Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Criminals can guess Visa number and security code in six seconds, experts find

independent.co.uk

Post reply on HN
Print view View original

41–50 of 166 posts

Re: Criminals can guess Visa number and security code in six seconds, experts find

#41

Post by pvdebbe »

maemre wrote: post #25

A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites…

As a customer I hate these 2FA codes and online bank confirmations, common in the EU. I don't want to bring my bank passwords and whatnot with me if I want to make an online purchase with my CC!

Re: Criminals can guess Visa number and security code in six seconds, experts find

#42

Post by throwaway2016a »

mannykannot wrote: post #16
avh02 wrote: post #2

hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.

This does not require hindsight - it is literally the first thing you would ask about in an audit of the system's security. The real issue is what it says about the competence of the people running these systems.

Source? Do you audit credit card security systems or are in a related industry?

I personally tend to air on the side of NOT assuming people I have never met working on a problem I have never had to try to solve (and therefor may not see all the complexity) are incompetent.

I find it way more likely they are competent it is just a problem that is significantly more complex when dealing with the kind of big-data volume they do than it would be on a smaller scale.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#43

Post by quickben »

preinheimer wrote: post #12

So criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge. Merchants doing everything they can need better protection from this crap.

Merchant gets charge backs, and back when I used to run a small online business, these were $25 a pop. Any kind of "online protection tools" would reduce the fraud by a bit , but nothing eliminates it.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#45

Post by swiley »

mataug wrote: post #44

Another one of those technologies which hasn't kept up with the evolving tech landscape.

It's pretty unfortunate that there is absolutely no federated, popular, and secure payment system in the US due to consumers and merchants simply sticking with older systems simply because "it's what we've always done."

Re: Criminals can guess Visa number and security code in six seconds, experts find

#46

Post by sirn »

vxNsr wrote: post #31
maemre wrote: post #25

A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites…

Visa has this for large (ie >$1000) transactions. But I'm not sure if every online merchant is set up to make it work...

This is most likely the merchant choose to enable 3-D Secure for large transactions so they're not liable for frauds.

3-D Secure flow is separate from the normal authorization flow and require the merchant (or payment gateway) to set it up. The merchant (or the gateway) is required to build or purchase an MPI from an approved vendors to make it work.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#47

Post by sirn »

acomjean wrote: post #20

I'm no means on expert on this, but having delt a little with online transactions from testing responses from a payment processor. The things that needed to match also involved the customers street address, zip and name. If I recall these were scored and if the match wasn't good (zip was entered wrong) the transaction was rejected. Maybe different payment processors have different thresholds for rejecting a transacti…

My memory is fuzzy, but I believe this depends on an issuers and acquirers. There are acquirers who do not check for anything but card number, expiration date and optionally CVC. And there are issuers who do not have AVS (address verification) support, which I think is almost all issuers outside the States.

Most modern payment gateways will enforce CVC check, and require the name to be present, though.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#48

Post by tyingq »

rcthompson wrote: post #26

Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen". Or maybe I'm just way too optimistic about how thi…

Sadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller.

It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#49

Post by aianus »

MichaelBurge wrote: post #37
hibikir wrote: post #29

Earlier quoted context omitted.

Transaction processors also face fines if the dispute percentage is too high. They don't have forbidden business lists just because they don't like pornography or sex toys. They can also be defrauded by merchants too: Make a fake business, make some fake purchases to yourself and after you get your money, disappear. Then a financial institution is the one holding the bag. That said, it's absolutely true that an onlin…

> They don't have forbidden business lists just because they don't like pornography or sex toys. Those are "high-risk" mainly because of "reputational risk", not because of chargebacks. Which I imagine is code for Visa or the banks thinking "If too many people with traditional morals get into political office, they'll start cracking down on us if we do business with the sex toy companies." https://en.wikipedia.org/wi…

ACH still has chargebacks. For up to six months after the debit, no less.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#50

Post by mannykannot »

throwaway2016a wrote: post #42
mannykannot wrote: post #16

Earlier quoted context omitted.

This does not require hindsight - it is literally the first thing you would ask about in an audit of the system's security. The real issue is what it says about the competence of the people running these systems.

Source? Do you audit credit card security systems or are in a related industry? I personally tend to air on the side of NOT assuming people I have never met working on a problem I have never had to try to solve (and therefor may not see all the complexity) are incompetent. I find it way more likely they are competent it is just a problem that is significantly more complex when dealing with the kind of big-data volume…

Actually, I have worked on the development of security software, but if you want a source, I suggest you start with the work of the researchers mentioned in the article.

Among the facts there, you can find that Mastercard is apparently capable of detecting these guessing attempts, so as we are on the subject of sources, what is your source for your suggestion that this is an insurmountable volume-related problem?

You have a point about not casually attributing incompetence, but this does seem to be a particularly facepalm-inducing issue. I am willing to be corrected.

Post reply on HN