Tell HN: Automatic fraud detection is making my life hell

402 points by aiProgMach 2 years ago | 388 comments

I've been in India for a while now, to support family member as she's here for medical reasons. I rely on online services to save on cash especially that it's hard to carry cash from my country (for "security" reasons, as most airports limit how much cash you can carry).

Yet, many online services are giving me hell with their "smart" anti fraud detection and things like that, at this point I can really understand the position of the people who are dooming about cashless society, because at some point here I felt trapped not being able to get services I needed so much (until I asked shop owner to pay for me and I paid him in cash + small profit...).

The thing is, the attitude of these companies is so frustrating; like if my card was already accepted once and I successfully approved the payment via 3D secure with my bank, who are you (as a random online service) to assume you can act as my big brother? Even more, if I'm using a balance paid by gift card, who give Amazon or other services the right to put my account on hold while it still contains my hard earned money (I had to try literally multiple services just to buy expensive gift card as Amazon payment won't allow me to choose the correct currency of my Card). Mind you, I'm just a random guy and not world class criminal, or an Activist who's being actively targeted, this make me wonder what these services can do once we go completely cashless.

Simple tasks like downloading region-specific Indian apps become unnecessarily complex, as Google play have this "smart" rule that says I can only change my region once per year, what?? It's just an app just give me the apk, and you can just ask for my location! (I had to install the apks from some random websites at risk of getting some malware...).

I would said what this experience taught me as a developer, but it won't matter, as most products are designed to help the stake holders and upper managers and even Governments, and a dev's empathy won't matter much...

Apologies for this vent, but I really felt I need to post something about this frustrating situation I'm in.

dreamcompiler 2 years ago |

Wrong assumptions programmers make about fraud prevention:

-- A mobile phone number uniquely identifies a single person.

-- Every person has a mobile phone number and they only have one mobile phone number.

-- If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud.

-- Every person always has their mobile phone handy and it is always able to receive calls and SMS messages under all circumstances.

-- Mobile phones are never lost or stolen and their batteries never run down.

-- Mobile phone numbers last forever.

-- An email address uniquely identifies a person.

-- Every person has an email address and they only have one email address.

-- Every person is always able to receive email under all circumstances.

-- Email addresses last forever.

-- People never travel to foreign countries.

-- A person's IP address always determines where they are located.

-- Geolocated IP addresses are always accurate.

-- Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end.

-- The IP address for a customer will never change during a given session (i.e. LEO satellite internet does not exist).

-- If the IP address for a customer changes "too quickly", that indicates fraud (i.e. LEO satellite internet does not exist).

-- Your customer will never connect to you through a VPN.

-- If your customer connects to you through a VPN, they are doing something fraudulent, rather than trying to get around your geolocation brain damage.

cj 2 years ago | |

The problem with many of these examples is that 99% of the time, it is a sign of fraud, and 1% of the time it’s a false positive.

> If a person's mobile phone number is associated with VoIP or Google Voice, that indicates fraud.

I’ve been using this heuristic (along with VPN and IP geo lookup) when screening job candidates after a massive influx of developers outside the US applying for US-only remote roles. I discovered that VOIP phone numbers on a resume is extremely highly correlated with the applicant lying about where they live.

If it weren’t for this screening step, I literally wouldn’t be able to hire anyone because the volume of fraud is so incredibly high that it drowns out legitimate candidates.

I wish there were a way to detect fraud while never having a false positive.

But the reality is that a lot of the heuristics you listed are indeed strongly correlated with fraud. It sucks, but it’s also not realistic to optimize for the 1% of false positives at the expense of the 99%.

chinchilla2020 2 years ago | | |

The cost of the false positives are much higher than the false negatives.

Temporarily slowing down down 99 scammers is not worth stranding one normal person in a foreign country with no means to access their money and no means to recover their account.

The reality is that most lockdown-type protection schemes are just a roadbump, not a solution. They slow down the attacker. In fact, hackers are employing account lockouts to lock security teams and management out of their own accounts when they launch an attack.

I'm with OP on this one. The banks have completely failed to protect against fraud while causing massive economic damage with their clueless security design.

hornban 2 years ago | | |

My primary phone number is a Google Voice number, and I am entirely legitimate. Just curious, how often are other people filtering with this kind of criteria?

I have been considering migrating away from GV for unrelated reasons, but if that sort of thing automatically makes me less attractive when looking for gigs then I'd like to prioritize actually doing that.

matheusmoreira 2 years ago | | |

> I wish there were a way to detect fraud while never having a false positive.

There is: networking. People you trust will tell you about candidates they know about.

> it’s also not realistic to optimize for the 1%

It's not about what's realistic, it's about what's right. Nobody should be falsely treated like a criminal. That 1% should carry enough legal liability to completely offset if not exceed the gains of preventing the 99%. If even one innocent person suffers, it's unacceptable.

dreamcompiler 2 years ago | | |

I'm confused about what such applicants hope to gain by this. What's their business model? They're going to have to give you a SS# or EIN (if they're a self-employed consultant) before you can send them a paycheck, right? And the Social Security Administration has a website where you can verify SS numbers. So what's the play here?

oooyay 2 years ago | | |

You could use identity verification:

https://plaid.com/products/identity-verification/

https://stripe.com/identity

https://www.id.me/

thedougd 2 years ago | | |

I use my Google Voice number for everything that’s not family or friend.

underwatersea 2 years ago | | |

This kinda scares me you are screening out Google Voice Numbers. Google Voice was my primary phone number for over 5 years, I had a real phone number but I was always giving out only Google Voice. Google Voice is a very powerful tool:

* your phone number keeps working even if you lose your phone (I could still answer phone calls when my phone broke). * Traveling abroad is a breeze, just change sim cards on arrival and your US phone number still works via data on Google Voice. No need for expensive travel passes, and you get to choose your operator that has a lot more data. * Having full SMS & call support on a website is very nice, I always hate typing with the phone. iMessage doesn't solve everything since you need a mac (I frequently switch OS & devices).

Also I think e-sims will make lying and fraud much more common. A month ago chatgpt was denying creating a work account for me because I've already had this phone number associated with my previous account. And they were blocking Google Voice. I went to USMobile.com, payed 7$ to create an esim with another phone number, and I had sms with a second phone number on my phone working in less than 10 minutes.

creer 2 years ago | | |

Seems to me you are filtering against agile, tech-aware candidates - prefering less agile, less tech-aware candidates. These are your false positives. A time saver for sure, but perhaps not optimal for filling the positions.

As opposed to, for example, demanding a video feed (and giving time for an alleged engineer to engineer their way past an alleged broken camera.)

It used to be that demanding a photo or video was frowned upon as being a bit too easy to use to filter on race or gender. But I guess not anymore.

dvngnt_ 2 years ago | | |

damn so I've been missing out on jobs because back in highschool I thought it was cool I could text from any browser without my phone

Waterluvian 2 years ago | | |

> The problem with many of these examples is that 99% of the time, it is a sign a fraud, and 1% of the time it’s a false positive.

That’s the key. It may very well be the wrong business decision to care about this 1%.

thwarted 2 years ago | | |

Tragedy of the Commons Ruins Everything Around Me.

TheNewsIsHere 2 years ago | | |

I’d be interested to see actual statistics on this.

I encounter anti-fraud challenges fairly regularly just because I have the same name as another family member and we once shared an address. Years ago.

A number of clients and friends have reported constant hassles wrought of poor anti-fraud implementations.

Older folks and less technically inclined are particularly at risk of falling through these cracks, as are frequent international travelers.

The 99%/1% thing is a good colloquialism but I don’t think the numbers would be there.

Loads of people are using VoIP numbers everyday for perfectly legit purposes. I’m not saying you’re making up your troubles. Just that clearly there are assumptions in anti-fraud technology generally that impact wide swaths of people, whether they understand why or not.

OwenFM 2 years ago | | |

When I lived in the US, I primarily used Google Voice, as I could still use it in foreign countries.

When I had asked T-Mobile to enable international roaming on a particular date, they said they would, but then didn't end up doing it, messing up my travel plans because I didn't have Internet when I arrived. Luckily I was in my home country (Australia) where I could speak the language, but it was a foreign city.

I eventually used someone else's phone to speak to a T-Mobile rep and was sent through a credit check, asking me my American social security number. I'm not American, I don't remember off-hand what government ID I was given there. Luckily I happened to have taken my social security card with me on vacation. I told them, if I can afford to travel internationally, you'd probably think I could also afford a phone plan; why am I being put through this bullshit and why can't you just keep your promises?

jerome-jh 2 years ago | | |

At some point every serious fraudster circumvents the protection and you are only blocking legitimate people.

OK this is probably an overstatement, but the 99% to 1% ratio must to be questioned though.

raverbashing 2 years ago | | |

- Different signals mean different things in different contexts

VOIP phone numbers can indicate an increase in the chance of fraud in some contexts, and be almost meaningless in others

ikiris 2 years ago | | |

So you wont hire anyone who uses google fi? That's pretty lousy.

LoganDark 2 years ago | | |

> US-only remote roles.

The entire premise of remote is that it shouldn't matter where you work from, as long as you get the work done. This is extremely, incredibly harmful. I hope you know that.

qingcharles 2 years ago | |

I tried to place some online bets for a friend who is in prison.

But the betting sites don't allow you to use an ethernet cable to connect to your router o_O (unless you also enable wifi.. except my desktop doesn't have wifi)

https://helpcenter.il.betrivers.com/hc/en-us/articles/360049...

lotsofpulp 2 years ago | | |

What is the heuristic they are checking for here? That problematic actors overwhelmingly will be unable to show an active wifi adapter?

orangepurple 2 years ago | | |

How do they scan for wifi?

quags 2 years ago | |

All these can be the wrong assumptions for sure. Working in a space with some fraud though I can tell you the majority of users verify fine and there ate only the few percentage that don’t for any number of reasons some what you have given above. For smaller vendors though things to consider are

- a charge back can come up to 6 months later. A loss of that is not only a loss of funds but a charge back fee

- too many charge backs could affect the merchant account with the potential of a loss of being able to run your business and this can extend to PayPal or anything merchants run charges through.

- Fees may go up like interchange fees on running credit cards if an account is deemed higher risk.

- blacklisting from visa or Mastercard or merchant accounts in general is not unheard of. Loosing access to running credit cards would be the end of many businesses.

So mom and pop shops need to be aware of fraud and ensure it is low or taken care of. You can’t just accept every order and hope for the best. Fraud does exists and when only a few percentage of users meet your list of incorrect fraud assumptions it’s easy to see why they are used at least for extra verification.

One good thing for merchants for those who accept crypto like Bitcoin is all the risk moves to the sender not the merchant. There are no charge backs - so merchants who take crypto should be able to be a bit more lenient on payments and verification.

ajb 2 years ago | | |

The problem is that it's not acceptable for online providers to converge on making life miserable for "a few percent" of people.

This is a market failure: to save the cost of a few bucks, huge costs are imposed on these individuals. The answer is to have some mechanism whereby people who run into these issues can pay (once) the small cost of being validated in an alternative way (like, actually talking to a human and explaining what's going on, which is how these issues got solved in meatspace originally)

creer 2 years ago | | |

Nobody contests that it's convenient. The question is whether it's technically correct. And the point is that it's not. Just because it's easy doesn't mean you found a solution.

viraptor 2 years ago | | |

> only the few percentage that don’t

Few percent of transactions for a payment processor means a few billion transactions. Visa on its own processes ~200B transactions a year. That's not a great threshold.

withinboredom 2 years ago | |

> Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end.

My Google Maps language (on my PC) is STILL in Portuguese, but I only happened to be visiting Portugal (for 3 days) when they did the subdomain switch... Every time I change it back to English, it changes the language back the next time I visit the site. It's super frustrating.

corbezzoli 2 years ago | | |

Make sure you’re not visiting with a bookmark that includes the specific language code.

I had a similar issue with some history item that would annoyingly point me to the previous version of a page. Only to realize that I was opening a permalink to it.

indrora 2 years ago | |

I'll add another to that list:

-- People will never have a physical mailing address that contains "funny" numbers like "000", "420", "69420", or "80085".

donmcronald 2 years ago | | |

-- No one was born on 4/20/69

-- Forced SMS based MFA should be used to protect logins for mobile phone accounts

dehrmann 2 years ago | | |

I used to work in a building in SF where the address was either 123 Main St. or 123 Mission St. Someone in sales had an issue giving that address to a cab driver, IIRC. Amusingly, the company did (and still does) ML for fraud detection.

dukeyukey 2 years ago | | |

Or that some towns may have... unusual substrings (Scunthorpe, Shitterton, Fingringhoe, and the ever-famous Fucking in Austria, now renamed to Fugging).

dghlsakjg 2 years ago | | |

I once had a friend that lived at, no shit, 1337 High.

margalabargala 2 years ago | | |

I used to live in Baltimore, where there are numbered streets that include ½ symbol streets, and worse, house numbers including ½ numbered houses.

lisper 2 years ago | | |

What’s funny about 420?

ugh123 2 years ago | |

Programmers make these assumptions? How about product/program managers?

lucasyvas 2 years ago | | |

I would say it's both.

tracerbulletx 2 years ago | |

It has nothing to do with wrong assumptions, it has everything to do with the statistical similarity to fraudulent transactions and acceptable failure rates.

creer 2 years ago | | |

Or laziness? "Quick and dirty" is so tempting.

quickthrower2 2 years ago | |

- Twilio etc. cam deliver SMS to any network

- The networks Twilio etc. can’t deliver to are small and don’t have millions of users

seanhunter 2 years ago | |

I'm calling BS on this list. Pretty much noone makes any of these assumptions. The thing with many of these (eg VoIP, Google Voice, VPN etc) is that the population who use these for legitimate purposes is too small for most devs to care about given the cost of fraud from people who are using these things nefariously. Both type I and type II errors are important but they mostly only care about type II errors because type I errors just piss off a small number of good people whereas type II errors cost them money and if they go unabated will get them shut down by payment processors, banks, regulators etc.

998244353 2 years ago | |

> Geolocated IP addresses always indicate the preferred and correct human language of the person on the other end.

This one is only tangentially related to fraud prevention. But I've never really understood this. Is the Accept-Language header really so inaccurate?

Huppie 2 years ago | | |

> Is the Accept-Language header really so inaccurate?

I'd say so yeah. Many many old people here (in a country where English isn't the primary language) use 'misconfigured' browsers.

It's getting better nowadays I suppose with new installers defaulting to our native language but (even though I tend to prefer the English version myself) I think it's a good default. I do prefer an easy way to change it though (or a quick confirmation on the first visit.)

jey 2 years ago | |

Why would LEO satellite internet cause frequent change of IP addresses? Shouldn't all that moving-satellite stuff be handled on a lower level of the OSI Model (probably Layer 2: Data Link), and the IP stuff at Layer 3 isn't affected?

dreamcompiler 2 years ago | | |

With Starlink, the downlink location determines your externally-visible IP address and that can change every 90 seconds or so based on where the closest satellite to you is at the moment. I'm in New Mexico and I frequenly see ads on web pages directing me to shops in Denver or Dallas because those are the downlink locations for me.

You can see the issue better on this visualization:

https://starlink.sx/

nickt 2 years ago | |

— everyone has a USA taxpayer ID

MerelyMortal 2 years ago | | |

or even 'All American citizens have a USA taxpayer ID'

k8svet 2 years ago |

I have such immense disdain for Capital One and MasterCard for how they implement 3DS.

I have been in Germany for 6 weeks. I have spent thousands of dollars between flights, train tickets, and hotels. Guess what I have to do every, single, time I buy a 3EUR train ticket? Receive an SMS on my American cellphone number.

Their "solution" is to have a family member in the US add their number to my account, wake up in the middle of the night and relay TOTP codes to me. FOR A 3EUR TRAIN TICKET. Multiple times a day. From the same damn train company.

I'm willing to pay $1000 yearly fee for a competent credit card company that sends me TOTPs over Email (just like they send me charges [but of course, not refunds/canceled-authorizations]). Or let's me use a Security Key.

The funny thing is, they happily text these codes to VOIP SMS numbers, which I can (and do) route to my email anyway.

It's abusrd that my Xbox account is both more secure and less annoying to use than my credit card. Again, for a 3EUR train ticket. I feel like we're slowly entering this dystopia Kafque-esk nightmare, and yet, as always, there's people in the comments here insisting this is fine, or that I deserve it.

I'm going to assume the people saying "use cash" have never set foot into the real world. Yes, let me put cash into the non-existent train ticket machines, or to the non-existent train attendants. In the 3 minutes I have before my train comes.

brianmiddleton 2 years ago |

I move to random corners of the world every 2-3 years and this is starting to give me real anxiety every time I try to make a purchase. One of my credit cards makes me jump through all of the verification and "Was this really you?" messages, then still locks my account half the time.

So many online stores will approve my purchase and bill the card with no issue, then cancel it a few hours later for vague security reasons. I remember when the credit card companies ran commercials about how easy and secure credit cards are, especially compared to checks, but now I feel like a criminal every time I try to use mine. I wonder if this violates any part of the merchant agreement that these stores are getting a 100% valid authorization on my credit card, but still aren't willing to accept my payment.

Habgdnv 2 years ago |

I wholeheartedly support digitization, having been involved in the realms of development, system administration, and everything computer-related since my early days. However, what irks me is when I'm bound to use products or services from providers who fail to execute their roles properly despite being compensated for it.

A recent incident at my child's school serves as a pertinent example. They transitioned from a traditional cash-based food delivery system to a new digital platform. While trying to register on this platform, I was prompted to provide an "email". I input my usual email address only to be met with an "invalid email" response. After multiple back-and-forths with both the school and the platform's support, I discovered that by "email", they actually meant a "Gmail account".

For context, I've been using my own domain for my email, which ends in .international, for over a decade now—longer than my 9-year-old child has been alive. Despite this, they deemed my email domain "new". The situation reached a head when the school's principal called me, trying to understand the issue. After explaining the situation, he assured me that the problem was on my end, stating that he had consulted with other teachers and they were in agreement that "<my domain name>.international" wasn't a "real platform".

jp57 2 years ago |

> if my card was already accepted once and I successfully approved the payment via 3D secure with my bank, who are you (as a random online service) to assume you can act as my big brother? Even more, if I'm using a balance paid by gift card, who give Amazon or other services the right to put my account on hold while it still contains my hard earned money[?]

There are many payment methods around the world that have different rules, but for Visa, MC, and Amex cards issued by American banks, the merchant, not the card issuer, has the liability to repay fraudulent on-line purchases (so-called "card not present" transactions). The merchant is the one accepting the risk, not your bank. So they decide which transactions they will accept liability for and which they will decline and what you need to do to prove that their liability is low.

In addition, some second-factor systems (like possibly 3D secure) shift the liability from the merchant to the issuer when passed, but banking rules are arcane, and it is likely that 3D secure only shifts the liability for the one transaction that triggered it, and not any subsequent transactions.

WhiteSabbath 2 years ago | |

Yes, you are right. But concerns about fraud are still understandable. I try to avoid scammers, so I select games for myself on the https://gamblizard.ca/best-canadian-online-casinos/real-mone... service, where all the sites offered are legal and verified. This is very important for me, because I don’t want my money to disappear into oblivion.

ryandrake 2 years ago |

Every time I travel abroad, some company's poorly thought out software goes bonkers and then it becomes my problem to solve. Hey, companies: People travel. Sometimes very frequently. This is not an edge case or an obscure P3 bug. If you're assuming that a mere sudden change in IP to a different country is "suspicious" then you're doing it wrong. Your software is a mess and can't seem to deal with it. Maybe take a break from cramming unwanted features and go fix some unglamorous bugs for a change.

kevstev 2 years ago | |

One thing I try to do to avoid this is to always make a purchase at the airport before I go overseas. This seems to calm down the algos a bit. I used to go through this a bunch too.

mickelsen 2 years ago | | |

One day my card got cloned and I see some withdrawals from a foreign country. I promptly report it, transactions reversed and the bank issued a new card. After this, I was getting fraud alerts and either informative or confirmation SMS when that was triggered in the past. It seemed to follow whenever a transaction passed $100, then $500, then $1000 and a certain frequency or off-hours.

It's like the risk threshold got a reset with the new issued plastic. Eventually the algorithm was trained I suppose, back it was back to where it was, and stopped getting alerts for anything out of the usual. This resonates with the experience of friends in the same bank, who hardly ever use their credit cards, so whatever they buy gets flagged and someone calls to make sure it's them.

Old fashioned banks who are behind the times in technology, but keep richer clients, are usually less annoying, both with the fraud algos thing and also the KYC stuff, and sometimes the difference is massive.

sentientslug 2 years ago | | |

Great idea, spend your money to earn the privilege of spending your money later.

0cf8612b2e1e 2 years ago | | |

I do the same, and again when I land. Try to double down on signaling to the black box.

teddyh 2 years ago | | |

“It approves of rereading.”

crazygringo 2 years ago |

Obviously I sympathize, but I find it extremely odd that OP is complaining about cards being declined but doesn't once explain whether he/she tried phoning their credit card to unblock? Because that generally works -- you call once, let them know you're traveling and where, and then your card works fine. Occasionally you have to call again for a specific high-value ($500+) transaction, but it's rarely more than a 5-minute phone call.

And then as to buying/using gift cards in India, on a non-Indian account, of course that's going to raise every suspicion under the sun, given that that's a mechanism used by some of the most prevalent scams in the world.

So I'm really confused, because this "vent" reads like somebody not going through the basic steps to use credit cards abroad, and then engaging in the biggest red-flag types of transactions.

And the fact that they're complaining the airport doesn't allow them to carry enough cash (isn't the limit $10K?) really raises red flags for me. If you need to transfer large amounts of money safely between countries to your family, that's what wire transfers or Western Union is for. That's been the case for many decades now.

The more I re-read this post, the less and less sense it makes.

cycomanic 2 years ago |

One of my favorites amongst this stupid platforms is PayPal. I have moved countries/continents. Once I forgot to close my account before moving (still had some $100 on it), after I could never access it as it wanted a phone call to my non existent former phone number to confirm this is really me, ok my fault. Now I have moved again when I want to pay with PayPal I can't because my account is associated to a different country. It is impossible to change the country. The FAQ say you have to close and reopen a new account), but if I try to close the account I get to an error page. This would all be not so bad if it wasn't for the merchants who use PayPal and disallow payment without an account. In the end the easiest was to just open a new account with a different email.

Somebody mentioned Google services, and that was a big issue as well. I still have bank accounts in my former country of residence, so I need access to apps from that country (the 2fa App that is used there). On the other hand I need to access some apps here (school notifications, banks...) Google obviously knows better than to allow me to get apps from different regions. The solution was again to just create another account. The whole system is really screwed up. I'm not sure what they are actually trying to prevent, considering that in the end one can work around the restrictions quite easily with multiple accounts, but one would think with the world moving closer together these things would actually get easier.

aiProgMach 2 years ago | |

Yes, PayPal once locked me from reading their developer docs because I opened it from the wrong country. These guys never heard of remote working apparently?

OJFord 2 years ago | |

PayPal refuse to close an account(↑) I didn't knowingly consent to the creation of, and certainly never provided any photographic ID for, because I refuse to 'prove my identity' to delete it.

There's not even a real phone number (0s) or address (ABC nonsense) on the bloody thing, but of course giving up some PII they don't have will somehow verify that I have the authority to close an account which is basically name + email address (I've provided those!).

(↑: it comes from the scummy dark park pattern checkout process where you say you want to pay with card not PayPal, and the it turns out the card payment is actually provided by PayPal and here you go have an account with the details you provided to the merchant not PayPal, wouldn't that be helpful. It's certainly not GDPR compliant, but try making PayPal care.)

notatoad 2 years ago |

>who are you (as a random online service) to assume you can act as my big brother?

we're the people who suffer the consequences of the fraud. if your card gets used fraudulently, you call your bank and get the transactions cancelled, no big deal.

if my website lets a fraudulent transaction through, my processing fees go up. if my website lets more than a couple fraudulent transactions through (or not even necessarily frauddulent, but transactions that the issuing banks classify as high-risk) the credit card companies shut off my ability to process payments and my business shuts down. so yeah, sorry if it inconveniences you, but accepting a payment from some random guy who even slightly matches some fraud characteristics isn't worth risking my business over.

jrockway 2 years ago | |

Yup. Having been on this side of the fraud business, I empathize with the OP but will definitely defend overly-aggressive fraud systems. As you make more money, it's less of an impact on your business, and you can tone them down. But at day 1, if people are only signing up for your service to see if their stolen credit card numbers work, there might not be day 2 unless you're aggressive about blocking this. So, sometimes innocent civilians will get caught up in the safety net.

olyjohn 2 years ago | |

Wow nice of them to pass the responsibility on to you.

xyst 2 years ago | |

yet another reason why credit and debit card companies need to be surgically removed from our lives. They are parasites.

tlb 2 years ago |

It is frustrating. From a consumer's POV, the system just denies you stuff for no apparent reason.

From a bank's POV, they're losing billions of dollars to card fraud operations, and there are very clever fraudsters who do their best to be indistinguishable from legit users.

Legit users in rare situations (such as being cross-border) are often collateral damage. You can only understand what heuristic you're triggering by knowing a bit about patterns of fraud, which is an unreasonable demand on innocent consumers.

miav 2 years ago |

Some comments try to justify this - they’re wrong.

Even if it was just 1% of users, outright ignoring their issues is not acceptable. And far more than 1% travel abroad or do other suspicious activity (such as buying things at a place you’ve never purchased from before).

And there are services that handle this correctly. Starling bank (UK) is a fave of mine. Confirm in an app, enter full password in some cases, but that’s it. I had to make some sketchy looking transactions and no matter, they never block your account or make you jump through additional hoops.

Nextgrid 2 years ago | |

> Confirm in an app, enter full password in some cases, but that’s it

That's only on the bank's side. There's a major problem where the merchant later cancels the transaction on their side despite successful 3D-Secure.

Either 3DS doesn't actually offload liability (so even accepting a fully 3DS-verified transaction is a risk), or merchants aren't up to date on what they are and aren't liable for.

gameshot911 2 years ago |

I did a year of travel worldwide in over a dozen countries, and I had the most problems using my credit and debit cards in India. Particularly online, even at large, legitimate businesses like major airlines.

It becomes a tense situation when you are trying to buy a flight that you absolutely have to take, and despite 4 different credit/debit cards you still can't get any purchase on multiple different airlines go through! I even tried to go to the offices, but they were often difficult to find, non-existent, or just not open at the times you'd expect them to be. And good luck trying to purchase on a telephone, between trying to dial in international number, bad connections, and language issues!

FWIW, I had the most success with debit cards. I suspect it's because international companies feel more comfortable with cash in hand, vs. an American CC which can be easily charged back.

patrakov 2 years ago |

That's how I effectively lost my Azure account.

"According to our records, you originally registered this account while in Russia, and there is no way to change the country of the account. So we will continue to apply sanctions to this account despite the well-confirmed fact that you have moved out for good. We will also not allow attaching any non-Russian debit cards to that account, as we generally prohibit attaching foreign cards to any account. Please make a new account and enjoy."

instagib 2 years ago |

Tried a premium credit card yet? One that costs $400/yr?

I had a number to call and talk to someone with no wait if I had an issue.

I dealt with some issues and I ultimately found out that they(the store) want to fingerprint you online. Things you do to avoid that make purchasing things online difficult.

My ip address didn’t match the city I was in or receiving the item in = flag. Using a non-default dns service or vpn? I turn all that off and WiFi when I make a purchase.

If you’re okay throwing money at the problem, get a second phone to buy things with that you don’t do anything else on which has separate logins.

My favorite joke scene about a cashless society was that some criminals couldn’t figure out who to rob because no one accepted cash anymore or held it in a store. Their only option was to rob another gang.

teddyh 2 years ago | |

> My favorite joke scene about a cashless society was that some criminals couldn’t figure out who to rob because no one accepted cash anymore or held it in a store. Their only option was to rob another gang.

In a cashless society, the robbers who are left are the ones in the credit card money chain itself, where everybody is taking their share of the money flowing through it. I.e. “The best way to rob a bank is to own it.” The best kind of crimes are the legal ones.

gnicholas 2 years ago |

My credit card company likes to aggressively flag transactions as fraudulent "for my protection" — even though it's really for their protection. The upshot is that purchases at my local Apple Store (which is walking distance from where I live) get flagged. I have bought many things from Apple over the years, and buy things there at least a couple times a year. So it's pretty silly for these transactions to be flagged.

The worst part is that they don't pro-actively notify me of the flagging via app notification, email, or phone call. I have to track them down and tell them the transaction was authorized. Or more likely I just get out a different credit card and use that one instead.

dakial1 2 years ago |

This happens because the cost of developing (or buying) good software and people to build a decent anti-fraud system is very clear to measure and the impact of the false positives is not. Also, as credit card fraud is usually the bank's responsibility, it makes sense for the leaders of that area to go towards more false positives than false negatives.

But it does not need to be that way and the government can and should help.

In my country (Brazil) banking is well regulated industry and we also have some good consumer laws. Both those things help a lot to show a clear impact of badly designed anti-fraud system to the banks. For example, the central bank has an online channel, where you can open a complaint, which the bank is obligated to answer/solve in 5 days and might get fined millions if they get lots of valid ones.

I used to get my card denied very often, with no heads-up or call to confirm. So I raised a complaint at the Central Bank, got an apology letter and call from my bank manager and I never again had my credit card blocked anywhere.

aiProgMach 2 years ago | |

My problem is different, the bank approve my payment after 3D secure check, the offender is the service provider, they cancel the order and issue a refund with a vague statement!

Aachen 2 years ago | |

The cost of false positives is obvious though: lost custom?

dakial1 2 years ago | | |

It is obvious but not easy to measure. And companies act like what is not easy to measure doesn't exist.

gdulli 2 years ago |

I am no longer allowed to buy anything at Ikea. The web site declines both my credit card and debit card. I called my credit card company, and no issues there. I called Ikea and tried to order through a person, but my cards were also declined that way. They can't give me any explanation. This happened in 2019 and again the next time I tried in 2021.

kragen 2 years ago | |

i know ikea doesn't accept bitcoin, but what happens if you pay cash

gdulli 2 years ago | | |

I was only trying to buy online and wasn't close enough to a store to want to try that.

sharmi 2 years ago |

Dealing with fraud detection is a real pain!

Every 3 months, I have to pay the school fee for my 3 kids. The amount is almost the same for all three. The first payment always goes off without a hitch. But, when I go to pay for the second kid, bam, it locks up the account. Our local branch is utterly clueless. Then we will have to jump through multiple hoops to get the account activated. This whole drama happens like clockwork every three months. It doesn't matter that it's just a school payment, and doesn't matter that thousands of parents are making payment around that time.

Friends holding accounts in other banks face the same issues. So, it is not isolated to my bank and changing banks will not help.

So, now, we've decided to take the one-kid-a-day approach. It's a bit more work, 'cause I have to remember to make those payments over three days, but it sure beats the headache of reactivating the account every time.

singlow 2 years ago |

> who are you (as a random online service) to assume you can act as my big brother?

They are not trying to protect you. As a card holder you would not be damaged by fraudulant purchases apart from the inconvenience of reporting them. They are protecting themselves because if that transaction is later found to be fraudulant then they will have to return the funds and will likely be unable to recover the product they shipped or other costs incurred.

jwr 2 years ago |

I run a SaaS based in the EU. Most of my US customers have problems with their subscriptions, because US banks automatically assume that any "foreign" charge must be fraud, and block it.

I am wasting so much time explaining that they need to contact their bank, and they waste so much time calling their banks… it's disheartening.

raverbashing 2 years ago | |

> because US banks automatically assume that any "foreign" charge must be fraud, and block it.

Wow amazing logic there

Sometimes I do wonder if there's one or two thinking neurons in the whole "fraud prevention" department of US banks or if they're just cargo-culting practices someone invented in the 70s

THENATHE 2 years ago |

The part about all of this that bothers me is that, 99% of the time, the fraud that is going on is of a fraudulent advertising nature.

I've worked as an 'IT guy' (short form for 'I do basically everything') for many small businesses, a lot of which were computer repair shops that, in their small town feel, spent a lot of time just helping old people navigate how to use a computer. Many times I had people come in that found a clearly fake site advertising some too good to be true deal and didn't realize, spent their money, and never got anything or got like a toothbrush when they ordered a desk.

This fraud protection doesn't protect in any way against that. I've helped probably 2,000 instances of fraud in this way just telling them "you need to file a claim with your bank and get your money back because you're never going to get that product" and hundreds upon hundreds of issues where they're like " oh Microsoft is going to delete my computer if I don't pay them 30 Bitcoin" and other bullshit like that. Maybe two times in my 10 plus year career has anyone actually had their cards stolen and used overseas.

Just kinda wild to think about that my bank cares more about me travelling to new York than it does making a 6000$ purchase on coinbase.

Aldipower 2 years ago |

I would like to emphasize his point. When we get into a digital only currency world, you are loosing control. He is giving a real life example. Nothing hypothetical. Think about blocked - without given reason - Google accounts and such. Could be you bank account, in the future, too!

klabb3 2 years ago | |

The beauty of cash is that it is money, not merely pinky-promising to be money. The “cashless” world was supposed to prevent fraud but clearly it doesn’t work. Instead we’re moving into a world of reputation and heuristics, with implications down to the level of individuals and small businesses.

I don’t particularly like to carry cash. But being shadow banned from existing by deliberately obscured algorithms could be much worse.

SantalBlush 2 years ago | |

Counterpoint: My dad sold a lot of pot in the 80s, and subscribed to High Times Magazine. They had an ad for a board game called "Dealer McDope", and he mailed an order for it with (naturally) cash, and waited. Eventually, he gets a reply in the mail: "No money, no game!" He was pissed.

My mom loves that story.

EVa5I7bHFq9mnYK 2 years ago | |

I think "loosing" should just be declared a language norm at this point.

smeej 2 years ago | |

This is only true if you're talking about central bank digital currencies. And frankly I worry about anyone who isn't worried about those.

csomar 2 years ago |

I am of the opinion that these restrictions are used (quietly) to preform a kind of capital restrictions while not (officially) having such capital restrictions in place. This happens because governments (or populations?) have accepted that, say, an agriculture bill (or law) can have sections that cover tech. So if you are trying to do something and you don't want to say it, you slip it in under "fraud" or "AML" or something else.

Now that everyone (including third-world countries) have figured that out; and legacy companies (big Tech, MasterCard/Visa, big banks) know that this makes their customer life hellish however it kills competition: They'll bend over backward, forward and multi-laterally to implement anything that any lawmaker asks them for.

If you are a very simple simpleton, say a government official with a single income, a regular rental, and regular bills (your groceries and your kids pencils), you'll very unlikely face any issue. But start to deviate from that, and everything starts breaking. Governments are becoming hostile to anything that doesn't fit their narrative.

This is only getting worse from here...

anish_m 2 years ago |

I worked on one of these Fraud detection systems at Airbnb. Statistically, You are in 1% population with the your usage patterns. For most part, all ML models which are used to detect fraud have to take a trade off between precision/recall - meaning how often they let good guys suffer vs let bad guys in. BUt what most of these systems are missing is the appeal and escape path.

spacebanana7 2 years ago | |

> But what most of these systems are missing is the appeal and escape path.

Are there any such systems that do have effective escape/appeal paths? If so, what do they look like?

sneak 2 years ago | | |

Even if they exist, I am willing to bet they consume the limited time and energy of the people whose only crime was not living the same lifestyle as 99% of everyone else.

ellyagg 2 years ago |

I live in California and nike.com just cancelled my last two orders without notice because they "couldn't verify my billing information", according to the chat rep. It's the same billing information I use everywhere for years.

thaumasiotes 2 years ago | |

Years ago I kept having Blizzard cancel my subscription to World of Warcraft because of unspecified problems with the payment information. I'd get locked out, I'd pay again, and a couple days later they'd be angry again over my invalid payment information.

I eventually learned that what they meant by "invalid" was "sure, your payment information is already associated with your account, but it doesn't match the preferred card listed on your account".

roshin 2 years ago |

As an expat, I've experienced lots of issues with my US bank recently. They started adding a 2fa through SMS, and they have no way for me to turn it off. I've been looking for banks to switch to, but it is hard to Google banks that don't require a phone number. What I've ended up doing is attempting to open an account and then stopping when they ask for a phone number. The solution I found was to open a Schwab international brokerage account. They're okay with people who do not reside in the US, provide a debit card, can be used to pay of CCs, can deposit/write checks and allow money transfers. The only issue is that I suspect that my money is not protected by the government if Schwab goes bankrupt.

LeonB 2 years ago |

The “fraud prevention” people are told that they are fraud prevention people, even though the rest of the company are “customer service” people.

So they build “fraud prevention” systems, and heavily discount any notion of customer service — they’re perfectly willing to lose some customers in the name of fraud prevention - not because they must, but because their focus and incentives are indifferent to customer service. They see it as an inevitable cost of business - when it’s an inevitable cost of not caring about that aspect of the business.

nitwit005 2 years ago |

If a business is the source of too much fraud, the payment processors will naturally cut them off, which has the side effect of forcing them all to try their best to stem the bleeding.

With the natural problem that many of them won't be all that good at it.

tjpnz 2 years ago |

As someone who's previously been involved in KYC/AML I've a long held suspicion that these policies are in place to benefit the United States while deliberately inconveniencing everyone else.

matheusmoreira 2 years ago | |

That's exactly what they are for. KYC/AML is just the financial arm of their total global surveillance program.

tjpnz 2 years ago | | |

I'm talking more in terms of retaining a competitive advantage. The processes you might implement in Japan wouldn't be implemented in the US despite them having a basis in international law.

csomar 2 years ago | |

I do have the same suspicion: https://news.ycombinator.com/item?id=38048156

I also think that the other countries started doing the same thing and this is starting to make the system as weird as it gets.

kalleboo 2 years ago | |

Can you explain? I'm not sure I get how this benefits the US specifically.

I'm not American but have held and used cards from a European and Asian country and am not sure how the behavior is any different.

vertis 2 years ago |

Another workaround: As far as Google Play is concerned just create new accounts and add them to your phone. I have this setup because I end up having to download region blocked Australian, UK and German apps.

teamspirit 2 years ago | |

Doesn't that then put you at risk of Google's anti fraud measures, which, in my opinion, is much more difficult to work around? At least with your bank you can call them and eventually get it resolved.

I ask because I've thought of doing this but have always been worried Google would not only shut that account down but my main one as well.

time_is_scary 2 years ago |

One thing I have started doing is using a VPN with the location set to my home location 100% of the time when home. Then, when logging in abroad I use the VPN to my home location.

It seems that using the VPN 100% of the time has trained many of these smart services to fingerprint that as my default fingerprint.

Of course, this doesn't help when interacting with services that detect/block VPNs. Or the even more annoying situation where VPNs are blocked and also all traffic from the country you are in is also blocked (occurs occasionally when trying to access US sites from SE Asia)

edit: WRT comments mentioning that you can call your bank or set a travel notice: that is how things used to work. Chase, for example, no longer lets you set a travel notice as they use a "smart" automated system. That said, my Chase travel card used via apple/android pay has never given me trouble so their system does seem better than most

codetrotter 2 years ago |

This sort of thing is where I hope Bitcoin can help more people.

worik 2 years ago | |

> This sort of thing is where I hope Bitcoin can help more people.

It is a use for a Bitcoin like system

(The transaction costs, planet destroying character, and slow speed probably not Bitcoin)

It is the intersection of money laundering and normal requirements

Stopping crime by stopping money laundering will always have these problems, surely?

Is there a way to inhibit CC fraud, and money laundering without making life difficult for people who are in the tails of the distributions?

Even cash will not suffice as many places no longer accept it

spacebanana7 2 years ago | | |

> Stopping crime by stopping money laundering will always have these problems, surely?

Yes.

Money laundering detection inescapably relies on private actors making a pre-prosecution estimate of whether money was earned illegitimately.

Private actors have much less information available to them than real law public sector enforcement.

And even with full information, trials cannot be predicted deterministically so there will always a gap those publicly deemed guilty and those privately deemed guilty.

Those in later category will suffer unjust financial hardship.

matheusmoreira 2 years ago | | |

> Stopping crime by stopping money laundering will always have these problems, surely?

I believe so. The optimal amount of fraud is non-zero.

https://news.ycombinator.com/item?id=32701913

NegativeK 2 years ago | | |

> Is there a way to inhibit CC fraud, and money laundering without making life difficult for people who are in the tails of the distributions?

Yes. Have better customer support and actually fix issues when they happen.

This ends up costing someone money.

bryankaplan 2 years ago | |

Yes, but there's still so much supporting software waiting to be built.

belk 2 years ago |

tip regarding google play, each account can have an independent region, create a new google account and set it to your new location, keep the original where it was, it has 0 impact on how you use the apps after installation, if the app uses google auth you can login with either accounts

aiProgMach 2 years ago | |

Nice will try that, thanks!

jokethrowaway 2 years ago |

Blame Anti Money Laundering regulations and chargebacks.

AML is a nightmare for banks, most BS they pull off is because the government is worried they won't be able to steal all your tax money.

Strong authentication is another BS regulation with the sole goal of killing small banks with

Chargebacks are convenient for the customer - but they have a cost on the entire system, including banks caring about people stealing a CC and spending.

corbezzoli 2 years ago |

I am glad I found a bank (N26) that rarely if ever blocks my payments online. I travel frequently and my previous credit card would block all kinds of payments regularly.

If possible, find yourself a bank that enables you to spend money and leaves “security” in your hands. My 2FA is via app, never SMS.

Side note: someone stole and used my card number and the bank immediately refunded me. Can’t get any better than this.

uoaei 2 years ago |

I have completely lost access to my Amazon account because I had the audacity to use a correct login and password from a recognized machine in a different part of the world from my shipping address. I called customer service and they said the only thing I can do is create a new account with a different email.

dbdoug 2 years ago | |

Strange. I live in Canada, and visit Brazil often. I have never had any trouble using my only Amazon account to log in to Amazon USA, Amazon Brazil, or Amazon Canada. I have both Brazilian and Canadian addresses set up as shipping options on my account, and I often make purchases on Amazon Brazil while in Canada and have them shipped to the Brazilian address.

Hackbraten 2 years ago | |

How old was your account when you lost access to it?

uoaei 2 years ago | | |

At least 15 years, but the past 7 years or so I only used it when I would receive a gift card for Amazon or had no other option for a specific brand's product. I think the last time I used it was 2 or 3 years ago. I'm sure that was a factor, but not being able to recover the account with the email address it's tied to doesn't make sense to me.

welder 2 years ago |

> who are you (as a random online service) to assume you can act as my big brother?

Card companies make the random online service pay a fee anytime someone does a chargeback. Yes it shouldn't be their job, but card companies make push this responsibility onto them.

camhart 2 years ago |

Could you use crypto instead? Use USDC (or some other semi reliable stable coin). Exchange for stable coin in other currency. Then withdraw to local bank in India. Move in small amounts at first to test everything out, check fees, etc.

aiProgMach 2 years ago |

Update, Amazon basically said they won't accept to remove the hold on my account, saying:

> The information you supplied was reviewed by Amazon but we cannot remove the hold on your account at this time. For details, check for an email or text message from Amazon describing next steps. Please contact us for further concerns.

I provided my visa + passport + card pic + selfie + Screens of latest Gift card order (email and from the website), still they won't remove the hold and effectively stealing the money in the account. I can't believe this is being done in good faith, this is clear theft, because what else they need?

aiProgMach 2 years ago | |

Update 2: I received an email with very dismissal tone from amazon telling me the account will be closed. The funds are still there, I'm planning to apply for consumer complain against them, I'm willing to go to the end with this.

pm24601 2 years ago |

I use cash for so so so much. I will bring a couple of thousand USD on a trip and convert it to the local currency to avoid exactly this hassle. Not just for me but for the merchant as well.

Cash is king-many, many times.

dalyons 2 years ago | |

Not really a solution, as there’s plenty of countries now (eg Australia, nz) where cash is not useful anymore, because many physical merchants no longer accept it. The number grows every year.

its-summertime 2 years ago |

> (until I asked shop owner to pay for me and I paid him in cash + small profit...).

I tried that once, family member specifically. They ended up getting blocked too. Customer support told me to take a hike.

sneak 2 years ago |

Most people in the US don’t ever leave their home country, and when they do, it’s usually to a small number of other first world countries.

I came close to being bankrupted this year because my US health insurer doesn’t support customers remaining insured if they live a lifestyle that involves being away from paper mail delivery for a few months at a time. (I live elsewhere half the year and they cancelled my policy with only paper mail notice after my payment card on file expired.)

It’s really terrible.

IG_Semmelweiss 2 years ago |

I tried to message the CTO and SVP revenue of adidas for this same reason.

I was literally trying to hand money to the company in 5 different attempts.

I finally gave up, with a borderline ulcer

I ll never try adidas.com again

idontwantthis 2 years ago |

I couldn’t activate a capital one credit card in the US with a real U.S. phone number. I didn’t just need a phone number associated with my name, I needed to be the one paying for the plan. I was on a family plan and I wasn’t the primary. Then I tried verifying my passport through their proprietary portal and it rejected me for unknown reasons. So I said fuck me then and cancelled the card.

supriyo-biswas 2 years ago |

(Tell HN:)

Also:

> Yet, many online services are giving me hell with their "smart" anti fraud detection and things like that

To provide a contrarian opinion, credit card testing, free trial abuse, and other forms of fraud are a thing, so companies usually have to layer other anti-fraud mechanisms on top of 3D secure.

That being said, what service are you facing issues with? I do see Amazon as one of the listed services, but they do eventually remove such suspensions. (My experience was with AWS though.)

EVa5I7bHFq9mnYK 2 years ago | |

I lost my 25-years old Amazon account when their AI grew suspicious of my credit card. After spending several hours on the phone, sending countless batches of "documentation" and taking selfies in various difficult poses, I gave up and just use Walmart online and ebay now. Saved a lot of money btw.

aiProgMach 2 years ago | |

Currently I'm at the 3rd attempt to unlock my account, let's see, hope you're right.

softveda 2 years ago |

I am Australian of Indian origin who also visits family each year. I had no such issues you mention (except the google region change). My Australian bank allows cash withdrawal from ATM without forex fee, most shops in Tier1&2 cities I go to accept credit cards. Verification is through in app notification, I get a local SIM. My Australian SIM has free incoming SMS.

The only issue is some places now accept UPI payments only.

gorbachev 2 years ago |

Interestingly I, kind of, have the opposite problem, so to speak.

I recently moved to a foreign country, admittedly an "easy" western European country, and I fully expected my credit cards to start refusing more or less every transaction. Not so. Not a single transaction has been delayed, or denied.

I travel back and forth my home country and my new home semi-regularly with no issues with using my credit cards. I'm not sure this is a good thing either.

edg5000 2 years ago | |

Which "easy" western european country are you in? Credit cards are extremely uncommon in many western european countries. They really only exist here so we can make international payments, primarily to US-based companies. Everything is debit card based. France: PayPal, Carte Bancaire. Most closely resembles the US credit card system. But it seems the french use their local debit accounts to make payments. Belgium: PayPal, BanContact (any local bank debit accounts) Netherlands: iDeal (any local bank debit account) Germany: PayPal, SOFORT (local bank debit accounts)

TLDR: In EU for online purchases, you want to have an PayPal + local debit account to cover most purchases. For interrnational payments, you can have a credit card for those extremely rare cases where vendors only accept credit cards.

aiProgMach 2 years ago | |

I wish I have the same problem :)

rglover 2 years ago |

Though it can have its own quirks (speed, access to exchange between currencies, etc), Bitcoin has been a life saver for situations like this.

If it's an option, it'd be worth exploring using a service that allows you to pay for gift cards (including things like Visa gift cards) to the services you need using Bitcoin.

pshirshov 2 years ago |

When I was on a trip to another country, Revolut blocked my card. I complained, they apologized, gave me €20 as a compensation and seemingly fixed something, at least it didn't happen again during several subsequent trips. Speak with your bank. Maybe change your bank.

kylehotchkiss 2 years ago |

Wise.com works wonderfully in India. I know it’s late this time around but it should work fine next time around. And American Express has been a pretty reliable option for me for an extended period of time. Wishing your family all the best in this time.

kragen 2 years ago |

this is why bitcoin and zcash is so important: your keys, your coins, period. as long as the bank or other card issuer or merchant is on the hook for stolen cards and identity fraud, they'll be paranoid about anything that looks 'suspicious' and cut off your access to your funds just in case

(of course if you want to keep your bitcoin in a 'bank' you can, but the important thing is that the choice is yours, not the government's; and merchants who accept bitcoin aren't at risk of incurring chargebacks)

online payment is coming one way or another; let's make sure it's self-sovereign, secure by design, and privacy-protecting. we've already gone a long way down a very dark road, and it's going to get a lot worse before it gets better, with oppressive governments freezing the funds of family members of dissidents and journalists, genocides, and targeted overseas assassinations facilitated by our insecure-by-design payment system

today bitcoin already solves the 'hard to carry cash from one country to another' problem pretty comprehensively; you can buy bitcoin in one country, write your electrum seed phrase on a slip of paper (or memorize it, or read it over the phone to a relative who writes it down), reinstall electrum on a fresh, trustworthy phone after you arrive, and change the bitcoin to local currency with a local counterparty. no cell phone for corrupt cops to copy keys from at the airport, no briefcases full of bills, nothing to declare at customs. and you don't have to care if the tiffin wallah accepts bitcoin (does he accept paytm yet?) because you just need to find one willing counterparty in the entire country

zcash is more difficult to use this way because there aren't as many counterparties

goodboyjojo 2 years ago |

that sucks man i know your pain. i hate having to jump though hoops just to do transactions online. i understand the things they do is to prevent fraud but treating everybody as a potential criminal is mildly disrespectful

starttoaster 2 years ago | |

> is mildly disrespectful

From their perspective (at least in this case), it's just business. Using one currency to buy gift cards in India's currency is a huge red flag in and of itself. Scammers exist everywhere, surely, but I don't know of many other countries where it's common news to see an entire office building full of scammers working telephones and computers with remote desktop sessions open on "client" computers to extort money from unsuspecting people (often using gift cards on services like Google Pay or Amazon as the vehicle.)

It's truly terrible that we live in a world where access to those services is almost a necessity for modern living, and that those services are more or less available depending on your region. It's also truly terrible that those office buildings exist. I assume the OP is on the right side of all of this, and is truly a victim of it, but it's hard for me to distinguish if I have more empathy for the innocent casualties of the war on scammers in India, or the innocent casualties of scammers in the rest of the world. Because without a basically divine way of determining guilt automatically, at least one of those groups is going to continue being slammed in the victim seat.

I'd hope that if victims of these anti-fraud algorithms in India were so prevalent, that the Indian government would do more to prevent these bad faith businesses from sprouting up in the first place. It would seem to me like that would benefit literally the entire world. Easier said than done, I'm sure. Probably even talking about an entire government reform for that effort.

tayo42 2 years ago |

the 2fa with a phone number drives me crazy when i travel. I couldnt get into my accounts because of it on one trip. frustrating that sites assume you always have a connected phone. had this happen on a airplane too

gumballindie 2 years ago |

Probably due to increased reliance on non deterministic systems such as those based on ai. I except overall quality of all services, including fraud detection, to drop.

pshirshov 2 years ago |

> as Google play have this "smart" rule that says I can only change my region once per year, what??

Create a work profile and a separate Google account with Island or Shelter.

yuumei 2 years ago |

I’m close to putting all my money in crypto and using prepaid cards to avoid the utter hell I have to deal with to pay for something using a normal bank.

nonsense123 2 years ago |

I only have two data points (well, three now with OP): but I susped this is on purpose.

BR and CN both are painful for me for this reason. Try to use a credit card, they will try to SMS a phone number I haven't used in my bank for 3 or more years.

Now that OP tells us about IN i'm starting to see a pattern: for a fraud and insurance company, or being realistic, the payment processor middle man who offers those services at a loss, making their client lose a few sales while pushing their customers (you) to instant electronic payments (BR:pix, IN:UPI, CN:IBPS etc) is a much better deal (for the middle man)!

didip 2 years ago |

To quickly solve some of your pain, pay a VPN node in America and just proxy requests through it.

Small amount of money compared to the stress.

EVa5I7bHFq9mnYK 2 years ago | |

VPN is a #1 sign of a fraudster, you will quickly learn this truing to use a VPN.

dboreham 2 years ago | | |

Parent may mean a VPN in the traditional (before wall to wall shills on YouTube) sense. Where you tunnel to your own network: home or office.

salad-tycoon 2 years ago |

I got an Apple Card, tried buying NextDNS with it, it declined for fraud detection 9 times over a few weeks(and I manually and immediately approved the transaction after each one and also called them around the 4th time). I asked Goldman sacks , they said NextDNS is not ESG enough or some such trash.

Yeah, I think we should be worried.

gruez 2 years ago | |

That seems suspect. Although it's theoretically possible to detect what your dns provider is and block it, I highly doubt GS cares enough about it to implement it.

blibble 2 years ago |

sounds like you are literally trying to launder money

system seems to be working as intended

edg5000 2 years ago |

So you move around a lot between 2 locations. Is it possible to set up two completely isolated systems (e.g. bank accounts, online accounts & devices), including a cheap second phone. The only interface between your two isolated systems would be the proven international money transfer services? Global money transfer between individuals (or yourself) I believe is the focus of all these remittance services of which I see all these ads lately. Of course they will charge a fee. I believe your use case is super common and many services target this use case.

TLDR: Global money transfer is probably not something you can do casually and frequently. There are specific services, and fees, and headaches. Probably you want to minimize the amount of individual transactions as much as possible to minimize the headaches (of course there are cashflow limitations).

RadixDLT 2 years ago |

you are using the wrong credit card/bank if you travel overseas. You should try something like Wise bank that will let you deposit money in different currencies

al2o3cr 2 years ago |

    I had to try literally multiple services just to buy expensive gift card

So instead of contacting your bank or Amazon, you did the most money-laundering-looking thing you could do. Heckuva job there!

Spriggan1313 2 years ago | |

I work in fraud detection in the US and the number of people that end up making their legit purchases look like fraud is way too high.

worik 2 years ago | | |

> I work in fraud detection in the US and the number of people that end up making their legit purchases look like fraud is way too high.

I don't think you meant it. But that is blaming the victim

A bit uncool

One of the main features of capitalism is you can dispose of your property as you like.

mickelsen 2 years ago | | |

ah, and that is our problem now? If I like to use my browser with uBlock, buying a gift card on a sunday 4am right, sharing data from my phone, different city and with my new laptop, it is still your problem for not letting it go through.

bryankaplan 2 years ago | | |

How do we solve that?

aiProgMach 2 years ago | |

hmm no, my bank is fine, Amazon customer service told me they won't accept my card, that was the only option, but excuse me, how is 100-200$ gift card is money laundering?

edmundsauto 2 years ago | | |

Buying gift cards with stolen credit cards is like fraud/money laundering 101. The amount is not really a differentiator either because a lot of carders will run smaller test transactions to see if the card is still active.

deepsun 2 years ago |

Well, you cannot blame companies from protecting their businesses, as long as you don't have to use them. Just use cash.

However, if that becomes problematic (like WeChat in China), then things go bad very quickly.

X6S1x6Okd1st 2 years ago | |

> it's hard to carry cash from my country (for "security" reasons, as most airports limit how much cash you can carry).

ChrisArchitect 2 years ago |

Tell HN:

CrendKing 2 years ago |

You do understand India is a country with huge number of scammers who targets US people, and they are causing US billions of dollars of damage [1] each year? Sure, you might not be a criminal, but how would these companies know? Plus, since you mention "gift card", you do know that scammers use gift cards to launder money, right?

India doesn't put heavy hammer on scammers for various reasons. For example, since the scammers are mostly targeting foreign countries, and Indian police are well known for accepting bribes from these scammers, the scamming business is de-facto welcomed. They are too short-sighted to not see that the "industry" is damaging India's global reputation, which transitively affects you in negative way. It's unfortunate, and hope the situation improves over the time.

[1] https://www.ftc.gov/news-events/news/press-releases/2023/02/...

tpmx 2 years ago |

A workaround (edit: in some of those cases): Setup a Tailscale exit node in the country where you're normally located - with a residential IP. E.g. in your apartment back home, or at a friend's.

aiProgMach 2 years ago | |

This might help in specific cases yes, but in case of websites that give physical services (e.g delivery of products) it won't help much

Mister_Snuggles 2 years ago | | |

In this case it might actually make it worse. Why are you suddenly, while in the US (for example), ordering physical services in India?

My bank locked my credit card once due to suspected fraud. I asked what triggered it and they said "You never buy gas on this card". This was 15 years ago and I'm sure the algorithms have only gotten better.

A different bank used to ask you to tell them if you were planning on traveling so that your card would continue to work, they stopped doing it and said that they had improved their fraud detection and this was no longer necessary. My guess is that they take the data provided by airlines[0] when you book a flight and use that to tell where and when you're traveling.

[0] https://www.marqeta.com/blog/data-details-what-is-level-1-2-...

agubelu 2 years ago | |

I have a Raspberry Pi at home running an OpenVPN server, and a client config for each of my devices, and it's been extremely useful ever since.

fishyjoe 2 years ago | | |

How do you expose the Raspberry Pi so that you can reach it from the outside internet?

My OpenVPN runs on a Digital Ocean droplet and I use it to tunnel into my home network, but having a direct route might be better.

maryfisherr6 2 years ago |

I just wanted to share this just incase anyone is in a situation where they don’t trust their partners anymore. There is no harm in wanting to know what your second half is into, it saves you from wasting more years of your life with people who do not deserve you. I will leave the hacker’s contacts below just incase anyone needs his services and assistance. Just a mail to remotespywise @gmil com.

matheusmoreira 2 years ago |

I sympathize with you. There should be no fraud prevention of any kind. They should just eat the cost without bothering us in any way.