Criminals can guess Visa number and security code in six seconds, experts find • Hacker News Board

Re: Criminals can guess Visa number and security code in six seconds, experts find

#141

Post by ian0 » Mon, Dec 05, 2016, 8:06 AM UTC

politician wrote: post #105

adrr wrote: post #91

Earlier quoted context omitted.

I designed the fraud prevention for a major ecommerce site(PCI Level 1). We used to get hit with lots of card testing including bot nets. They are easily mitigated. First thing is detune your error messages. Combine all the errors into one generic message. This includes AVS, CVN, and Expiration. I've see so many sites return the raw message back from the processor. We also actively black holed large blocks IP address…

Regarding error messages: At a previous gig, we had to aggressively and repeatedly fight the business side who thought that vague credit card error messages were a large source of user confusion. Eventually, we won but it was certainly an eye-opening moment for the developers involved to even have to fight that battle.

There are tradeoffs, you have to balance security with usability. Generic payments failure messages are responsible for a lot of frustration in users, especially users who are paying online for the first time and have to go through complicated payments processes like 3D secure.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#142

Post by seanp2k2 » Mon, Dec 05, 2016, 8:07 AM UTC

tyingq wrote: post #89

mjevans wrote: post #79

Earlier quoted context omitted.

I wonder how much of "Item Not Received" is due to poor transport security, like delivering the item to someone's 'property' but just leaving it outside, unattended and unsecured.

That's part of it. The chargeback system is a complete joke, however. I had one guy that I was very suspicious about, so I hired a PI to see if the item was visible in his small business, and take a picture. The tracking number showed the item delivered to the person, signed for with an known employee's name. I submitted this, as well as a picture of the item in the guy's shop. I still lost the chargeback. Got my rev…

First off, what a jerk, glad you got your money back. Second though, too bad you can't sue for damages in time wasted stressing out about this and having to file a lawsuit + likely do some research. Hopefully it was at least a few grand to make it worth your time. Hopefully also you appealed the first chargeback decision, which I'm guessing took at least a month or two.

Some people just seemingly think of creative ways to screw other people for fun, or because they figure no one will stop them.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#143

Post by seanp2k2 » Mon, Dec 05, 2016, 8:11 AM UTC

tyingq wrote: post #64

baldeagle wrote: post #61

Earlier quoted context omitted.

I'm sure the IRS and a number of other groups would love access to this data.

For the most part, the data is already centralized. It just isn't used for anti fraud measures that would help online merchants. The cc companies and banks do leverage aggregated data when they are the ones that hold the bag....like card present transactions.

Yep, it would cost them to implement and maintain, and they have no financial incentive to do so. It's not like they have a brand to ruin either; everyone already hates them, but Visa and MasterCard run the US market (and much of the global market), so they can do whatever they want to consumers without fear of backlash / loss of business.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#144

Post by CmdrSprinkles » Mon, Dec 05, 2016, 9:01 AM UTC

seanp2k2 wrote: post #135

mamon wrote: post #134

That's why you should enable two factor authentication on your credit card: online transactions would require confirmation with single-use password you receive by SMS.

What cards allow this? I would do it in a second if that was a thing I could actually have. Not 100% foolproof but I'd bet it would stop almost all fraud.

Not aware of any cards specifically (outside of European chip-and-pin, but I don't think those usually work online), but this is the big argument for things like android/apple/firebomb pay.

Make a purchase, then sign off on your phone (or fingerprint reader on your laptop).

It obviously won't resolve the issue posed in the article, but it is definitely a step in the right direction and many of the major CC companies are integrating more and more. In five or six years I can easily see Chase and the like giving an option to only let the physical card be used in chip-and-pin mode and to require the use of an approved service for any contactless/online orders.

Obviously the approved services thing is a concern, but not a huge one.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#145

Post by BillinghamJ » Mon, Dec 05, 2016, 9:51 AM UTC

jpatokal wrote: post #121

BillinghamJ wrote: post #104

Earlier quoted context omitted.

It does - there is a 3 digit number on the back in the signature strip. The Amex website will ask you for it if you attempt to change your phone number, amongst other similar high-risk transactions.

Not on mine there isn't. This may be a US-only thing? Some discussion, which doesn't shed a whole lot of light though: https://insideflyer.com/forums/threads/what-is-the-3-digit-c...

All of my UK Amex cards have it.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#146

Post by BillinghamJ » Mon, Dec 05, 2016, 9:52 AM UTC

tyingq wrote: post #115

BillinghamJ wrote: post #108

Earlier quoted context omitted.

The actual way you do it in reality is to trigger it for a small percentage of high risk transactions. My company uses Ravelin for this - we feed them lots of data, they do some kind of machine learning, and they feed us back a recommendation. Depending on what recommendation we receive, we either let the transaction through without 3DS, block it completely, or only allow it with 3DS.

I assume though, that you're still losing some number of conversions to legitimate customers that don't want to deal with 3DS.

A few, but it's a very small percentage, and the monetary loss of not requiring 3DS in these cases far outweighs the lost sales.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#147

Post by mamadrood » Mon, Dec 05, 2016, 11:17 AM UTC

mamon wrote: post #134

That's why you should enable two factor authentication on your credit card: online transactions would require confirmation with single-use password you receive by SMS.

I don't know if you're talking about the 3-D Secure / Verified by Visa system, but the major flaw of this technology is that the merchant is the only one responsible for putting it up or not.

I used to work in e-commerce and my company simply disabled the SMS protection because it would harm sales and the platform would sometimes completely crash.

On the other hand there is no way (that I know of) that I, as a customer, could prevent my card being used in non secured websites. So this system makes legitimate purchases harder and doesn't prevent fraud.

We need a different technology than credit card for online payments, they are not secured enough and any layer of security that we add around them won't work.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#148

Post by lmm » Mon, Dec 05, 2016, 12:01 PM UTC

dawnerd wrote: post #126

adrr wrote: post #118

Earlier quoted context omitted.

Score your users based on attributes like whats in cart, IP reputation, browser/os, pages visited, source,3rd party fraud detecton providers etc. Score should reflect how likely the user is genuine or not. For well scoring users which should be 90% of your traffic, provide them with detailed messages.

I wish sites like newegg would treat customs with successful transactions as safe. I've had many times where they've outright canned an important order for really no reason. Trying to get them to accept it is a whole other hassle.

Vote with your wallet. I don't think this is common behaviour.

Re: Criminals can guess Visa number and security code in six seconds, experts find

#149

Post by lmm » Mon, Dec 05, 2016, 12:03 PM UTC

erikpukinskis wrote: post #77

tzs wrote: post #53

Earlier quoted context omitted.

The merchant is not just left holding the bag. The merchant has to buy the bag...and it is not a cheap paper or plastic bad. It is a fancy, expensive, designer bag. When a charge is disputed, the merchant pays a fee of typically $15-30, regardless of who wins the dispute. In other words, there are two possible outcomes to a dispute: 1. Merchant loses. Merchant refunds in full that amount of the charge plus $15-30 for…

> Worse, the merchant does not appear to be able to really know when payment from a credit card is actually final. This is why I find it strange when people wring their hands over Bitcoin's 10 minute settlement window... Credit card transactions are regularly open for weeks if not months!

But I can buy a coffee with my credit card without having to wait weeks or months to get it. This works because people have faith in the system, faith which in turn is built on identity information and legal systems. You could probably achieve the same thing on top of Bitcoin, but at that point why bother with Bitcoin (and the cost is nontrivial)?

Re: Criminals can guess Visa number and security code in six seconds, experts find

#150

Post by pablovidal85 » Mon, Dec 05, 2016, 1:32 PM UTC

TheDong wrote: post #110

ryanlol wrote: post #10

Earlier quoted context omitted.

The data you'd gain from this is practically useless to anyone looking to commit fraud... so laugh at the article I guess? Maybe you could abuse this to create a lot of netflix accounts, but you aren't really going to be able to buy anything with just the PAN/cvv/expiry.

https://purse.io/ is a website for committing fraud with stolen credit cards. It's a website that specializes in letting criminals convert credit card details (PAN/cvv/expiry) into bitcoin while exposing them to minimal risk. There are very real ways to commit such fraud.

Not really, purse.io does not facilitate fraud more than Amazon itself does. Purse.io just connects people who are willing to buy bitcoin using Amazon gift cards for a premium, and those that would like to purchase products on Amazon using bitcoin.