A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites…
Criminals can guess Visa number and security code in six seconds, experts find
31–40 of 166 posts
Re: Criminals can guess Visa number and security code in six seconds, experts find
#32Earlier quoted context omitted.
More importantly, an "honest" living as a developer probably makes them pennies compared to online fraud.
you will be surprised :)
Re: Criminals can guess Visa number and security code in six seconds, experts find
#33hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.
Matercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card processors could detect it; if you pick sufficiently broad set of web site to test with the chances of them sharing a server that could detect something is probably low.
I would think that they flag if a card is attempted a lot of times in short time span.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#34Earlier quoted context omitted.
Isn't that (almost) 1000? All numbers between 001 and 999?
For any valid card number yes. I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. http://m.wolframalpha.com/input/?i=count+of+permutations+of+...
Re: Criminals can guess Visa number and security code in six seconds, experts find
#35Earlier quoted context omitted.
Isn't that (almost) 1000? All numbers between 001 and 999?
For any valid card number yes. I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. http://m.wolframalpha.com/input/?i=count+of+permutations+of+...
Re: Criminals can guess Visa number and security code in six seconds, experts find
#36Earlier quoted context omitted.
Isn't that (almost) 1000? All numbers between 001 and 999?
For any valid card number yes. I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. http://m.wolframalpha.com/input/?i=count+of+permutations+of+...
Re: Criminals can guess Visa number and security code in six seconds, experts find
#37So criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge. Merchants doing everything they can need better protection from this crap.
Transaction processors also face fines if the dispute percentage is too high. They don't have forbidden business lists just because they don't like pornography or sex toys. They can also be defrauded by merchants too: Make a fake business, make some fake purchases to yourself and after you get your money, disappear. Then a financial institution is the one holding the bag. That said, it's absolutely true that an onlin…
Those are "high-risk" mainly because of "reputational risk", not because of chargebacks. Which I imagine is code for Visa or the banks thinking "If too many people with traditional morals get into political office, they'll start cracking down on us if we do business with the sex toy companies." https://en.wikipedia.org/wiki/Operation_Choke_Point
There's also some bad history with old porn sites, since they used 0-days to install dialers on people's computers to rack up tons of money when they used their dialup to connect to the internet. Hence the old "I think my computer has a virus", "Quit browsing those weird porn sites" retort you may have heard. They did other shady things which got Visa in a bit of trouble. It doesn't happen much anymore, but I suspect the organizational scars remain.
You've insinuated that pornography or sex toys are often "forbidden" because they have a high chargeback rate. But if you have 0 chargebacks after a few years, you still won't be able to negotiate a lower rate or to use a service like Paypal or Stripe. Because chargebacks aren't the reason.
Visa and MasterCard charge you $500/year each as an extra fee too, so I suspect the Stripes and Paypals of the world can't combine them into their aggregate account. A fee like that would seem to preclude even a specialized aggregate account, without a special agreement with Visa.
Also, if chargebacks were the issue, I would expect companies that only take debit cards to be in a different risk category than those that take credit cards. Debit cards have reduced fraud protection, so a Paypal or Stripe's underwriting should be more lenient for them. But I've never heard of Stripe letting you sell porn or of Visa waiving the fee if you only take debit cards. It could just be uncommon though.
Plus, I believe both Paypal and Stripe ban selling porn even using e-checks, which is more evidence against chargebacks being the issue. There shouldn't be any restrictions on the ACH system, and even if there usually were somebody could set up a state credit union in Oregon or similar to handle it.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#38hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.
This does not require hindsight - it is literally the first thing you would ask about in an audit of the system's security. The real issue is what it says about the competence of the people running these systems.
Re: Criminals can guess Visa number and security code in six seconds, experts find
#39Re: Criminals can guess Visa number and security code in six seconds, experts find
#40A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites…
Unless this is the case, having 3-D Secure only benefits merchants as the liability will now be shifted from the merchant to the cardholder (e.g. the cardholder is now liable for fraud) while the (stolen) card can still be used for a non 3-D Secure payments.