How does Antifraud see carders?

[Lord777]

How do shop operators see us?​

The process of how the operator sees us from the shop side, using the example of The Sift Science Console.

The Sift Science Console consists of the following:

The number 1 denotes the so-called fraudscore (the number of fraud points scored), from 0 to 100, where 0-100% is not fraud, which is unlikely even for a cardholder, but what you need to strive for. And 100-100% fraud, they won't send you anything for sure.

Under the number 2, there is nothing interesting, the operator simply chooses whether we are a good or bad user + can add any comments.

Under the number 3 - the order (its number), IP, address, and distance on the map between billing and shipping.

Under the number 4 - more detailed information about the order.

Here it is already more interesting, under the number 5 we see Users per shipping name - users who used the same name. It's not a bad way to add froudscore. That is, in most shops, sending a single drop from different accounts is still not recommended.

Users per device - here you need to make a small digression towards canvas fingerprinting, which is essentially the" fingerprint " of your system. Canvas is not always used. The print can also be made up of other parameters that each shop chooses for itself.

Here is an example canvas fingerprinting https://www.browserleaks.com/canvas

Accordingly, users per device shows people with the same fingerprint as you, but in fact the picture may be different. Often there is a coincidence of fingerprints, for example, users of Mac, iPhone, etc. have the same fingerprints, because the hardware component, just like the browser, the system is the same. Similarly, if the list of parameters used to generate a fingerprint is small, then Windows, Linux, and Android users will also have a match.

My result with browserleaks.com

That is, a sufficient number of people have a similar fingerprint, and this is normal.

Next comes users per cookie - here it is clear, different accounts and cookies are the same, very bad.

Users per browser - ip users with the same IP address. Also very bad.

Billing/Credit card county match - matches the state specified in billing with the state that issued the card.

Shipping / Billing distance - no comments.

Users per shipping address - users who used a similar shipping address. As for mediums, it's a slightly different story.

Shipping name fraction vowels - the fraction of vowels in the name. To determine whether the name is spelled correctly. Yes, yes, the Americans are bothering about this.

User agent - our browser, OS, etc.

SHIPPING / BILLING zip match - matches of zip with billing and shipping, some stores are biased against this.

Transaction payment gateway - through which payment system the payment was made.

TRANSACTION SHIPPING ZIP - our ship's zip code

USERS PER BILLING ADDRESS - I don't think anyone will drive the same CC into the shop several times.

Credit card bank - if a bank is very often found on fraud's lists, it becomes biased. According to my assumptions, in the top shops there is a similar point about bins, that is, purchases from certain bins automatically go to fraud. (You can correct me, I'm not sure).

EMAIL SIMILARITY - the similarity of the e-mail with the cardholder name.

Point 7 essentially shows the user and all his fingerprint matches with other users. In this case, our "hero" matches 3 users at once, in all parameters, that is, he drove in from one central control center, from one system, from one cookie, but from different accounts.

By the way, I want to add a little more about Canvas Fingerprint, and why you should not use plugins that change it.

The principle of these plugins, fraudfox's, for the antique I will not say, I did not use it, is to unify canvas fingerprint, yes, of course, it succeeds.

However, the user becomes a white crow, so I advise you to vary the canvas fingerprint manually.:

Browser versions.

The browser itself, from chrome to firefox for example.

Operating system versions.

Fonts (office suite).

Plugins. Each of the first three parameters changes the fingerprint, the other two only in aggregate (not counting the language, timezone, screen resolution, color depth, etc. which make a very small contribution to the print and in fact it is unlikely to change)