Live data from Hacker News

I’ll Take 2 MasterCards and a Visa, Please

krebsonsecurity.com

11–20 of 22 posts

Re: I’ll Take 2 MasterCards and a Visa, Please

#11
Am I the only one who finds it shocking that it's apparently so cheap and easy to buy stolen credit cards? Why are the law enforcers (or the banks, or other appropriate organizations) not going after these "re-sellers", atleast to find/track the original thieves?

Or am I missing something? Are these cards all (or mostly) deactivated? And so the buyers are not using them directly, and rather using them as leads/information to do some other nefarious activity?

Re: I’ll Take 2 MasterCards and a Visa, Please

#12
post #11

Am I the only one who finds it shocking that it's apparently so cheap and easy to buy stolen credit cards? Why are the law enforcers (or the banks, or other appropriate organizations) not going after these "re-sellers", atleast to find/track the original thieves? Or am I missing something? Are these cards all (or mostly) deactivated? And so the buyers are not using them directly, and rather using them as leads/inform…

> Why are the law enforcers (or the banks, or other appropriate organizations) not goiging after these "re-sellers", atleast to find/track the original thieves?

Um, who says they're not?

Re: I’ll Take 2 MasterCards and a Visa, Please

#13
Wait a minute... there's a website advertising stolen credit cards for $1.50, and the author is complaining that they tacked on an extra 0.60 fee?

I'm pretty sure this article was written with tongue firmly in cheek, but it's just so... out there.

I dare the author to make this $2.10 purchase using one of his own valid credit cards.

Re: I’ll Take 2 MasterCards and a Visa, Please

#14
post #11

Am I the only one who finds it shocking that it's apparently so cheap and easy to buy stolen credit cards? Why are the law enforcers (or the banks, or other appropriate organizations) not going after these "re-sellers", atleast to find/track the original thieves? Or am I missing something? Are these cards all (or mostly) deactivated? And so the buyers are not using them directly, and rather using them as leads/inform…

> Why are the law enforcers (or the banks, or other appropriate organizations) not goiging after these "re-sellers", atleast to find/track the original thieves? Um, who says they're not?

I know someone who works for an insurance company that covers credit card and identity fraud. They are actively monitoring these sites for their costumers information. Even though that's a private company, I wouldn't be surprised if government organisations do the same.

Re: I’ll Take 2 MasterCards and a Visa, Please

#15
post #11

Am I the only one who finds it shocking that it's apparently so cheap and easy to buy stolen credit cards? Why are the law enforcers (or the banks, or other appropriate organizations) not going after these "re-sellers", atleast to find/track the original thieves? Or am I missing something? Are these cards all (or mostly) deactivated? And so the buyers are not using them directly, and rather using them as leads/inform…

These organizations are based out of countries with corrupt governments, where law enforcement from the rest of the world can't easily reach. You can track a credit card peddler to Russia, but you can't do much about them there.

Re: I’ll Take 2 MasterCards and a Visa, Please

#16
post #14

Earlier quoted context omitted.

> Why are the law enforcers (or the banks, or other appropriate organizations) not goiging after these "re-sellers", atleast to find/track the original thieves? Um, who says they're not?

I know someone who works for an insurance company that covers credit card and identity fraud. They are actively monitoring these sites for their costumers information. Even though that's a private company, I wouldn't be surprised if government organisations do the same.

And following LeCarré, I could easily envision some entities searching for and holding certain of these acquired credit card numbers in reserve, should there be a need to charge p*rn or some financially questionable charges onto those account holders they care to call into question.

Re: I’ll Take 2 MasterCards and a Visa, Please

#17

Wait a minute... there's a website advertising stolen credit cards for $1.50, and the author is complaining that they tacked on an extra 0.60 fee? I'm pretty sure this article was written with tongue firmly in cheek, but it's just so... out there. I dare the author to make this $2.10 purchase using one of his own valid credit cards.

Hmm..I wonder if there is a way to charge the $2.10 to the card that you are purchasing.

Re: I’ll Take 2 MasterCards and a Visa, Please

#18
This is a direct consequence of the global near-real-time credit card payment authorization system being the Biggest Ball of Mud design you can imagine. Clearly, at each and every stage of getting to where we are now, people did the bare minimum of change to add new functions to the system.

The other aspect of the problem is the length of time the NSA sat on public key encryption. It's within the realm of possibility for credit card companies to have used public key encryption to at least validate that the human user of a card number knew something, a PIN or whatever, related to the card number. The payment authorization system grew up without that math, so it pretty much depends on everyone (like the call center reps or the programmers of shopping cart software) keeping the card number and the CID/CVC/CVV secret and off their disks.

Re: I’ll Take 2 MasterCards and a Visa, Please

#19
post #18

This is a direct consequence of the global near-real-time credit card payment authorization system being the Biggest Ball of Mud design you can imagine. Clearly, at each and every stage of getting to where we are now, people did the bare minimum of change to add new functions to the system. The other aspect of the problem is the length of time the NSA sat on public key encryption. It's within the realm of possibility…

What does public key encryption have to do with it? Password or pin + salt + hash function like MD5/SHA would be all it takes to securely verify that the CC holder knew a secret.

Re: I’ll Take 2 MasterCards and a Visa, Please

#20

Wait a minute... there's a website advertising stolen credit cards for $1.50, and the author is complaining that they tacked on an extra 0.60 fee? I'm pretty sure this article was written with tongue firmly in cheek, but it's just so... out there. I dare the author to make this $2.10 purchase using one of his own valid credit cards.

Totally and completely tongue-in-cheek. Check out his work in the Washington Post.
Post reply on HN