There are services that do this. Several retail stores I consult for have transaction filtering through an independent fraud detection service which has its oen blacklists of hashed CC numbers, emails, and street addresses. They also evaluate the ip address, distance fom billing and shipping addresses and a slew of other factors.

Criminals have many tools that can circumvent these systems though and many are very hard to defeat while still providing a smooth customer experience. There are entire web browsers developed by Russian groups that exist solely to clone the entire fingerprint of the victim, complete with session cookies. A lot of bank fraud happens this way...a hidden RDP service is installed on victims machines and then sold online so you can just remote into their computer, login to their bank and nobody is the wiser. There are services to conduct COBs (change of billing) so you can get new credit cards shipped to fake addresses under the attacker's control. And nearly all online bank account/CC sellers usually include cookies with the stolen cards now. Criminals have quickly figured out that a VPN in the general location of the victim is no longer good enough and they've adapted much faster than security systems can keep up with. There's also still a very big and unfounded trust system between certain merchants and certain banks. For example, AMEX cards sell for much more on the markets because many merchants (including Amazon) will usually assume trust in those cards even if other factors seem a bit off and will often ship products before fully confirming the transaction, so even if the card is flagged, it's likely a criminal could still steal a product or two. This is nonsense and despite being well known information to anyone that's spent even a little time researching fraud networks, it remains an exploitable loophole.

I don't doubt that your statements are true. However, services like this do stop a lot of fraud. If you do not have some basic filtering in place, it is that much easier for the less sophisticated fraudster. The particulars of your business will definitely affect the ability to stop some types of fraud. However if you are shipping a product to your customer you can make fraud pretty hard. It will depend largely on the product you are selling. You have to increase the effort required to successfully get a product shipped so that it exceeds the profit that can be made from it.

In our case we often do something similar to this:

---

No order is rejected outright - but various combinations of criteria cause a manual review of the order. This prevents customers getting error messages and also avoids having fraudsters receive quick feedback.

Shipping addresses known to be forwarding mail centers or mailboxes are flagged.

If the billing address does not match the shipping address, and the IP is flagged as proxy/vpn/datacenter, etc. or is too far from the billing/shipping address, it is flagged. This allows most people to ship to their office even though the credit card is at their home address, etc.

If the billing address is to far from the shipping address it is flagged. Fraudster are limited to using cards that have billing addresses in a close range to where they can receive goods.

The machine learning system gives a score and various thresholds of that score are used to trigger in combination with other factors.

Flagged items are manually reviewed. Sometimes customers are called to do human verification.

---

Some still get through, but I just implemented one a few weeks ago and saw 99% reduction in fraud orders, and a 90% reduction in man-hours for reviewing orders. In most cases, the fraudsters will just see that it is no longer worth their time and move on to easier targets. Obviously this particular store had a serious problem due to a high level of automation and an easily resalable product. The margin of the product and relatively low shipping costs allowed the fraud to get to pretty high levels before they really focused on it.

Wow, so I guess you could say that you don't have to be 100% effective, just better than the other potential victims.

Its not just that there are other victims. Let's say you are selling a widget for $50. The fraudster can order some of these and put them up on Amazon for $45. They have costs associated with this, including the cost of acquiring usable CC numbers, the cost of running their store, the cost of placing the fraudulent orders. I can increase the cost of the first and third in that by filtering a large number of their orders. Many of their CCs aren't going to pass the filter and many of the time they spend making the orders is wasted. Even if they have bots making the orders, there is a cost associated with it. Increase it enough and they don't really make enough for it to be worth their while.

Makes sense though. If your herd is being attacked by a pack of wolves, as long as there is someone slower/weaker/dumber than you, they’ll become the target and your likelihood of staying alive goes up.

TLDR: don’t be last, second to last is still OK. I guess.

Which do you recommend? I work with custom solutions for banks which a lot of times include fraud prevention services from third parties, so I'm consistently benchmarking for better alternatives.

What services do this & are they expensive to implement? Are you just unloading CC data & other hashed values for matches like Maxmind?

Yes - you send a hashed cc number along with client ip and most of the order/payment info. I wrote another response to a sibling post with it but I must have never submitted it because I don't see it there. FraudLabsPro and Subuno are entry/mid level products. Others like Sift Science, Riskified and Simility only have very high volume options or don't advertise any entry-level pricing.

I once bought a 2k item online from a well known camera store in the US. I called and asked for a competitor price adjustment. I did end up purchasing it over the phone. A day later I noticed that a fraud specialist from that company looked at my LinkedIn profile. So, yeah I guess that they do have to figure it out on almost every transaction/customer

The camera stores have it down pretty well. I remember trying to ship a camera lens to my fathers place (He's retired and can sign for it) as opposed to my usual address. Long story short (and a phone call), I did get it sorted. But part of that was I was a customer for a few years and was able to prove that it was ok. I was glad they were vigilant.

They have databases of "known addresses" so if your order doesn't match, it can be hard.

(They keep the old addresses too, as an attempt to get UPS automated phone center to hold for pickup one time ended up with them shipping the clothes to an 8 year address of mine in a adjacent state. )

I just bought an expensive bed yesterday and got a fraud alert text within 5 seconds of the transaction going out and my card was shut off today temporarily until I confirmed the purchase again. Some banks are fairly on the ball when it comes to detecting irregular purchase patterns.

Services such as Stripe and PayPal indeed serve as central repositories for fraud intelligence. I imagine that other payment gateways also provide a similar function, though those two are the ones I'm personally familiar with. We've operated a small ecommerce business for almost 8 years and although PayPal fees are probably on the high side, fraud has been a non-issue for us.

> PayPal fees are probably on the high side, fraud has been a non-issue for us.

It should he an issue for you. That is because PayPal is stopping a lot of payments with false positives. I live outside US and using PayPal is generally a pain in the ass.

I also live outside US and every legit transfer larger than 100 USD or EUR from my account got blocked. Every time it happened, I had to send photocopied ID, bills, and other requested documents. I got a verified business account with lifted limits and still the same pattern continued. And every time I had to call support, otherwise it took about a month for them to review the documents and unlock the account. At the end I was able to get the money out by small transfers. Now I just require a SWIFT transfer from all my US customers.

Hmmm... that does sound interesting. Might you have any hard data to back this up?

If it's true I'd expect that we'd get alot more complaints from customers that their cards are being rejected.

Would a customer complain to you because of a paypal doesn’t cater to them ?

In particular, credit card setings are multi-step and all done on the paypal site, I wouldn’t imagine going back to some merchant site to complain about that process.

I would imagine that at least some would, given that they're interested enough in the product to initiate the checkout process.

In the absence of any hard data on this, I'm writing it off as nectodal.

> In the absence of any hard data on this, I'm writing it off as nectodal.

The Internet is full of this stories from people with good karma. Just look for it on Internet. Probably you are from one of the few countries where the experience is different.

Internet is full of facts about PayPal issues.

We had massive fraud issues with PayPal. Got blasted with stolen credit cards with completely fake addresses (123 Main street Zip code 12345) from Chinese IPs. It seemed like they weren't even doing address verification...

They should, but as far as I can tell, they don't.

Obvious freight forwarder + foreign IP + local US credit card with the wrong billing address...doesn't raise any suspicions from them.

Companies like Accertify are more typical for stores that want a more standard non-Paypal type interface, the purchases go through them following the transaction

On this note, does anyone know how does Stripe Radar stack against fraud protection.

Yep, Stripe handles that via "Radar": https://stripe.com/us/radar

Whenever I travel, I learned the hard way to put a "travel alert" on the credit cards. Otherwise, they may shut them off if suddenly charges start appearing from a foreign country!

Even that isn't a guarantee- I'm traveling in Japan right now and everyone I'm traveling with except myself have had issues, despite filing travel notices well in advance.

What kind of issues? It could be some sort of communication problems, rather than rejections by your bank. Or, maybe, a local bank rejecting your card for their own reasons (I don't really know how this works).

I was visiting Philippines recently, and wasn't able to withdraw cash - the ATMs (I've tried different banks' ones) were rejecting me with a generic error message. So I've contacted my bank to check what's wrong and if they're blocking me for any reason. Turned out that they haven't seen any transaction attempts at all - like something along the path wasn't working (no clue, really). The suggested method of trying an ATM in a different part of the city worked.

I've also had issues with some payments via PoS terminals. Normally, when payment fails I get a push notification about the failure - but none happened at those times. So, I guess, this could be similar.

Nope, actual rejections that had to be called in and confirmed.

I've never had problems not posting notice on my trips to Canada but I didn't feel brave enough to try transacting in Japan without notifying first... Still, I wonder with the prevalence of chip readers, isn't the "card is present" signal much stronger? So unless they think I've had my card stolen and haven't bothered to report it yet they probably shouldn't stop any card-present transactions.

(Having had an EMV chip card for about 15 years.)

The banks still advise customers to inform them when travelling, but I've not found that to be necessary when in countries with chip and PIN. (If I'm going outside Europe I will inform the bank of my main card, but in South America, Asia, Africa there will be some point where it isn't accepted, and I use a backup card -- that bank doesn't know I'm travelling.)

The USA used to be the problem -- about once a year, someone in the office would get a robot phone call from the bank saying their card had just been blocked due to suspect activity in the USA. That should be becoming a lot less common.

Chip transactions are indeed a huge signal - a chip transaction can’t be faked due to strong cryptography. Granted, the card can still be stolen, but it’s rare enough that most banks let it though.

I feel like if my card gets stolen and I don't notice before it gets to Japan and starts spending money, I have bigger issues.

Magstrip cards can be cloned very easily. You might still have your card, but maybe someone copied the data off it last week. The chip is a different story.

> a chip transaction can’t be faked due to strong cryptography.

There is always a defcon pwn

https://www.youtube.com/watch?v=JABJlvrZWbY

I don't know why but I kind of expected with all the hubbub from Europeans about how chips rule they would have some sort of anti-tampering / tamper-evident features to them... Next thing you're going to tell me you can extract the private key from one without much effort...?

Of course you can but i wasnt writing about that.

The ide behind chip is that transaction result is written back to your card, something mag stripe cannot do. I had a family related fraud where my son used my card in store to buy few video games. Over the phone amex told me to go to the bank which was able to show me this card has been swiped physically in the store because confirmation hashes were written on the chip of my card.

I was explained up to 16777264 transaction hashes can be written on one chip before overwrite process starts.

So at this point you wont get your loeny back if you have your card present but claim someone made copy because they will simply pull data off the card.

Side issue Europe switched to touch credit cards some 3 years ago. Its insane fast yoy dont even touch reader you just wand your card transaction approved. You will need another 5-8 years to wait for that in usa tho.

Yes. There are significant beneficial network effects in payment processing.

Back in the day, eBay had ludicrously good fraud rates (and hundreds of engineers working on models, from what I heard). We hired a few people from them and were quite proud to achieve rates in the same ballpark with orders of magnitude less traffic.

eBay also had and still has a reputation for outright letting fraudsters operate easily as buyers. I would never trust eBay to sell anything there anymore.

Same for sellers. Its really sucky to get a bunch of broken laptop keyboards from a seller, then get replacements that are also liquid damaged or physically damaged.

Buyers automatically win all disputes though. And every though PayPal thankfully split from eBay the buyer wins there too.

Living abroad and using a forwarder ... I buy almost exclusively from Amazon just because I know it'll be easy. Pretty much anywhere else, it seems to be a 50/50 chance that they'll just cancel the order, half the time without so much as a notification.

Equifax. But we know how that worked out.

Could a Blockchain/DHT solution work for this? Normalize and hash the data and send it to the network to check its karma. If there's no karma then it's a new customer, otherwise the karma tells if it's a good/bad customer. Then after they buy you add or reduce a karma point.

Would there be a way for someone to reverse/bruteforce the hashes to figure out people information?

MD5 Hash of concatenated CC# & street address for all orders. Post to a database 90 days after the order shows no signs of fraud.

Use existence in the DB (weighted by number of instances) as a probability of not-fraud.

My guess is Shopify, Stripe, etc are doing something like that when they send "this might be fraud, you should review" alerts.