Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Criminals can guess Visa number and security code in six seconds, experts find

independent.co.uk

Post reply on HN
Print view View original

61–70 of 166 posts

Re: Criminals can guess Visa number and security code in six seconds, experts find

#61

Post by baldeagle »

tyingq wrote: post #48
rcthompson wrote: post #26

Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen". Or maybe I'm just way too optimistic about how thi…

Sadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller. It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.

I'm sure the IRS and a number of other groups would love access to this data.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#63

Post by user5994461 »

cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

1) Pick a bank that gives expiration dates within 3 years. 60 => 36 combinations

2) Security codes are always 3 digits. I don't know why you think 4? 9999 => 999 combinations.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#64

Post by tyingq »

baldeagle wrote: post #61
tyingq wrote: post #48

Earlier quoted context omitted.

Sadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller. It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.

I'm sure the IRS and a number of other groups would love access to this data.

For the most part, the data is already centralized. It just isn't used for anti fraud measures that would help online merchants.

The cc companies and banks do leverage aggregated data when they are the ones that hold the bag....like card present transactions.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#65

Post by user5994461 »

tyingq wrote: post #48
rcthompson wrote: post #26

Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen". Or maybe I'm just way too optimistic about how thi…

Sadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller. It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.

> Any fraud is paid for by the merchant seller.

Not if the transaction uses 3D secure.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#66

Post by tyingq »

user5994461 wrote: post #65
tyingq wrote: post #48

Earlier quoted context omitted.

Sadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller. It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.

> Any fraud is paid for by the merchant seller. Not if the transaction uses 3D secure.

In the US, if you accept only 3D secure, you would go out of business. If made optional, it is a tiny percentage of sales.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#68

Post by Doctor_Fegg »

pvdebbe wrote: post #41
maemre wrote: post #25

A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites…

As a customer I hate these 2FA codes and online bank confirmations, common in the EU. I don't want to bring my bank passwords and whatnot with me if I want to make an online purchase with my CC!

Some banks appear to have lighter-touch 3D Secure than others. I switched to my current (UK) bank when my previous bank, HSBC, introduced a mandatory keypad for online banking: no way did I want to carry that around everywhere I might want to check my balance or transfer money. The bank I now use doesn't require a keypad for personal banking, nor a password for most 3D Secure transactions.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#69

Post by user5994461 »

hughw wrote: post #5

These attackers are probably brilliant enough to make their mark in the honest tech business world. I suppose they are driven by the challenge of the crime.

There are only a very few places in the world where you can get good jobs in tech: SV & NY...

If you're not American, you're screwed because you can't get to America legally. That leaves fraud as a very serious make-a-living option =)

Re: Criminals can guess Visa number and security code in six seconds, experts find

#70

Post by jamiesonbecker »

user5994461 wrote: post #63
cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

1) Pick a bank that gives expiration dates within 3 years. 60 => 36 combinations 2) Security codes are always 3 digits. I don't know why you think 4? 9999 => 999 combinations.

To your second point, AMEX uses 4 digit CVV's[1].

However, it's easy to tell the difference between an AMEX and a VISA/MC from the card number alone.

1. https://www.cvvnumber.com/

Post reply on HN