Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

5900 online stores found skimming

gwillem.github.io

Post reply on HN
Print view View original

91–100 of 104 posts

Re: 5900 online stores found skimming

#91

Post by nommm-nommm »

MrTonyD wrote: post #81
4ad wrote: post #33

Earlier quoted context omitted.

I am not liable for credit card fraud. The last thing in the world I want is inconvenience for me , when it's other people's money at risk (bank, merchant, CC company, whoever), not mine. On the other hand, Paypal itself is a liability. Blocking your account (and your money!) for months without recourse, randomly reducing expense limits to nothing (50 EUR) are not just some Internet stories, but things that have happ…

Some years ago I had a Bank of America credit card. My new card never arrived in the mail, and I discovered 3,000 in charges. When I reported it, Bank of America insisted that they had mailed me the card and that I was responsible for its use. I appealed, and they still insisted that I pay the bill. I don't know their logic - was it just some employees trying to increase profit - like Wells Fargo today? And what choi…

Now (post 2009) you can make a complaint to CFCB who I hear is really helpful and pro consumer but I don't have first-hand experience with them.

They are who fined Wells Fargo.

Re: 5900 online stores found skimming

#92

Post by hbcondo714 »

I'm surprised this article does not mention the use of virtual credit card numbers in their list of solutions. I use one-time / temporary card numbers with expirations and dollar limits from my issuer[1] for both online and over the phone transactions

[1] https://www.cardbenefits.citi.com/Products/Virtual-Account-N...

Re: 5900 online stores found skimming

#93

Post by _delirium »

jghn wrote: post #77
mrb wrote: post #59

Earlier quoted context omitted.

"I have zero liability on credit card purchases" Not quite right. Many banks make you liable for the first $50, for each occurrence of fraud. Also they typically require you to notice and report a fraudulent charge within 30-90 days or else you are liable for 100% of the amount.

The person said they have no liability, how is saying that many banks don't refuting what they said?

More specifically: U.S. law puts a $50 cap on consumer liability, but many credit cards voluntarily lower it to $0. The $50 is a ceiling, not a floor.

Re: 5900 online stores found skimming

#95

Post by initram »

hbcondo714 wrote: post #92

I'm surprised this article does not mention the use of virtual credit card numbers in their list of solutions. I use one-time / temporary card numbers with expirations and dollar limits from my issuer[1] for both online and over the phone transactions [1] https://www.cardbenefits.citi.com/Products/Virtual-Account-N...

I tried to do this with Citibank a few years ago and couldn't get it to work. I don't know if the issue was something in my browser, or what, but it just wouldn't generate the numbers for me. After that, I gave up. Maybe it works better now?

Re: 5900 online stores found skimming

#96

Post by initram »

the_mitsuhiko wrote: post #53

And this is exactly why I do not understand why there is such a huge opposition against 3D Secure. It prevents this exact issue. Card fraud on 3D Secure pages that are well implemented (2nd factor with SMS or hardware device token) is non existent.

Here in the US, users avoid Verified by Visa (which I believe is the same thing) because it moves the burden of fraud onto the end user. Whenever that VBV page comes up, I immediately abort. I don't trust companies to keep my card data safe, so if the burden is suddenly on me, I'll just go without whatever I was going to buy if I can't get it elsewhere. It's that big of a deal. This is before we even get to technical issues or the UI/UX flow.

Re: 5900 online stores found skimming

#97

Post by the_mitsuhiko »

initram wrote: post #96
the_mitsuhiko wrote: post #53

And this is exactly why I do not understand why there is such a huge opposition against 3D Secure. It prevents this exact issue. Card fraud on 3D Secure pages that are well implemented (2nd factor with SMS or hardware device token) is non existent.

Here in the US, users avoid Verified by Visa (which I believe is the same thing) because it moves the burden of fraud onto the end user. Whenever that VBV page comes up, I immediately abort. I don't trust companies to keep my card data safe, so if the burden is suddenly on me, I'll just go without whatever I was going to buy if I can't get it elsewhere. It's that big of a deal. This is before we even get to technical…

That's misinformation. It only shifts for 3d secure transactions work require another info that is not sent to your merchant. So the only way this fails if your bank had a bad 3d secure page or your fucked up.

Re: 5900 online stores found skimming

#98

Post by jerf »

nateberkopec wrote: post #67
jerf wrote: post #63

Earlier quoted context omitted.

I'm not sure what eval has to do with the specific problem, but you actually can nuke eval from your website in most browsers now with a header: https://en.wikipedia.org/wiki/Content_Security_Policy You could also prevent this problem in general with Content Security Policy, by whitelisting only the domains you know JS should come from. Then, even if they do in fact get a script tag on to your page pointing at a host…

In this case, since the attacker has access to the source code, they could easily disable a site's Content Security Policy.

"Raises the bar", I did say. They have access but if they're only accessing it through an automated system they may miss it.

Plus, I should have pointed out that CSP can be applied at higher layers, including nginx itself or a WAF, that the attacker may not be able to access or modify. I didn't think of it at the time.

Re: 5900 online stores found skimming

#99

Post by enraged_camel »

4ad wrote: post #61
Cyph0n wrote: post #54

Earlier quoted context omitted.

I'm assuming you ended up with no debit card for a few days at least. That's a huge inconvenience in my opinion.

No, because I have many debit cards from different banks in order to have redundancy and increase availability when the bank's system is down, or a particular card simply won't work at some merchant, but other will (usually happens in the US with my European cards).

The biggest risk of credit card data being stolen is not loss of money, but identity theft.

Re: 5900 online stores found skimming

#100

Post by the_mitsuhiko »

zrail wrote: post #60
the_mitsuhiko wrote: post #55

Earlier quoted context omitted.

Stripe does not use an iframe/redirect for protection.

Stripe Checkout is loaded in an iframe and stripe.js uses an iframe for data transmission.

I know, but the credit card information for stripe.js lives in an unprotected DOM.
Post reply on HN