Bad transactions in an e-commerce system?

Question

I read an article signifyd-raises-2m-from-andreessen-horowitz-to-help-online-businesses-use-data-to-prevent-payments-fraud which talks about a service that pulls together data to screen the (e-commerce) transaction. The product uses algorithms on back end to see if every transaction is legitimate and had different systems in place for various types and sizes of retailers.

I don't know what a bad transaction is and how someone can do it to cheat an e-commerce business ? The only bad transaction I can think of is "using a stolen credit card``. What are the other ways criminals commit e-frauds ?

What are the flaws in the existing payment validation systems ? and why do we need something like signifyd to prevent such transactions ?

Answer 1

So Signifyd seems to be a set of statistical methods to find unusual activity - "We combine your ... data with our datasources and turn it into a easy-to-interpret score and behaviorial signature." Their website doesn't restrict application to eCommerce. Indeed, the idea is very general and could just as easily be applied to electricity/water theft, tax evasion, and other areas.

By formalizing the analysis, it's much more reliable. Instead of "Hey, that dude has a lot of returns", you should get something much more useful: "User 12341 has a problem score of 92%. He reported failed delivery for 19 out of the last 25 orders. There is a 0.001 probability of that happening by chance, therefore we should investigate in more detail".

Finally, there are other types of "bad" transactions that don't require stolen Credit Cards, but can be detected with good data analysis:

1. Buy something and re-sell it. Put a bag of sand of identical weight into the original packaging, re-seal it with a shrink-wrap machine, and return it to the retailer (this also works at physical stores). The retailer cannot defeat this without inspecting every single returned item.

2. Buy something and re-sell it. Claim it wasn't delivered and request a refund, or a replacement product. As many online stores try and keep customers happy, often a replacement will be sent, or a refund offered even if there is proof of delivery.

3. Find a broken product (e.g. Dumpster diving or eBay). Find a store that sells said product and buy it. Sell the working product that you just bought, "return" the broken product to the seller and request a refund.

So the reason we need fraud-detection methods is because fraud will occur even if the payment system is perfect (and it isn't).

Answer 2

Almost all of them do rely on having a stolen credit card. The trick is in trying to catch that, particularly if the card hasn't been reported as missing yet. This is especially difficult if the attacker has the physical card, or the security code, and knows the address of the victim.

There are several "red flags" that can indicate potential fraud of this nature:

• Unusual amount of transactions
• A small "test " transaction followed by several unusual large transactions
• Shipping address other than what the issuing bank has online (particularly to PO boxes)
• mismatch of some data
• and many more I hope never to have to learn about.

Software like this is designed to help to catch transactions for people who have access to a lot of the potential victim's data. Given how freely available PID is these days, tools like this are, unfortunately, necessary.

There are other solutions out there, including one from TransUnion, Idology, and many others.

There is more information in a video on the Signifyd website.