Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Criminals can guess Visa number and security code in six seconds, experts find

independent.co.uk

Post reply on HN
Print view View original

121–130 of 166 posts

Re: Criminals can guess Visa number and security code in six seconds, experts find

#121

Post by jpatokal »

BillinghamJ wrote: post #104
jpatokal wrote: post #103

Earlier quoted context omitted.

Citation needed. I have an AMEX in my wallet and it does not have any codes on the back, nor have I ever been asked for one.

It does - there is a 3 digit number on the back in the signature strip. The Amex website will ask you for it if you attempt to change your phone number, amongst other similar high-risk transactions.

Not on mine there isn't. This may be a US-only thing?

Some discussion, which doesn't shed a whole lot of light though: https://insideflyer.com/forums/threads/what-is-the-3-digit-c...

Re: Criminals can guess Visa number and security code in six seconds, experts find

#122

Post by curun1r »

politician wrote: post #105
adrr wrote: post #91

Earlier quoted context omitted.

I designed the fraud prevention for a major ecommerce site(PCI Level 1). We used to get hit with lots of card testing including bot nets. They are easily mitigated. First thing is detune your error messages. Combine all the errors into one generic message. This includes AVS, CVN, and Expiration. I've see so many sites return the raw message back from the processor. We also actively black holed large blocks IP address…

Regarding error messages: At a previous gig, we had to aggressively and repeatedly fight the business side who thought that vague credit card error messages were a large source of user confusion. Eventually, we won but it was certainly an eye-opening moment for the developers involved to even have to fight that battle.

I've had the same argument many times over error messages for login and forgot password flows. Being security conscious is a way of thinking that many people aren't really capable of and an even greater number have problem maintaining consistently. It's so ingrained in product managers to make their software as friendly as possible that they forget that sometimes their users don't have similarly noble intentions. This is also why social engineering is so successful. When it's your job to be helpful, it's very difficult to be strategically unhelpful when necessary.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#123

Post by kctess5 »

caf wrote: post #94
StephanTLavavej wrote: post #88

Earlier quoted context omitted.

Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100…

Guessing 100 numbers, there's a chance to produce 2 or more hits, of course. ..to the point that the expected value should converge to the same amount, right?

The expected value of both strategies is to have 1 success, but they have different variance. The first strategy has variance of 0.99, and the second strategy has variance 0. The chance of n out of 100 hits with the first strategy is: binomial(100,n) x 0.01^n x 0.99^(100-n)

edit: asterisks as multiplication signs => italics

Re: Criminals can guess Visa number and security code in six seconds, experts find

#124

Post by saurik »

jpatokal wrote: post #103
Terretta wrote: post #81

Earlier quoted context omitted.

For AMEX, there's still a 3 digit CSC code on the back which you will need from time to time. The 4 digit code on the front is their CID, asked for by most merchants.

Citation needed. I have an AMEX in my wallet and it does not have any codes on the back, nor have I ever been asked for one.

The Apple Store (as in, the actual brick and mortar establishment) started using the 3-digit code on the back of my American Express card at some point instead of the 4-digit one at the front (but they are so far the only company I have personally run into which does that).

Re: Criminals can guess Visa number and security code in six seconds, experts find

#125

Post by ctrl-j »

aquadrop wrote: post #95
ctrl-j wrote: post #72

Earlier quoted context omitted.

> I'd bet that almost all don't have three numbers all the same and that there are probably more rules/conventions that would reduce the search space. You're correct that almost all don't have three identical digits, but that's just because there's only 10 of them - 000, 111, 222, 333, 444, 555, 666, 777, 888, 999 10/1000 = 1% I doubt they would make up rules for determining the cvv, as it would only improve security…

I think they can be same, but they always > 99 (at least I never saw a card with CVV starting with 0)

A coworker of mine thought the same. Parsed the string into an int - we saw a bunch of cards get declined by our gateway processing company. They definitely can have leading zeroes.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#126

Post by dawnerd »

adrr wrote: post #118
politician wrote: post #105

Earlier quoted context omitted.

Regarding error messages: At a previous gig, we had to aggressively and repeatedly fight the business side who thought that vague credit card error messages were a large source of user confusion. Eventually, we won but it was certainly an eye-opening moment for the developers involved to even have to fight that battle.

Score your users based on attributes like whats in cart, IP reputation, browser/os, pages visited, source,3rd party fraud detecton providers etc. Score should reflect how likely the user is genuine or not. For well scoring users which should be 90% of your traffic, provide them with detailed messages.

I wish sites like newegg would treat customs with successful transactions as safe. I've had many times where they've outright canned an important order for really no reason. Trying to get them to accept it is a whole other hassle.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#127

Post by napoleond »

burfog wrote: post #117
user5994461 wrote: post #69

Earlier quoted context omitted.

There are only a very few places in the world where you can get good jobs in tech: SV & NY... If you're not American, you're screwed because you can't get to America legally. That leaves fraud as a very serious make-a-living option =)

SV and NY are not the best places to go once you consider quality of life. Better choices: San Antonio, TX Provo, UT Huntsville, AL Melbourne, FL Nashua, NH Salt Lake City, UT Charleston, SC Arlington, VA Alexandria, VA Wichita, KS These are places with greater freedom. Most of them are less crowded and less expensive, usually by a huge amount.

LMAO

>> If you're not American, you're screwed because you can't get to America legally.

> [proceed to list a bunch of American cities]

Re: Criminals can guess Visa number and security code in six seconds, experts find

#128

Post by ian0 »

adrr wrote: post #91
preinheimer wrote: post #12

So criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge. Merchants doing everything they can need better protection from this crap.

I designed the fraud prevention for a major ecommerce site(PCI Level 1). We used to get hit with lots of card testing including bot nets. They are easily mitigated. First thing is detune your error messages. Combine all the errors into one generic message. This includes AVS, CVN, and Expiration. I've see so many sites return the raw message back from the processor. We also actively black holed large blocks IP address…

Its opposite in my experience. Detuning error messaging will increase abandonment as users wont know how to recover from errors (Eg invalid CVV) - thereby decreasing revenue. Its especially true where something like 3D secure is in use and failure messages varied.

Ive also never seen risk based authentication based on MID in place at issuers (Im in SEA it could be different in more developed markets). Rather they have blanket bans on MID or categories of MID with high fraud-to-sales ratios. Payments processors and acquirers have fraud detection systems, but they will score not actively decline.

So while someone abusing your service may land you in hot water, reducing their ability doesn't necessarily mean a higher authorization rate for regular transactions.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#129

Post by ForFreedom »

If you total the credit card numbers for any particular card the answer would be the same. For example: totaling the visa credit card number might be 32. The hackers would have to guess the 3 set of numbers if they get the fourth set.

So my guess is they would try out different combination with the available expiry date/cvv number

Re: Criminals can guess Visa number and security code in six seconds, experts find

#130

Post by ian0 »

lisper wrote: post #106

Securing the current protocol for credit card transactions is completely hopeless. It is inherently insecure because the "secret" information used to authorize a transaction is not bound to that transaction, and so it's reusable. Even if you were able to secure the system against brute-force attacks like this one, you can never secure against phishing. The only way to fix it is to change the protocol to one that reli…

EMV tokens and virtual card numbers attempt to mitigate against the re-use factor. 3D secure adds a layer of auth to the regular method (at some expense).

There is a large infrastructure (acceptance, processing, acquiring, clearing, issuing) running on card numbers so the solutions mentioned above all attempt to build on top of them as oppose to replace them with something better. As the logistics of doing so tend to be prohibitive.

Post reply on HN