Hacker News Reader

Comment by tptacek | Hacker News Reader

Not super surprising? Like this is pretty obviously the kind of thing that sets off fraud detection, and probably 99 times out of 100 that fraud signal is real, which means it's not routed into customer service, but rather anti-fraud, which is not very friendly.

There are few things fraud-ier than gift cards. It sucks! There's nothing morally wrong with using them! But anything outside the absolute most normal usage of a gift card is likely to stick you in a user cluster that is overwhelmingly fraudulent.

View on HN

> But anything outside the absolute most normal usage of a gift card is likely to stick you in a user cluster that is overwhelmingly fraudulent.

And this is the problem of the user rather than the business? I find any attempt to justify behavior like this disgusting. Just say it the way it is - Apple maximizes its profits by imposing costs like this on others. From that perspective, you cannot justify restrictions on a restaurant running sewage into the street, since the profit of the business trumps all else.

I'm not sure that there's much point in trying to assign blame here. Sure, blame Apple! In any given fraud misfire scenario, there is going to be a pretty clear set of steps Apple could have taken to provide a more reasonable customer experience. But we're focusing on just one such scenario, and Apple's customer support team has to deal with every scenario.

If you've worked in anti-fraud stuff before, you know: there isn't a single clear answer to fraud. There's no reliable way to stop it. It's all just a big series of heuristics. And it's a cat-and-mouse game, because if you're Apple, your fraudster adversaries sink enormous amounts of time into working out the minutia of your customer support and anti-fraud processes looking for gaps.

Which means there's probably no way in hell you're going to be able to talk your way out of a fraud hit with a customer support agent. They're simply not qualified to do that.

I wouldn't say this is obvious at all. If Apple thinks gift cards are fraudulent, it shouldn't sell them or accept them as a payment method.

I have to agree with this. Either they are too risky to accept, or they're too lucrative to ignore. You can't play both sides here, because it's not going to be the 1T company that gets hurt in the end -- it'll be the small guy with no resources.

Edit: Meã culpa! I didn’t read the article properly, what you are talking about and what I was talking about were two different things and I wrote a snide comment about it. Sorry.

This is not a case of a heuristic. This is a case of provably purchased gift cards, and multiple people at Apple refusing to accept those cards as payment, and in fact retaliating by confiscating the cards, along with all software previously purchased by the user.

This is not accepting gift cards.

They're not "provably purchased". All we know is that the person has "receipts" of some sort. Fraudsters generate receipts too.

It's obvious if you do any work in online fraud, is maybe what I should have said instead. I'm not making a normative argument, just a positive one.

There is a huge difference between declining a transaction, and taking someone's money but giving them nothing in return.

I guess you have experience of the former. Apple is engaged in the latter.

Again, this is every fraud flag story ever. For what it's worth, one reason I'm not huffy about this is that I'm pretty sure they're going to get their funds back or their cards activated or whatever thing needs to happen. It's just going to be an annoying process.

They’ve spent many hours on this already and been denied. I don’t know why you think they’ll get their account unblocked, but I disagree.

I expect the best that can happen is a small claims court victory thereby getting their money back, but not their software. And that might also be followed by a lifetime ban by Apple.

Yeah, I also think if I try to go to court, all my devices will turn into a pumpkin.

And if there's any chance of someone stealing your bank account, you shouldn't have one.

And you should only use your credit card at places where there's zero chance of it getting stolen (no US restaurants!), or getting skimmed, or hacked once it's in their system.

...Or perhaps we live in a world where things are not entirely black and white, and nuance exists?

Working at a major big box retailer, my location simply stopped selling Apple gift cards because the rate of fraud was so high. New cards would get shipped in via the supply chain and we would just throw them directly into the trash (they're all activated at point of sale, so until then they're merely cardboard as far as the store is concerned, no value lost). Either scammers would attempt to return them empty and pitch a fit until they found a compliant manager willing to pay to make them leave, or innocent customers would buy a card only to find that someone had pilfered the number and drained the balance as soon as it went through point of sale.

The flip side of this: the #1 most common "phishing"-type attack we see right now are attempts to get us to buy and relay gift cards; we get big waves of these attempts across our team.

e.g. "Hi Thomas, I'm in a conference right now and can't talk on the phone, but I need you to buy some gift cards for an upcoming promotion. It's very important. -- CEO"

There are a lot of people who have to use gift cards because they don't have a credit card, or because their foreign credit card isn't accepted, and they can't get a local card because local banks only offer cards to permanent residents, or because they are minors and their parents don't want to give them a credit card, etc.

If your algorithm throws all these people in with fraudsters, then it's a bad algorithm.

(This problem would be fixed if Apple offered other payment options aside from credit cards)

By this logic every anti-fraud system is a bad system, because they all do indeed penalize people without access to the financial system. It's a reasonable thing to lament, but probably not a reasonable thing to expect a change in, because fraudsters outnumber legitimate unbanked users, at least if you count by transactions.

Getting your account temporarily disabled is not surprising. The response from Apple when the user has the receipts being "Too bad" is what's surprising.

A thermal receipt printer is probably not outside the budget of the big gift card fraud rings.

They cost like $300 new. So, yeah, the receipts might help once you get escalated to the right person, but they're not going to instantly resolve the situation with customer support.

The reasonable thing to do would be to put a hold on the funds from the gift cards but leave his account alone.

The reasonable thing to do in an actual fraud attempt is to lock absolutely everything down, and then look for signals that link the fraudulent account to other accounts, then lock those accounts down, then find any distinctive gift card sources for those accounts and use them to find other accounts, then lock them down, and then repeat.

"Cashed in a bunch of different gift cards in varying denominations to buy an M1 Macbook" is a transaction that is probably 50:1 fraud:real, which is the sucky part of this situation.

If someone had posted on HN and asked "would it be a good idea to cash in a bunch of gift cards to buy a Macbook on the Apple store", you'd have a thread where almost every comment started with "NO!!!", caps and exclamations included.

Whatever the response is, there should be a way for every single person who got their account suspended without committing actual fraud to get their account back.

There is, it's just not pleasant.

Reply on news.ycombinator.com