Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Criminals can guess Visa number and security code in six seconds, experts find

independent.co.uk

Post reply on HN
Print view View original

131–140 of 166 posts

Re: Criminals can guess Visa number and security code in six seconds, experts find

#131

Post by tgsovlerkhgsel »

maemre wrote: post #25

A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites…

Fortunately, merchants and banks have realized that requiring 3-D Secure results in an abandoned shopping card.

I rarely use my CC online. Asking me for my 3-D Secure password means asking me to log into my bank and use a physical second factor to set a new password.

Likewise, requiring 3-D Secure on my credit card makes me much more likely to pick a different payment method since I don't feel like doing the above. (Or rather, I might not even be carrying the phone/token needed for it.)

Seems like someone has figured this out. I haven't seen a 3-D Secure prompt in a while.

There's also no reason for me to like it: Without 3-D Secure, fraud is a minor hassle and I'll get my money back. With it, the bank may try to put the responsibility on me, even though I can't distinguish a real 3-D Secure page from a phishing page because they're all IFRAMEd per their official recommendations.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#132

Post by ian0 »

swiley wrote: post #45
mataug wrote: post #44

Another one of those technologies which hasn't kept up with the evolving tech landscape.

It's pretty unfortunate that there is absolutely no federated, popular, and secure payment system in the US due to consumers and merchants simply sticking with older systems simply because "it's what we've always done."

There are many parties that would gain from a better payments system.

However the logistics of improving it are significant due to the number of highly regulated and kinda-fat and kinda-happy entities running the infrastructure.

Interestingly what has happened in India and China (success of non-bank payment wallets VS cards) is injecting a lot of the traditional players with a sense of urgency. Before this it would have taken a states intervention (Eg MEPS in Sing/MY) to improve acceptance through the launch of a new payments system.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#133

Post by flukus »

Mz wrote: post #90
cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

there are only 10⁴ = 10,000 four-digit security codes possible Yeah, that's not a big number, even manually, much less for a hacker. I went to school for two months and the TV in my dorm room had been locked down to a few channels by some parental security crap, presumably by a previous occupant. With nothing better to do, I manually went through codes until I found the right one and unlocked it to open up more chann…

> Yeah, that's not a big number, even manually, much less for a hacker.

But how many false attempts do you have to make before the suspicious activity is picked up? At one a day you probably aren't going to get it right.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#135

Post by seanp2k2 »

mamon wrote: post #134

That's why you should enable two factor authentication on your credit card: online transactions would require confirmation with single-use password you receive by SMS.

What cards allow this? I would do it in a second if that was a thing I could actually have. Not 100% foolproof but I'd bet it would stop almost all fraud.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#136

Post by seanp2k2 »

tzs wrote: post #30
cs702 wrote: post #7

There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future). Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few…

You generally don't even need to get the right expiration date. As long as the date you supply is in the future it will usually work. The security code also can sometimes be skipped. This varies from region to region, but in the US the credit card companies do not actually require a security code match for card not present transactions. The merchant can supply the code, and if so, the credit card processing system wi…

I think it also varies by processor, but I'm not sure on that one. One particular jerk merchant accepted my order for a few hundred dollars worth of car parts, then told me that he would only ship to my billing address. When I told him no and explained that my mail gets frequently stolen at that address, which is why I wanted my order shipped to the other address, he refused to cancel my order, and told me I'd need to call my bank to add the other address before he could ship my stuff.

At this point, he had not charged my card. I told him that if he did charge my card, I would file a chargeback. He charged it, I charged back, waited 2 months, and got a letter saying the chargeback was finalized and my refund was no longer "pending". Idiot cost himself probably 6% of the transaction both running it and paying for processing the refund, plus got a bad mark with his merchant account. He did all of this because he thought my transaction was fraud since the billing and shipping address didn't match (yet he refused to cancel it and charged it anyway).

Gas stations also verify billing zip.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#137

Post by seanp2k2 »

contingencies wrote: post #82
closeparen wrote: post #73

Earlier quoted context omitted.

No, there's an analogue of the CVV2, the CVV1, which is only present on the magnetic stripe. The information you'd get from an online transaction is not enough to print a working magstripe.

There are still offline processors that don't read magstripe and just take a copy of the card and a signature.

Yep, ever have a merchant enter your CC number on the keypad IRL? That's what's happening. The fees for these types of transactions are typically higher as your processor is assuming more risk, so they prefer to only do them when they need to. See https://www.mastercard.us/content/dam/mccom/en-us/documents/... if you're really curious about how this stuff works in the MasterCard case. Visa is similar AFAIK.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#138

Post by seanp2k2 »

Cyph0n wrote: post #23
ryanlol wrote: post #10

Earlier quoted context omitted.

The data you'd gain from this is practically useless to anyone looking to commit fraud... so laugh at the article I guess? Maybe you could abuse this to create a lot of netflix accounts, but you aren't really going to be able to buy anything with just the PAN/cvv/expiry.

Game gifts on online stores, such as Steam, are a common target.

Apple Store gift cards are another which are popular with scammers and fraudsters for whatever reason. I'm curious now what that reason is.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#139

Post by SocratesV »

acomjean wrote: post #20

I'm no means on expert on this, but having delt a little with online transactions from testing responses from a payment processor. The things that needed to match also involved the customers street address, zip and name. If I recall these were scored and if the match wasn't good (zip was entered wrong) the transaction was rejected. Maybe different payment processors have different thresholds for rejecting a transacti…

Believe that the address validation only checks the numbers present in the address, not the rest of the text, at least that was what I read in some gateway's documentation. Imagine the level of what they check may vary.

This is of course if the merchant/gateway even cares about that level...

Re: Criminals can guess Visa number and security code in six seconds, experts find

#140

Post by SocratesV »

maemre wrote: post #25

A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites…

3-D Secure doesn't always requests a 2FA code sent to your phone.

Most that I've used are fixed passwords (and they ask you for the character at certain positions) while others will ask you for personal information that is rather easy to obtain.

This is at least my experience. From the handful of cards I've used from different banks, only 1 used to send me a code via SMS.

(this was in the UK)

Post reply on HN