Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I read an article signifyd-raises-2m-from-andreessen-horowitz-to-help-online-businesses-use-data-to-prevent-payments-fraud which talks about a service that pulls together data to screen the (e-commerce) transaction. The product uses algorithms on back end to see if every transaction is legitimate and had different systems in place for various types and sizes of retailers.

I don't know what a bad transaction is and how someone can do it to cheat an e-commerce business ? The only bad transaction I can think of is "using a stolen credit card``. What are the other ways criminals commit e-frauds ?

What are the flaws in the existing payment validation systems ? and why do we need something like signifyd to prevent such transactions ?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

So Signifyd seems to be a set of statistical methods to find unusual activity - "We combine your ... data with our datasources and turn it into a easy-to-interpret score and behaviorial signature." Their website doesn't restrict application to eCommerce. Indeed, the idea is very general and could just as easily be applied to electricity/water theft, tax evasion, and other areas.

By formalizing the analysis, it's much more reliable. Instead of "Hey, that dude has a lot of returns", you should get something much more useful: "User 12341 has a problem score of 92%. He reported failed delivery for 19 out of the last 25 orders. There is a 0.001 probability of that happening by chance, therefore we should investigate in more detail".

Finally, there are other types of "bad" transactions that don't require stolen Credit Cards, but can be detected with good data analysis:

  1. Buy something and re-sell it. Put a bag of sand of identical weight into the original packaging, re-seal it with a shrink-wrap machine, and return it to the retailer (this also works at physical stores). The retailer cannot defeat this without inspecting every single returned item.

  2. Buy something and re-sell it. Claim it wasn't delivered and request a refund, or a replacement product. As many online stores try and keep customers happy, often a replacement will be sent, or a refund offered even if there is proof of delivery.

  3. Find a broken product (e.g. Dumpster diving or eBay). Find a store that sells said product and buy it. Sell the working product that you just bought, "return" the broken product to the seller and request a refund.

So the reason we need fraud-detection methods is because fraud will occur even if the payment system is perfect (and it isn't).

share|improve this answer
    
Thanks. I get the picture. Haha...I never really had it in me to think of such schemes. Interesting. –  FirstName LastName Jan 15 '13 at 4:41

Almost all of them do rely on having a stolen credit card. The trick is in trying to catch that, particularly if the card hasn't been reported as missing yet. This is especially difficult if the attacker has the physical card, or the security code, and knows the address of the victim.

There are several "red flags" that can indicate potential fraud of this nature:

  • Unusual amount of transactions
  • A small "test " transaction followed by several unusual large transactions
  • Shipping address other than what the issuing bank has online (particularly to PO boxes)
  • mismatch of some data
  • and many more I hope never to have to learn about.

Software like this is designed to help to catch transactions for people who have access to a lot of the potential victim's data. Given how freely available PID is these days, tools like this are, unfortunately, necessary.

There are other solutions out there, including one from TransUnion, Idology, and many others.

There is more information in a video on the Signifyd website.

share|improve this answer
    
Sorry, i forgot to mention that i had seen their website too. But the information there is sketchy and does not lead me to an answer. –  FirstName LastName Jan 14 '13 at 21:45
    
Why do you say this - "and many more I hope never to have to learn about." ? –  FirstName LastName Jan 14 '13 at 21:47
    
PID = Personal Identification ? –  FirstName LastName Jan 14 '13 at 21:47
    
@FirstNameLastName - Only because I seldom deal with shopping carts any more, and there are some things I'm happy to leave to those with a wealth of experience. I'm not a security guru. I care about security mostly from a developer's perspective. I am obsessed with ensuring I'm not the cause of any holes as far as I can help, but I won't ever know everything. My normal day-to-day routine and our apps don't need to deal with this type of thing now, and if I ever did learn about it, it would likely be because I'm responding to an incident, rather than just learning to expand my knowledge. –  David Stratton Jan 14 '13 at 22:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.