51AM (#12149209)
That sounds unlikely to me, since Coinbase and the other processors promise to accept a price in USD and give you exactly that price, abstracting payment from you completely...
Re:How Humble Bundle stops online fraud by gruez on Friday July 22, 2016 @10:11PM (#12148040)
Don't they use a bitcoin payment processor like bitpay or coinbase which handles conversion?
Re:How Humble Bundle stops online fraud by ThatPlayer on Saturday July 23, 2016 @01:22AM (#12148465)
Humble Bundle uses Coinbase, but maybe they don't convert it to USD.
Re:How Humble Bundle stops online fraud by divbit on Friday July 22, 2016 @06:00PM (#12147077)
>sadly it's just worse than Credit cards for most merchants.

Don't most merchants just use something like a 'pay with bitpay / coinbase' which results in them directly getting cash? I can't imagine how that would be much worse?

Re:How Humble Bundle stops online fraud by wmf on Friday July 22, 2016 @06:07PM (#12147115)
It's worse if the Bitcoin payment never goes through or the customer abandons their cart due to Bitcoin's generally poor UX.
Re:How Humble Bundle stops online fraud by voxic11 on Friday July 22, 2016 @06:52PM (#12147347)
I really like bitcoins ux, it's really simple to take out your phone and scan a qr code. I've also made a large number of transactions and have never had one fail (some can take a while to get confirmed but every merchant I've used credits you as soon as they get the broadcast, not when it's actually confirmed.
Re:How Humble Bundle stops online fraud by swiley on Friday July 22, 2016 @09:46PM (#12147968)
This is my feeling exactly! Bitcoin ux (especially for online only stuff that doesn't actually need an address) is actually way nicer than typing in my credit card.

This last time I tried to buy something with my credit card I accidentally mistyped the code on the back and they disabled it until I called the card issuer and gave them my SSN!

Re:How Humble Bundle stops online fraud by StavrosK on Friday July 22, 2016 @06:56PM (#12147359)
"Poor UX"?

"Scan QR code, press Accept" is poor UX? You should see Visa's 3D secure, the thing that just makes me close the browser window whenever I see it, because it means I'm never getting the payment through.

Re:How Humble Bundle stops online fraud by divbit on Friday July 22, 2016 @06:35PM (#12147255)
I would guess, just having it as an option in addition to credit cards, wouldn't make someone abandon their cart in the case of a poor UX (more likely abandon bitcoin)
Re:How Humble Bundle stops online fraud by zanny on Friday July 22, 2016 @10:09PM (#12148037)
The various tipping services on reddit and other message boards that enable bots are anything but poor UX. Nothing else can come close to enable that kind of instant tipping.
Re:How Humble Bundle stops online fraud by chrischen on Friday July 22, 2016 @05:54PM (#12147043)
Yes there's a small but significant percentage of transactions for my company that are flagged and completely withheld because of some non-related issue of fraud. For example they lost their card, or their card had some other fraud on it, or they mistakenly reported fraud.

Despite not being our fault, the CC companies withhold the cash for months....

Re:How Humble Bundle stops online fraud by ThatPlayer on Friday July 22, 2016 @06:16PM (#12147162)
>Humble Bundle stopped accepting Bitcoin a year or two ago

It seems to be enabled on a individual bundle basis. While the main bundles going on right now are not accepting it, the two Book Bundles are accepting Bitcions.

However it's always been the less noticeable button.

Re:How Humble Bundle stops online fraud by fpgaminer on Friday July 22, 2016 @06:29PM (#12147234)
I meant in the store which added support maybe 3 or so years ago, and then dropped it a year or two ago. I used to prefer buying my games there, instead of on Steam, because of that as well as not having my games library locked to Steam. Nowadays I'll usually buy from GMG for the same reasons, though their store interface is much more confusing and conflated compared to Humble's.
Re:How Humble Bundle stops online fraud by cooper12 on Friday July 22, 2016 @06:00PM (#12147072)
By the way the ones you are thinking about are Candy Japan: https://www.candyjapan.com/candy-japan-hit-with-credit-card-....
Re:How Humble Bundle stops online fraud by fpgaminer on Friday July 22, 2016 @06:15PM (#12147151)
Thank you, it was definitely the Candy Japan thread that I was thinking about. I believe this was the specific article: https://www.candyjapan.com/how-i-got-credit-card-fraud-somew... (HN thread: https://news.ycombinator.com/item?id=11431881). The associated comments have stories from other entrepreneurs bitten by this.
Re:How Humble Bundle stops online fraud by acbabis on Friday July 22, 2016 @05:48PM (#12147009)
> They get paid regardless of whether a transaction is fraudulent or not, so they have no incentive to improve.

It doesn't take away from your main point, but credit card companies do have some incentive to improve. They want the customer not to be inconvenienced by having to report fraud in the first place, and they want to avoid having those people call the support staff. That's why banks monitor your activity and automatically decline transactions that seem fishy.

Re:How Humble Bundle stops online fraud by aianus on Friday July 22, 2016 @07:03PM (#12147404)
> That's why banks monitor your activity and automatically decline transactions that seem fishy.

This practice is infuriating and does the opposite of encouraging me to call support less.

Re:How Humble Bundle stops online fraud by Falcon9 on Friday July 22, 2016 @08:37PM (#12147769)
Huh. I actually used Bitcoin to buy Crashlands through the dev's Humble link since they said they get a larger cut there than through Steam, and I decided to cash out my Stellar (or whatever those morphed into recently) which worked out nicely for me. I guess they don't accept Bitcoin for some of their bundles which could then be resold on shady websites.
Re:How Humble Bundle stops online fraud by mootothemax on Friday July 22, 2016 @06:22PM (#12147194)
Bitcoin doesn't solve fraud; there's no way to prove that someone hasn't sent money to you.

That is, you can prove ownership of a Bitcoin address, but you can't prove that you don't own an address.

Re:How Humble Bundle stops online fraud by gohrt on Friday July 22, 2016 @07:42PM (#12147574)
> or shell out more of their margin for a third party fraud prevention service. It's disgusting.

how is that meaningfully worse than your proposed solution, paying the CC processor for fraud-prevention?

Re:How Humble Bundle stops online fraud by fpgaminer on Friday July 22, 2016 @08:01PM (#12147634)
Because, right off the bat, the CC processor can do a better job. They have more volume and resources, so their fraud prevention could be just as good if not better than the third party systems (note: _could_, assuming they actually put the necessary effort into it). More importantly, though, what I suggest is implementing actual security on credit cards. These fraud detection systems would be largely unnecessary if credit cards were secure. That's primarily what I suggest, and that would reduce fraud overall, thus reducing overall costs for everybody.
Re:How Humble Bundle stops online fraud by joshmn on Friday July 22, 2016 @07:49PM (#12147605)
> people starting commercial websites

GitHub had an issue with this IIRC.