Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Criminals can guess Visa number and security code in six seconds, experts find

independent.co.uk

Post reply on HN
Print view View original

101–110 of 166 posts

Re: Criminals can guess Visa number and security code in six seconds, experts find

#101

Post by belovedeagle »

aquadrop wrote: post #96
erikpukinskis wrote: post #75

Earlier quoted context omitted.

They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.

But that means you have pretty low conversion rate. You have 1000 numbers of stolen cards, and you only going to get 10 of them? It reduces profitability substantially. And even 100 attempts is enough to mark card as stolen if bank is watching it.

They don't need to steal a card at all to do this. They're just guessing random numbers — everything after the issuer/cardtype numbers (first 5 or 6). So there's nothing to convert, and they only try a particular card number a few times.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#102

Post by fjarlq »

The paper:

Ali, Mohammed Aamir and Arief, Budi and Emms, Martin and van Moorsel, Aad (2016)

Does The Online Card Payment Landscape Unwittingly Facilitate Fraud?

IEEE Security & Privacy

http://eprint.ncl.ac.uk/file_store/production/230123/1918024...

Re: Criminals can guess Visa number and security code in six seconds, experts find

#103

Post by jpatokal »

Terretta wrote: post #81
jamiesonbecker wrote: post #70

Earlier quoted context omitted.

To your second point, AMEX uses 4 digit CVV's[1]. However, it's easy to tell the difference between an AMEX and a VISA/MC from the card number alone. 1. https://www.cvvnumber.com/

For AMEX, there's still a 3 digit CSC code on the back which you will need from time to time. The 4 digit code on the front is their CID, asked for by most merchants.

Citation needed. I have an AMEX in my wallet and it does not have any codes on the back, nor have I ever been asked for one.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#104

Post by BillinghamJ »

jpatokal wrote: post #103
Terretta wrote: post #81

Earlier quoted context omitted.

For AMEX, there's still a 3 digit CSC code on the back which you will need from time to time. The 4 digit code on the front is their CID, asked for by most merchants.

Citation needed. I have an AMEX in my wallet and it does not have any codes on the back, nor have I ever been asked for one.

It does - there is a 3 digit number on the back in the signature strip. The Amex website will ask you for it if you attempt to change your phone number, amongst other similar high-risk transactions.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#105

Post by politician »

adrr wrote: post #91
preinheimer wrote: post #12

So criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge. Merchants doing everything they can need better protection from this crap.

I designed the fraud prevention for a major ecommerce site(PCI Level 1). We used to get hit with lots of card testing including bot nets. They are easily mitigated. First thing is detune your error messages. Combine all the errors into one generic message. This includes AVS, CVN, and Expiration. I've see so many sites return the raw message back from the processor. We also actively black holed large blocks IP address…

Regarding error messages: At a previous gig, we had to aggressively and repeatedly fight the business side who thought that vague credit card error messages were a large source of user confusion. Eventually, we won but it was certainly an eye-opening moment for the developers involved to even have to fight that battle.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#106

Post by lisper »

Securing the current protocol for credit card transactions is completely hopeless. It is inherently insecure because the "secret" information used to authorize a transaction is not bound to that transaction, and so it's reusable. Even if you were able to secure the system against brute-force attacks like this one, you can never secure against phishing. The only way to fix it is to change the protocol to one that relies on public-key cryptography and secure digital signatures.

http://blog.rongarret.info/2013/02/a-simple-solution-to-cred...

Re: Criminals can guess Visa number and security code in six seconds, experts find

#107

Post by BillinghamJ »

hanoz wrote: post #54

I find it impossible to believe distributed enumeration of card numbers via ecommerce sites was used to defraud 9000 Tesco customers over a weekend.

The article stated that Tesco weren't protecting against distributed card testing because they didn't track failures on the same card across different merchants. Thus I think it would be very plausible.

The people running the scam would choose a specific IIN/BIN known to suffer from this problem.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#108

Post by BillinghamJ »

tyingq wrote: post #80
maemre wrote: post #25

A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites…

>almost none of the American sites supported it There's just not much incentive to support it. You have to make it optional, otherwise your conversion rate drops like a rock. And, if you make it optional, only a very tiny amount of customers ever use it...and the ones that do are VERY unlikely to be fraudulent users. Thus, the shift in liability isn't really an incentive. The only way it would work would be to make i…

The actual way you do it in reality is to trigger it for a small percentage of high risk transactions.

My company uses Ravelin for this - we feed them lots of data, they do some kind of machine learning, and they feed us back a recommendation.

Depending on what recommendation we receive, we either let the transaction through without 3DS, block it completely, or only allow it with 3DS.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#109

Post by BillinghamJ »

tyingq wrote: post #51
acomjean wrote: post #20

I'm no means on expert on this, but having delt a little with online transactions from testing responses from a payment processor. The things that needed to match also involved the customers street address, zip and name. If I recall these were scored and if the match wasn't good (zip was entered wrong) the transaction was rejected. Maybe different payment processors have different thresholds for rejecting a transacti…

For US based transactions, AVS failures (address, zip) don't typically fail the transactions. Most often, the api has 3 possible return values "Success", "Success With Warnings" and "Failure". The "Success with Warnings" will have some error codes for AVS failures (street address, zip). Usually the same for invalid CVV2. I've also noticed that cardholder name matching isn't universally supported...AMEX does it well,…

Only Amex has the ability to check the cardholder name. Visa & Mastercard don't pass this data to the issuer.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#110

Post by TheDong »

ryanlol wrote: post #10
cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

The data you'd gain from this is practically useless to anyone looking to commit fraud... so laugh at the article I guess? Maybe you could abuse this to create a lot of netflix accounts, but you aren't really going to be able to buy anything with just the PAN/cvv/expiry.

https://purse.io/ is a website for committing fraud with stolen credit cards.

It's a website that specializes in letting criminals convert credit card details (PAN/cvv/expiry) into bitcoin while exposing them to minimal risk.

There are very real ways to commit such fraud.

Post reply on HN