On a different note, I'm happy to disclose the one heuristic BCC has since I'm the only one who can get negatively affected by it. I have several thousand names of people who have previously bought BCC, and they are a pretty diverse sampling of a slice of the American experience. If you hit the trifecta of a) a first name I've never seen before, b) you use a free email provider and c) you've never actually made a bingo card yet, your purchase causes my phone to light up so that I can refund it prior to the actual cardholder hitting me with a chargeback. I also add it to a spreadsheet that I periodically bug Paypal's fraud team with.

This heuristic has literally perfect detection and recall [+] against a particular carder ring, which was using BCC to test cards (via our Paypal account, sadly, so I have limited pre-charge options to fix it) this summer.

Paypal, to their credit, has apparently shut down this carder ring, since I can't remember that heuristic firing in 2014. (Edit: Poor phrasing. The heuristic not firing doesn't mean I'm safe. Having a historical level of chargebacks, which is less than one a quarter, rather than having the carder ring induced "20+ in a week." suggests that I'm safe.)

[+] Edit: It's 2 AM and I can't remember if this is the right circumstance for that jargon. What I'm trying to say is, of the universe of charges that I can classify as good or bad at N months after the charge, 100% of the ones this heuristic flags are in fact caused by a carder ring and 100% of the ones this heuristic fails to flag are, to the limit of my current understanding, not caused by that carder ring.

Very interesting heuristic! I can see why data mining could be so useful for e.g. Paypal: analyzing data on known-fraudulent and known-valid transactions, looking for unexpected correlations...

Although in this particular case I wonder if the most benefit comes from simply flagging people who buy the product without trying it... and that is a heuristic that almost any SAAS could trivially implement.

Thank you for sharing Patrick. Informative as usual!

> a first name I've never seen before

You mean you just see if the first name is not already represented in BCC's user database? Under what conditions are your users required to give you their first name? For the trial or just for the purchase?

Paypal passes a first and last name with purchases, and some customers provide theirs in Settings (it's not a requirement), so I have about 5,000 or so lying around.

Why would he be refunding someone for a free trial? ...

You're missing the point. He refunds a purchase if he's not seen the name before plus the other two conditions. My question is: what exactly does he mean by "I haven't seen the name before"?