Re:Ask HN: dealing with credit card fraud while selling phys...
by cstross on Sunday September 26, 2010 @04:13PM
(#1729902)
I'm somewhat out-of-date, but Russia, Romania, and Bulgaria used to be problematic (and might still be, for all I know).
There was a scam whereby some of the more enterprising crooks would buy goods using stolen CC credentials and have them shipped to a Bulgarian address ... but put "Germany" at the bottom instead of "Bulgaria"; the Bundespost being highly efficient would then spot the mistake and forward the package! So you might want to do city/country consistency checks.
Again, look out for PO boxes.
This is going back years, and probably doesn't affect you if you're only using Paypal verified addresses, but when handling credit cards one useful thing to do was velocity checking: if two consecutive purchases come in, check the physical addresses associated with each transaction and block the transactions if the card would have had to go supersonic to get between them. You might be able to do something similar if you can dereference IP blocks geographically (e.g. purchase #1 on card foo comes in from a net in France and purchase #2 on card foo comes in from a network in Paraguay five minutes later). You can do this lazily (i.e. only trigger the check when you've got the second request).
There was a scam whereby some of the more enterprising crooks would buy goods using stolen CC credentials and have them shipped to a Bulgarian address ... but put "Germany" at the bottom instead of "Bulgaria"; the Bundespost being highly efficient would then spot the mistake and forward the package! So you might want to do city/country consistency checks.
Again, look out for PO boxes.
This is going back years, and probably doesn't affect you if you're only using Paypal verified addresses, but when handling credit cards one useful thing to do was velocity checking: if two consecutive purchases come in, check the physical addresses associated with each transaction and block the transactions if the card would have had to go supersonic to get between them. You might be able to do something similar if you can dereference IP blocks geographically (e.g. purchase #1 on card foo comes in from a net in France and purchase #2 on card foo comes in from a network in Paraguay five minutes later). You can do this lazily (i.e. only trigger the check when you've got the second request).