Slashdot Mirror
A New Approach To Reducing Spam: Go After Credit Processors
WrongSizeGlass writes "A team of computer scientists at two University of California campuses has been looking deeply into the nature of spam, and they think found a 'choke point' [PDF] that could greatly reduce the flow of spam. It turned out that 95 percent of the credit card transactions for the spam-advertised drugs and herbal remedies they bought were handled by just three financial companies — one based in Azerbaijan, one in Denmark and one in Nevis, in the West Indies. If a handful of companies like these refused to authorize online credit card payments to the merchants, 'you'd cut off the money that supports the entire spam enterprise,' said one of the scientists."
Frequent Slashdot contributor (and author of a book on Digital Cash) Peter Wayner wonders if "the way to get a business shut down is to send out a couple billion spam messages in its name."
So, they will just open new credit card processors, or worse yet, start spamming random websites to get them shut down? Great way to take your competitor down.
Indicating there are still other companies willing to process these transactions. The spammers will just switch to them if the 'big 3' refuse to do business with them.
I've never understood why not, when a computer can generate millions of spam ads for viagra, that another computer cannot generate millions of (fake) orders for the viagra.
Gently reply
The study identified 3 top payment-processors for spam sites. Surely these processors aren't the weak link; their business model is to process payments for spammers. You can't simply ask them not to process spam payments - there is a financial disincentive for them to do so.
We could move one rung up the ladder, and ask Visa and Mastercard not to authorize any paments to these top-3 processors. However, we've just "widened" the narrowest point, plus, these companies have a financial incentive to grin and pass the buck. Maybe less so; I'd be interested in the number of consumers who later try to contest these payments, but I'm willing to bet that dealing with fraction of unhappy customers now is less expensive than the net amount the credit cards pull in while processing these shady payments. Otherwise, Visa would have done something by now.
If a handful of companies like these refused to authorize online credit card payments to the merchants
You suggest that as if this specific activity was not these people's business model. A credit processor in Azerbaijan doesn't just one day decide to start processing spam purchases, they open their business specifically for that purpose. Good luck getting them to switch business models just because you want them to.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
This approach is already being used against the "evil pirates", but they haven't even gotten started on the spammers. Getting their priorities straight: they go after the teenagers sharing music first instead of the real criminals sending out phishing emails, viruses and shit like that. FTW.
It's against the law to send the spam. Visa is aiding and abetting the crime by handling the transfer payments from US banks to the foreign banks through its payment network. If this study is accepted, it will be hard for them to deny accurate and full knowledge of their role in the crime. Each link in the financial chain is explicitly aware of nature of the transaction, save the originating bank in the US.
I don't believe it is a simple thing to set up a new credit card processor, at these scales. Doesn't Visa have to authorize each credit card processor? Spammers won't be able to create credit card processors on the same scale as their URL creation. Visa has solid statistics on processor creation now. They can watch for skews to understand unusual new processor applications.
Visa should be running a constant program of low-level buys from spammers, tracing the transactions through, just like these researchers did. Visa would then have complete and accurate data on the pipeline, and they could shut it down completely.
Unless they don't want to, of course. Which is exactly true. The only thing that will force it to happen is legislation.
I'm one of the MANY coauthors of this paper. Myself or others will try to answer questions in this thread.
Test your net with Netalyzr
( ) You read the paper
(X) You did not read the paper
The paper specifically covers merchant relationships with acquiring banks and credit processing. Purchases were done to track the credit processing. It isn't possible to anonymously spoof that. Also, stopping the transactions is more legislative than market-based.
They already refuse to process payments to Wikileaks.
However, whoever wrote this summary got one thing wrong at the end. A "Joe Job" - sending out fake spam to smear someone you dislike - is useless.
I submitted the story but did not write the following:
Frequent Slashdot contributor (and author of a book on Digital Cash) Peter Wayner wonders if "the way to get a business shut down is to send out a couple billion spam messages in its name."
The above was added by the editor. The article and linked PDF are about cutting off the payment processing for those selling the "spammed" products in order to indirectly reduce the amount of spam. They are not about going after companies who send the spam (either under their own name or those of others).