Hacker News Reader

Comment by ryanlol | Hacker News Reader

Despite what the article seems to claim, it appears to be describing the most basic anti-fraud measures which are easily defeated by basic fraudster tools and techniques.

>User ID

1 account per card per IP, basic stuff.

>IP address

Vip72 is a pretty basic example of a commercial solution, more advanced people either source fresh IPs from bots or scan for SSH tunnels.

>Geo location

While not as trivial to defeat, most "serious" fraudsters either operate their own mule networks or pay for access to one. There's no lack of stupid people.

>A tracking cookie

lol?

>Credit card number

There's no lack of credit cards, even if you're paying $30 for a no-AVS card with full VBV info that still costs less than a TV.

View on HN

This is a blogpost intended to demonstrate the usefulness of applying neo4j to a specific problem. All the challenges you cite are valid, but they do not negate the value of using neo4j in this scenario.

You can solve these problems by adding to the list of identifiers. Off the top of my head: browser fingerprinting, request latency, IP subnets, IP ASNs, hsts super cookies...

Stopping fraud is always going to be a cat and mouse game. The goal is not to eliminate fraud completely, but to make it so difficult for fraudsters to use your service successfully, that they would rather move to the next target. If a fraudster is specifically targeting your service, they will get around any blockades you put in front of them. But you can still make it as hard as possible to circumvent those blockades.

If you deter a high enough percentage of fraudsters, you mitigate your risk of chargebacks. That risk will never be zero. But you should certainly do all you can to minimize it.

My main point was that despite what the article implies, these techniques are far from new.

But the tone of the blog post implies this graph thingie is _the_ solution:

"How graph databases stop fraud e-commerce frauds in real-time" - note the use of 'stop' and 'real-time'.

"Fortunately, graph database technology is able to detect the patterns that arise around these e-commerce fraud scenarios and put an end to them in real time"

Again, look at the terms used: 'put an end' and 'real time'.

I am not trying to nit-pick, but what has been discussed is far from being able to put an end to fraudsters. Maybe this could weed out some of the newbie frausters, but that is it.

Disclaimer: I work in the payments industry.

Don't dismiss the tracking cookie so quickly. Every dirty marketing technique you've ever heard of from Evercookie to using eTags to accomplishing the same thing make it easier to get "device ids" and coalesce that information to fraudulent user ids as well as the accounts, ips and transactions associated with them.

Services like MaxMind go a very long way in identifying proxies or Tor nodes as well.

Nothing is going to be 100% perfect but the more you can do to make it a struggle for the perpetrator the more they have to decide if it's worth the effort.

The flip side of that is that actively engaged attackers become easier to identify in terms of patterns of behavior and leaving trails to alert authorities.

>Don't dismiss the tracking cookie so quickly. Every dirty marketing technique you've ever heard of from Evercookie to using eTags to accomplishing the same thing make it easier to get "device ids" and coalesce that information to fraudulent user ids as well as the accounts, ips and transactions associated with them.

Most of the more "serious" types use setups similar to FraudFox that defeat systems like these (Although this too causes detectable patterns, new customers with 0 tracking cookies putting in orders less than 30 minutes after initially hitting the site are probably fraud). Don't forget that the Pareto principle applies here, to be able to perform large scale fraud you need lots of cards which requires investment which requires that you're successful.

>Services like MaxMind go a very long way in identifying proxies or Tor nodes as well.

Nobody uses Tor, at best that'll prevent some kids using public proxies (which are worth stopping mind you, but that generally only accounts for a small fraction of the fraud). MaxMind is a joke and struggles against stuff like vip72, and has absolutely no chance against anything more sophisticated than that.

To be honest you could probably replace MaxMind with DNSRBLs and do just fine

>The flip side of that is that actively engaged attackers become easier to identify in terms of patterns of behavior and leaving trails to alert authorities.

Authorities do not give a shit, they might go after card shops but they definitely aren't going to do anything about some guy doing orders to Russia.

Proxy detection is actually pretty hard for fraud. Proxies come and go much faster than a detector can pick them up, and a fraudster can just flip through proxies until they find one that works.

(The Tor thing is easy because Tor publishes a list of exit nodes, but some people manage to screw even this up by blocking even the non-exit relays as well!)

I agree. What this graph is missing is "relevancy". It's much easier to detect fraud when not looking at population numbers or a basic graph since these often lead to super nodes and if someone wants to cover their tracks it is easy for them to avoid creating super nodes, as you've described.

However, with relevancy in a graph we can detect this type of fraud significantly better as we can begin to find relationships that stick out and are uncommonly common to each other.

Interesting how many downvotes this is getting while none of the replies seem to disagree with my main point which is that neo4j is incorrectly marketing this like as if it was something new.

Reply on news.ycombinator.com