Before selling stolen credit cards, bad guys have to verify them. This is often done with small (<$10) donations to charities or small purchases of intangible goods that are considered low risk merchants.
With Gittip they found a way to get the low dollar amounts to come back to them, but since this wasn't really the goal to start with, you'll likely see donations to random leaderboard members that are unaffiliated with the fraud itself in the future.
I've supported a number of different online credit card donation forms for various charitable and other causes, and you see this behavior of card testing whenever you set the minimum allowed donation too low, and adopt too few of the necessary precautions.
I wrote a post on the approach to raising the bar I took - it really doesn't require much to get the credit card testers to go away, and if you don't get rid of them rapidly, you'll be dealing with chargebacks from here until eternity:
http://www.exratione.com/2010/10/three-necessary-defenses-fo...
Most small online businesses do not store credit card data locally, but that doesn't stop you from using salted hashes of credit card numbers to compare.
Storing a "salted hash" of a credit card number in the manner you describe is only fractionally better than storing the credit card number itself. This is because credit card numbers have very little entropy - less than 36 bits per issuer code, so bruteforcing these hashes can be done very quickly.
https://github.com/whit537/www.gittip.com/issues/345
Even then, I'm not sure I would trust this approach. I feel much more comfortable white-listing accounts, and for the time being that's not too onerous.
Could you run them off by just always displaying success for any sane-looking small value donation, without leaking the result from your payment processor?
https://github.com/whit537/www.gittip.com/issues/329
The desire to verify stolen cards with the added benefit of recovering that waste seems to explain the motive for using Gittip.
They also verified them on SoundCloud without any purchase. Don't know if it's still possible.
Or just verify that the credit card number is potentially a legitimate one?
Because if it's the latter, that's just the Luhn algorithm (http://en.wikipedia.org/wiki/Luhn_algorithm) and no transactions are required to perform the verification.
If it's the former, until you make a transaction there's no way to verify in advance whether or not a card has a still valid account attached to the backside of it.
I know you're saying "without any purchase", but maybe it was just for a vanishingly small amount.
As it turns out, the CEO of BalancedPayments is (there is just no nice way to put this) an unethical bag of scum. He recently went on some kind of insane power trip, completely disregarding the needs of his customers, putting me on unpaid leave for ... reporting an incident of fraud to a bank. I reported an incident exactly like the one Chad discusses here, but the dollar amount stolen was much higher, and the fraudster a repeat offender.
Anyway, after that last meeting where he was sneering and enjoying way too much the power trip of getting to "fire" somebody, I can confidently exhort that Balanced should not be trusted.
It's important that any company a marketplace entrusts its financial data with is an ethical one. So, yeah, looks like I'm on the job market; ping me : http://lnkd.in/NuBGDY
On the other hand, the world would be a better place if we didn't all have to make nice-nice and pretend, so rock on!
This is very dangerous ground, and could be a case of libel if the "unethical" CEO catches this.
What libel? You mean his opinion of the CEO? Which statement do you find to be factual and a lie?
That said I am not sure how BalancedPayments is built. By that I mean how much risk they are taking in being part of this payment ecosystem. It looks like they hold the money in their own bank account so BalancedPayments themselves uses another processor to do their payment processing. The other alternative is that they are big enough to communicate directly with the backend network like IPPay, First Data Omaha, or FNBO...but they don't seem that large.
Information assymetry is probably your only advantage against credit card fraudsters, because there is no security hole, rather they are exploiting your core business flow.
After all, hidden passwords are security through obscurity, and that's "just the wrong way".
What to do? Some options to reduce your fraud are - outsource the problem by using an indemnified payments system (a payment processor who do their own fraud checks and don't pass on any chargebacks to you). Pros: easy. Cons: expensive and lots of valid payments will be refused.
- Use an e-wallet that usually has few/no chargebacks, eg Skrill & Neteller. Pros. Easy, not too expensive. Cons: more difficult for people to make payments as they need to create an account with the e-wallet first.
- Use services to help with your fraud detection. Eg. Iovation. Pros: you can keep it easy for your customers to make payments. Cons. a lot of work to implement (relatively speaking).
- Use bitcoin, eg bitcoin247.com. Pros. no chargebacks ever. Cons. about 0.00001% of your customers use Bitcoin.
Edit: I forgot to add: - require 3D Secure / Verified by Visa payments. This removes the chargeback liability from the merchant in most cases and shifts it to the card owners bank. Pros. much fewer chargebacks. Customers can still deposit directly on your site using their card (apart from the 3D redirect). Cons: entering 3DS details another barrier to making payments so will reduce payments. Plus I'm not sure of the penetration of 3DS cards in the US.
Depending on where you're based you'll have legal obligations that'll define what you should be doing at this point. This may well involve lawyers, your regulators and the police.
Some countries make it a criminal offence if you let a criminal know that you suspect them of money laundering or similar offences (this is known as "tipping off") so you should be very very careful about what you're disclosing both to your users and the general public.
This is one of the reasons that PayPal will lock accounts without giving a reason why--it's potentially criminal for them to tell you why!
It does make me wonder, did the bad agent happen across Gittip independently or are they active within Tech communities?
Essentially, this is standard practice.
Their first round of chargebacks are going to be insane, and if they're this far behind they're going to be eaten alive by fraud.
Just kidding, but it is funny how outsiders might not understand why you are surprised to find criminals in the "hacking" world.
Even so, a significant proportion of the people who go to something like DefCon have done some low-level fraud with credit cards, and some have done much more than that.
First off, strictly speaking, this is most likely to be a stolen credit card (i.e., fraud) rather than money laundering. You do NOT benefit from fraud, because when the cardholder notices the charges, they'll call up their bank and issue a chargeback. The $488.15 in your account will actually be removed and given back to the original cardholders. In addition, each fraudulent charge carries a $15-$25 fee, which you're liable for. https://www.balancedpayments.com/docs/testing#chargebacks---...
What's worse, chargebacks can take 60-120 days to reach you, since there's delay at every step: the customer's bank, the credit card networks, your payment gateway, and the acquiring bank (your bank). Unfortunately, that means you won't know how much fraud you have today until February (!). It's a broken system, but that's how all the major card networks work, so it's something that everybody who sells online has to deal with.
If your fraud rate is higher than about 2% for two months in a six month period, Visa and Mastercard reserve the right to block payments entirely to your (or Balanced's) account unless you prove you can get the chargeback rate down. This is called an "excessive chargeback program."
In terms of heuristics, fraudsters adapt rapidly to whatever counter-measures you use. The half-life of a good heuristic is maybe a couple of months. The best approach is to evaluate hundreds of different signals, using a machine learning algorithm to constantly adapt to changing fraud patterns. My company is running a private beta of exactly this technology and we're happy to help: http://siftscience.com. Even if you don't use us, I can recommend other services or give you general pointers.
Hope that helps! Let me know if you have any questions: brandon@siftscience.com.
http://blog.gittip.com/post/28351995405/open-partnerships
I'd welcome a conversation with Sift Science along the same lines.
"use a fraud detection service"
Companies that have high transaction amounts often use the machine learning system to detect likely fraudsters, but then have a human review each one and make the final decision to approve/deny. We have a visualization "widget" that shows the reviewers which signals made a particular user look suspicious. The advantage of using machine learning is then that you: a) catch fraudsters you wouldn't have noticed otherwise, b) don't have to review every single transaction, just the subset that are most suspicious, c) make it faster for your staff to review transactions since the visualization tools will help point them at what to look at.
Does that make sense?
Any good payment gateway should be managing the risk of stolen credit cards, but it's likely that because Gittip works with small recurrent payments instead of big upfront payments, it doesn't trigger any red alerts.
To take this to the next step, this is also why I believe Paypal is one of the very few companies that has been able to scale online payments. I'd love to see anyone challenge their ability to balance customer service with fraud prevention at scale.
Gittip should work with a party that is already in the possession of the required knowledge or they'll be shutting down. This post raised their visibility as rookies considerably and you can expect the sharks to move in now that there is blood in the water.
In the end, I think we (Balanced) should have done a better job here, and we'll work hard to do so in the future.
> The uncomfortable truth is that Gittip, Balanced, and our legitimate users are financially incentivized to turn a blind eye to laundering, because we have benefitted and are benefitting from it.
That's only true until you start getting chargebacks.
Phew. I'm saved from the moral burden by the financial burden. :^)
There are compliance ramifications of permitting money laundering, but collusion isn't always money laundering. Here's a few different scenarios:
1. Legitimate money laundering where someone is trying to obfuscate the origin of the money for some illicit reason. The ramifications of permitting or not having strong enough systems to prevent money laundering results in being shutdown. That's a bigger incentive than financial loss
2. Fraud where someone is trying to get cash off of someone else's card. This is the number one form of fraud on a marketplace and, by far, the hardest to catch. This is where the incentive is financial due to chargebacks
3. Cash advance where a marketplace has set their fees low (sometimes even lower than the fees Balanced charges) and someone is incentivized to get money off their card or simply get miles/points. Venmo and a lot of similar services experienced would get targeted by this form of collusion when they didn't charge any fees. This should be prevented due to card network (Amex, Visa, MC, Discover) policies, but they generally won't result in a chargeback
Credit card companies will, some time later, probably notice the fraud. At that point, you'll get a chargeback: you'll have to pay back the money you charged in addition to a fixed penalty per fraudulent charge (usually $15.) Especially if you're enabling a marketplace, like gittip does, these fees can be devastating. Regardless, if chargebacks become too common, your merchant account may be suspended.
I've written some about my company's experiences with fraud, if it's of interest:
http://davepeck.org/2011/11/17/fraudsters-gonna-fraud/
http://davepeck.org/2011/12/01/dealing-with-credit-card-frau...
use a fraud detection service: https://github.com/whit537/www.gittip.com/issues/357
detect and prevent botnets: https://github.com/whit537/www.gittip.com/issues/358
detect and prevent scripting: https://github.com/whit537/www.gittip.com/issues/359
So that's that for that heuristic. They will adapt now.
https://github.com/whit537/www.gittip.com/issues/search?q=bi...
For what it's worth, a little bit of fraud is a good thing. It means people are using your system and it's growing. Too much fraud and people will lose confidence and your payment processors will punish you. Too little fraud and your system is probably too complicated to be useful to anyone, including fraudsters.
You didn't get money laundering, but if your volumes would be larger, you would get also money launderers.
None have been as open and ethical about this as you, though, so it's very comforting to know that gittip won't be a free-for-all bonanza for asshats.
Haha! That's why i'm never gonna use Tumblr! :P
