Some thoughts on hit/note validation

[-STAR-]

Hello!

Having read some stories, like "Why is a hit moderated" and the endless "Faker" stories among
many others, I was thinking about how the EBT site could check if a given note is genuine or not.

The answer for me would be a more rigorous check of the printer code. Unfortunately,
this seems to be quite a challenge in general and a big problem checking in real time
during note entry in particular.

Some countries, like my home country Austria, have a system where the note printers "map"
some part of the printer code to some other part of the serial number, but most countries
do not seem to have such "mappings". So checking _every_ single note during entry does
not seem feasible to me. At least not now.

However, if an entered note turns out to be a hit, there could be some more stringent checks
on the printer code. As far as I know, the printer code of a hit note is not checked in any way
at the moment. This is one weakness that opens the door for fakers.

My suggestion would be the following:
If an entered note turns out to be a hit, do not immediately display the "it is a hit!" message,
but check the printer code first. Check it against the printer code that was entered by the other
user involved in the hit (or all other users in case of a multi-hit). If the printer code matches,
display the "it is a hit!" message. If not, ask the user to verify the printer code. If he enters
the same printer code again, accept it anyway, but put a note somewhere in the database
(and/or send the admins a notification mail) with the discrepance.

Summary:
If a hit note is entered correctly and the hit partner has also entered the correct printer code,
nothing changes to the current behaviour. If there is a typo in the printer code, the user has
the possibility to correct it. If the hit partner entered the wrong short code in the first place,
at least the entering user and an admin are alerted that something is wrong and should
be corrected.

And if a faker enters "dummy" or "stolen" serial numbers (mostly consecutive serials)
and one of the bills turns out to be a hit, he has to confirm the notes' printer code (which
is boring at least, especially if there are more hits involved) and should rise attention soon.
This would also make it less attractive to just enter serial numbers found on web sites, in
newspapers or any other public places, because usually the printer code is not published
with such serial numbers and the entering user has to "invent" some printer code,
which will at least be detected, if the note turns out to be a hit, which is highly possible
in case of published note data.

Of course it would be even better to have some advanced syntax check on the printer code
(if that is possible at all) and/or check every single note entered (which may very likely pose
some kind of performance problems).

Just my EUR 0,02...
Franz

[klapotec]

My suggestion would be the following:
If an entered note turns out to be a hit, do not immediately display the "it is a hit!" message,
but check the printer code first. Check it against the printer code that was entered by the other
user involved in the hit (or all other users in case of a multi-hit). If the printer code matches,
display the "it is a hit!" message. If not, ask the user to verify the printer code. If he enters
the same printer code again, accept it anyway,

As far as I know, that is exactly how it's done already.

but put a note somewhere in the database
(and/or send the admins a notification mail) with the discrepance.

Don't know about that, however.

Of course it would be even better to have some advanced syntax check on the printer code

One planned functionality of my "NIG for Linux" is to be able to easily check one's own short code/serial number combinations for possible typos/discrepancies (I just want to be able to correct old typos) - that will rely heavily on heuristics and already availabe data, but for e.g. German notes there is so far as I know no way to check whether the character+digit at the end of the short code is or is not correct given the serial number.

[JP Simões]

Of course it would be even better to have some advanced syntax check on the printer code (if that is possible at all) and/or check every single note entered (which may very likely pose some kind of performance problems).

1. New combinations are constantly being created, which means the check might be outdated at one point or the other;
2. I recall reading a message by avij in which he stated he'd rather not have this to give fakers no clue of correct short code combinations;
3. Admins have access to the whole database anyway.

[avij]

Unfortunately the short code isn't THE magic bullet for preventing all fake hits, there are various other ways to make fake hits where checking the shortcode wouldn't help.

My suggestion would be the following:
If an entered note turns out to be a hit, do not immediately display the "it is a hit!" message,
but check the printer code first. Check it against the printer code that was entered by the other
user involved in the hit (or all other users in case of a multi-hit). If the printer code matches,
display the "it is a hit!" message. If not, ask the user to verify the printer code. If he enters
the same printer code again, accept it anyway,

As far as I know, that is exactly how it's done already.

Slightly incorrect -- this is how it has worked in the past, but nowadays the possibly incorrect short code is simply accepted to the database as is but an error message about the incident is logged for the admins. This change was made because the verification message was found confusing for some users, and paradoxically, to prevent fake hits. I don't want to go into detail why exactly this change was made, but this was a conscious decision. Both the shortcodes are kept in the database, so they can be compared later on if needed. You'll also get the other user's shortcode if you download your hit CSV.

but for e.g. German notes there is so far as I know no way to check whether the character+digit at the end of the short code is or is not correct given the serial number.

Sure there is. It might not be as obvious as for other notes, but having a few million German notes in our database certainly helps us in figuring out the shortcode calculation methods.

See also:

As always I can't and don't want to comment this case of faking, simply to not give fakers a hint of which patterns and criteria we're looking at.

As such, I'd be really tempted to lock this topic, although this is certainly an interesting topic.. We (Nerzhul and I) have seen quite a lot of various cheating attempts, and we've gathered quite a few methods to detect fakers. We'd rather not discuss those methods in public, though. If you really must, feel free to PM either me or Nerzhul with your ideas.

[-STAR-]

Unfortunately the short code isn't THE magic bullet for preventing all fake hits, there are various other ways to make fake hits where checking the shortcode wouldn't help.

I'm sure there are and I'm glad, that there is some background check to the short code, when a hit occurs.

You'll also get the other user's shortcode if you download your hit CSV.

I know. Though you have to manually look through the hit CSV for short code discrepancies yourself.

[...about short code logic]
Sure there is. It might not be as obvious as for other notes, but having a few million German notes in our database certainly helps us in figuring out the shortcode calculation methods.

I know Elmo has knowledge about most if not all combinations and how to check if a given serial number/
short code combination is feasible or not. For some countries/printers, I have found out the rules myself,
but for other countries, especially Germany and France, there just seems to be no logic to connect the two.

As such, I'd be really tempted to lock this topic, although this is certainly an interesting topic.

Feel free to close the topic; I didn't mean to interfere with your current and future anti-faker measures.
Sorry if I messed up your strategies.

Franz

[klapotec]

but for e.g. German notes there is so far as I know no way to check whether the character+digit at the end of the short code is or is not correct given the serial number.

Sure there is. It might not be as obvious as for other notes, but having a few million German notes in our database certainly helps us in figuring out the shortcode calculation methods.

OK, no easy way to check...

If you really must, feel free to PM either me or Nerzhul with your ideas.

Concerning my tool, I certainly will, soon.