Tell HN: Automatic fraud detection is making my life hell

In this case it might actually make it worse. Why are you suddenly, while in the US (for example), ordering physical services in India?

My bank locked my credit card once due to suspected fraud. I asked what triggered it and they said "You never buy gas on this card". This was 15 years ago and I'm sure the algorithms have only gotten better.

A different bank used to ask you to tell them if you were planning on traveling so that your card would continue to work, they stopped doing it and said that they had improved their fraud detection and this was no longer necessary. My guess is that they take the data provided by airlines[0] when you book a flight and use that to tell where and when you're traveling.

[0] https://www.marqeta.com/blog/data-details-what-is-level-1-2-...

How do you expose the Raspberry Pi so that you can reach it from the outside internet?

My OpenVPN runs on a Digital Ocean droplet and I use it to tunnel into my home network, but having a direct route might be better.

Great idea, spend your money to earn the privilege of spending your money later.

I do the same, and again when I land. Try to double down on signaling to the black box.

One day my card got cloned and I see some withdrawals from a foreign country. I promptly report it, transactions reversed and the bank issued a new card. After this, I was getting fraud alerts and either informative or confirmation SMS when that was triggered in the past. It seemed to follow whenever a transaction passed $100, then $500, then $1000 and a certain frequency or off-hours.

It's like the risk threshold got a reset with the new issued plastic. Eventually the algorithm was trained I suppose, back it was back to where it was, and stopped getting alerts for anything out of the usual. This resonates with the experience of friends in the same bank, who hardly ever use their credit cards, so whatever they buy gets flagged and someone calls to make sure it's them.

Old fashioned banks who are behind the times in technology, but keep richer clients, are usually less annoying, both with the fraud algos thing and also the KYC stuff, and sometimes the difference is massive.

“It approves of rereading.”

Buying gift cards with stolen credit cards is like fraud/money laundering 101. The amount is not really a differentiator either because a lot of carders will run smaller test transactions to see if the card is still active.

How do we solve that?

> I work in fraud detection in the US and the number of people that end up making their legit purchases look like fraud is way too high.

I don't think you meant it. But that is blaming the victim

A bit uncool

One of the main features of capitalism is you can dispose of your property as you like.

ah, and that is our problem now? If I like to use my browser with uBlock, buying a gift card on a sunday 4am right, sharing data from my phone, different city and with my new laptop, it is still your problem for not letting it go through.

It is obvious but not easy to measure. And companies act like what is not easy to measure doesn't exist.

That does help a bit with the banks, but I've not had any luck at all with the stores who cancel my orders after the payment goes through. They refuse to budge, assuming I even get a response, and won't give me any information about why my orders are cancelled, citing more vague security reasons.

I did have success with a privacy.com card once, at a store that cancelled orders from all of my other cards. I'm guessing they see it as a prepaid card and can't get as much info on those.

> I found that notifying my providers of upcoming moves eliminates this.

you seem to be older. I used this too. Until 5 or so years ago. Now my bank just says i "don't have to notify them anymore as they don't have this in the system, since it is all automated for my convenience"

Note that this is about large tech service providers “taking this into their own hands.” The basic problem is that a lot of these companies deal with people who store their card information and then use an insecure password or so, or reuse the password at a different website... Someone else gets into the account and requests a transaction to a new address.

Also fun story about how your advice doesn't always work, I was locked out from my money multiple times on my honeymoon in Greece despite repeated calls to the bank, repeated unlockings of said account, “hi I am actually standing at an ATM in this bank branch, can we track this account lockup in real time?”... I think with all of the time on hold I actually might have spent something like 20+ hours in the trip trying to debug it over the several times it happened.

When we finally resolved it, I'm not 100% sure about the explanation, but it was something like “the person you called a week ago put in country code GE for Georgia rather than GR for Greece, and that is the first place everybody else who has serviced your request has probably looked, but they all probably thought GE was right because you have to memorize that DE is Germany and so people get confused real easily...”

When I worked at a bank, I heard that the travel notifications weren't actually used by the fraud department at all and were just there as window dressing to make the customer feel better.

Having to contact the provider to spend one's own money is simply outrageous.

And yet, I also have started to make preemptive contact with them to avoid the complete hassle of having the card blocked for fraud that is NOT fraud.

A tailscale node on your AppleTV at home will fix the issue for you.

Shopify does use the IP location distance Vs shipping address as a risk factor for fraud. I see it often on my Shopify stores where they will flag an order as high risk for that reason.

Same thing if someone used a VPN.

I don't know how the numbers break down, but plenty of people that buy credit card numbers are happy to orchestrate a scheme to ship packages to the US and have someone forward them to the scammer. Or steal them off your porch.

It is probably exceptionally rare for a fraud protection algorithm to be in place to inconvenience and spite you. Rather, some ne'er-do-well has cooked up a bafflingly complicated scheme that looks like your legitimate business. Such is the tragedy of operating at scale.

>It's not like the auth systems are designed for higher scrutiny in specific countries

Of course it matters and of course they are.

Everything you describe and OP describes are frictions that apply by virtue of you not being in the US, on purpose.

I worked in the payment card industry for awhile a few years back. There are entire countries that are blocked by card providers due to fraud.

Unfair or not, it actually makes a difference. I was in a neat position to see some of the attempts in real time. It blew me away how much attempted fraud there is. Think of it like spam email - it's that bad.

> sending an OTP to my US number (and US number alone) for any transaction, making it impossible for me to move money when abroad

Strictly speaking it doesn't make it impossible. You have made a choice not to pay roaming fees while using your USA number while abroad.

Just FYI (because your OTP hell was my OTP hell until recently) if you fly to another country, disable roaming in the phone, and don’t make outbound calls, your phone will receive these OTP messages for free with most US cell providers.

Just because there are efforts to combat the problem to some degree does not mean the problem is solved or that there isn't a major problem to begin with.

> Scammers, as a category, target everyone. You think Indians don't get conned into sharing their OTP/passwords or financial details?

Right, but it's a lens thing. US merchants don't care that they're also targeting non-Americans. They care about "target US people" as a subset of that.

Absolutely. Walmart used to have a policy of refunding gift cards in cash. You'd buy many at one location, and return them at another. Less trackable. Gift cards are also used quite regularly in human/sex trafficking to control the victims.

A few years ago, gift cards are THE currency in scamming world for shifting funds between victim and money launderer. They would ask victim to go to 8 different department stores to buy as many gift cards as the store allows then tell them the card number. It's pretty normal the victim hands them over 20 $200 gift cards. And the scammers will keep phishing the victim over and over again until there is no more money to squeeze.

Nowadays many scammers switch to digital concurrency like Bitcoin, which is even less traceable and hard to shut down, but that's only because banks and stores have put in the counter-measurements you encounter to combat them.

There are many scamming related materials available online. Many scam-baiters put their video on Youtube, such as Jim Browning [1] and Kitboga [2].

[1] https://www.youtube.com/@JimBrowning

[2] https://www.youtube.com/@KitbogaShow

At least 15 years, but the past 7 years or so I only used it when I would receive a gift card for Amazon or had no other option for a specific brand's product. I think the last time I used it was 2 or 3 years ago. I'm sure that was a factor, but not being able to recover the account with the email address it's tied to doesn't make sense to me.

I initially wrote a much longer comment, detailing multiple instances like these from just the past few months. But then I just deleted it because it will be too long. As for them - They will just tell "huh, he is hacker and can send fake emails from fake non-existing platforms".

It's like me attempting to demonstrate my possession of a private key for an SSL certificate to someone who lacks even a basic understanding of what a "browser" is, or who has never encountered terms like HTTP or HTTPS.

Another thought, more closely aligned with the original poster's point: if someone pushes to transition everything to a digital format, he must first understand what that means. For instance, if you're looking to gather email addresses, take the time to familiarize yourself with relevant RFCs. Understand that the local part of the email is determined by the user, not you. So, if I decide my email address should be "john with space here-doe!@#$%^&"@example.international, and I've set up my server to accept messages directed to this address, and given that IANA recognizes ".international" as a valid TLD, then it's a legitimate email. For clarity's sake, my actual email is of the format first.last@example.international, without any "non-standard" characters.

And as a connection to the OP - they are pushing for debit/credit cards society and when they make sure that all your money are with them and you don't have a single cent on you - they just cut you because you're just 0.001% and an edge case. But that is their point of view. From your point of view its like this: At home if my card stops working i can go to my bank the very next day and get it sorted. I can walk for 15 minutes and be at my mom's place where I can eat everything for free. The next day you are in another country where you don't know anybody and if your card stops there, they just leave you to the wolves. For them you're the edge case - 0.001%. For you - this is all your food, shelter, health. It feels a bit unfair.

And just in case - I am not that weirdo that just refuses google. No - I have google account, youtube premium, etc. But my google account is with my own email and not with gmail.com. I have microsoft, twitter/X, facebook, amazon, everything that you probably have. All sites. And I was there 10 years ago when .international was introduced. I remember few sites that don't accept it in the first year or two. Then everything went smooth. And 10years later someone is creating brand new site and limit the tld in the email to 3 characters :) The last company that I remember that was having problems was Activision/Blizzard. And when I wrote to them and pointed out that they are not potato but tech company and should watch for such things it took them about 1 month to fix all their sites/account management/billing.

I'm inclined to think that this is caused by prejudice against nonstandard TLDs which many, many services have; that it would work if the OP had their custom .com or .org domain.

No, I think the situation is more nuanced than this. Why do the people at the school have providers who only accept gmail? Because some extremely technical people who understand exactly what they’re doing have led the web further and further into platform lock-in, and others go along with it.

Frankly, examples like GP's are a compelling argument for professional licensure for software developers, because "only accepting gmail addresses as valid emails" should be considered professional malpractice.

In this case it's relatively benign; the worst result is that they'll have to create a (free) gmail account to forward to their domain. It's annoying and stupid, bit in the grand scheme of things, acceptable.

But in other cases the results are much more severe.

I got vaccinated for Covid. But I couldn't get a "Covid passport" because I didn't have the right government account and couldn't get one as I didn't have eligible housing. I literally had the "proof of vaccinations", but turns out that doesn't count as "proof". Great. You know what sucks more than a Covid lockdown? One where you see everyone else go out and have fun and you're allowed to do fuck all.

> Stopping crime by stopping money laundering will always have these problems, surely?

Yes.

Money laundering detection inescapably relies on private actors making a pre-prosecution estimate of whether money was earned illegitimately.

Private actors have much less information available to them than real law public sector enforcement.

And even with full information, trials cannot be predicted deterministically so there will always a gap those publicly deemed guilty and those privately deemed guilty.

Those in later category will suffer unjust financial hardship.

> Is there a way to inhibit CC fraud, and money laundering without making life difficult for people who are in the tails of the distributions?

Yes. Have better customer support and actually fix issues when they happen.

This ends up costing someone money.

> Stopping crime by stopping money laundering will always have these problems, surely?

I believe so. The optimal amount of fraud is non-zero.

https://news.ycombinator.com/item?id=32701913

Ah sorry, it was hard to understand what types of transactions you were talking about. Yes, the reality is that when you try to live in a foreign country and do non-touristy "resident" things like buy things online or pay bills, but when you don't actually have a work visa that allows you to open a local bank account -- the systems aren't built for that. And local merchants really do put themselves at the risk of scams -- even with debit cards, transactions can be reversed by banks (stolen debit cards are a thing), and then the merchant is out of merchandise and money. It sucks, and you just wind up having to rely on a friend or family member to do your online purchases. It's such a small group of people, that companies don't do much to support those edge cases.

I still don't understand why you couldn't wire money though. That's what wiring money internationally is for. If timing with the hospital is an issue, you just wire yourself or your family member in advance -- that's usually more common than attempting to a the hospital directly. (And even if you do have to wire the hospital directly, you can provide proof of the fact that the wire was initiated from your bank.) The only problem I can think of with wiring money is the fact that the money is illegal or someone is trying to evade taxes or something. If the money is perfectly legal, then what is the problem?

> Most places in the US has Apple Pay broken sticker on them

Citation needed. At least in my experience, over the last 12 months, the last time I saw "Apple Pay broken" was at one location, affected all tap-to-pay, and lasted for maybe 2 days.

Cards aren't generally meant for sending cash -- I honestly don't even know what you mean by sending a remittance using a credit card, or even a debit card. If you're talking about using e.g. Venmo or Zelle, they're generally intended for social transactions of tens/hundreds of dollars, not for thousands, and especially not for thousands cross-border.

For transferring thousands of dollars, that's what wire transfers are for, and basically every bank has supported them for decades. You shouldn't need any luck at all.