Someone thinks Grandcentral should be criminalized

Original post is here


…Companies like Grand Central should be put out of business – they pose a threat to every online merchant who accepts credit cards.

By offering a service where you can get a phone number in any US city and that furthermore you can receive and send calls from your real phone that are routed through that number they have made the best fraud checking tool, call verification, essentially useless…

My reply on his post:

Your wrong in some aspects.

The Merchant when verifying the card number with the credit card company in online transactions can verify the phone number matches to what’s tied to the account. If the merchant decides not to utilize this functionality and verification it’s their own fault.

You can (and have for a couple decades) been able to purchase a voicemail box anywhere in the world for a couple dollars a month and usually the voicemail has it’s own unique number. Most of these services also offer call forwarding.

Finally the largest gap in your theory that you is the cell phone market – I can literally go to Wal-Mart and pick up a disposable cell phone today for 15.00 that comes with 60 minutes of talk time.

If you want to criminalize grandcentral for their behavior you have to take into account this other avenues for performing the same fraud in the same method.

The cost of entry is very low and I can say that I have never gotten a call from any online merchant I a have dealt with in my 13 years on the Internet. I have however gotten a couple bounce backs where a charge going through where my phone number didn’t match what the credit card company had on file for me.


His response

Creeva – you have some good points. However I work in the data center business as sales manager for a large data center. Roughly 40% of all server orders are attempted frauds. I have a lot of tricks up my sleeve for determining order authenticity, most of which I won’t discuss for obvious reasons, but this is going to hurt us. Not all frauds are CC – many are stolen PayPal accounts and there’s no way to check phone numbers on those. Not all banks use full authentication on the cards – they don’t require the address/phone number to match their records when the card is processed just name, number and PIN. Hell, even some of the foreign banks (our customer base is world wide) don’t even use a PIN (CVV) on the cards. In general it is only North American banks (and not all of them) that require the details to match.

My follow-up:

So you feel the barrier to entry from a offering a service such as this by making it free (though you still need a phone to verify to grandcentral) would be drastically different from hard core fraudsters (I hate that term but applicable) over a 15 dollar cell phone?

I guess it would depend on the type of fraud and or the amount that you are working with whether that few dollars could make a difference.

The problem really is more on the credit cards company side for not enforcing these security audits.

One thing retailers could do to help offset this (and google may actually give you this data versus data that ties a customer to their private data) is to have them give you the phone exchanges they utilize their pools of addresses from.

This work by picking new/underutilized/never utilized exchanges in a zip code. So you know if they use the exchange 541-256-XXXX or 789-986-XXXX that these are utilized by google or farmed out to SIP providers for similar things – this would allow you to blacklist address blocks on your side.

This allows people to maintain their privacy since the information is only aggregate. They can make the choice if they wish to shop with you if you won’t accept it. You can blacklist the exchanges you don’t wish to accept. If disposable cell phones use the same technique (I’m next to positive alot of them are in these same blocks that grandcentral is using) it would correct that issue also.

While this would not be foolproof and 100% it actually would give your company significantly better trust then it has right now.

So where do I send the consulting bill to :P

Theoretically in an afternoon you could get about 70-90% of the exchanges that grandcentral uses and have them added to your blacklisted do not call database.


His final reply:

Alas the consulting bill will have to wait ;) This is a strategy we are already contemplating if Google will release that information as I alluded to in the post. Somehow I doubt they will but perhaps they will see it as yet another way to monetize their investment in those blocks.

You wouldn’t necessarily lose those potential customers – you could make it clear that GC and free cell phones will not be accepted but most of those individuals, the honest ones at least, have the real number they can provide, the one that GC forwards to and from that they can provide if they want the service.

I think we’ve now beat this horse to death.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.