Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detect breaches with Canary credit cards

blog.thinkst.com

Post reply on HN
Print view View original

101–110 of 158 posts

Re: Detect breaches with Canary credit cards

#101

Post by edarchis »

I've been trying to use this technique to alert banks (in Belgium where I live) of online fraud for a while but failed.

We are getting lots of phishing by text, email and hacked IMs. They use a bunch of redirections to get you to "login to your bank" with our security devices. In reality, they'll use MITM it and transfer money to some mules.

If we could have people fill in some canary bank account that would trigger a fraud alert at the banks, we could stop those payments a lot more easily.

The banks don't really seem to care because the payments are signed with the card and PIN of the owner, so they refuse to refund it. No loss to the bank, no action. :(

Re: Detect breaches with Canary credit cards

#102

Post by jddj »

vlabakje90 wrote: post #76
worble wrote: post #74

Earlier quoted context omitted.

It's also frankly absurd that no such service exists for European customers. I've been looking the past few days for someone who does something like this and it's just not available, for what I can only assume are regulatory reasons.

Revolut has single use credit cards as part of their offering. You can either choose to create a new one for each transaction (disposable card) or a virtual credit card that you can use more than once but discard if something happens to it. Because both types are virtual prepaid type cards, some services (e.g. car rental) will not accept such cards.

(Transfer)wise offers virtuals too, though not prepaid

Re: Detect breaches with Canary credit cards

#103

Post by asciimike »

lobstersammich wrote: post #91

Does anyone have a good alternative to Privacy.com where your virtual credit card transaction data isn't sold to Wall Street? If you're unfamiliar with what a "virtual [credit] card" is here's the page from Privacy.com's website: https://privacy.com/virtual-card I use the Privacy app on my mobile phone to create virtual cards (primarily for work subscriptions). Pro-tip: since each Privacy card can have its own name p…

> (1) Does anyone have a privacy-respecting alternative to Privacy.com's virtual credit cards?

Capital One offers virtual cards through Eno (https://www.capitalone.com/digital/eno/virtual-card-numbers/) that are merchant locked. They make it somewhat cumbersome to use, but I've really enjoyed using them.

It doesn't block wall street knowing about what you're buying, but at least it's likely got one (or more) fewer middlemen looking at all your transactions.

Re: Detect breaches with Canary credit cards

#104

Post by nebula8804 »

derefr wrote: post #82
lazide wrote: post #18

Earlier quoted context omitted.

Near as I can tell, a lot of the fraud is exploitation of the known and not yet solved ‘remote jurisdiction’ issue. When someone is far away, and in a different jurisdiction, it’s hard to track them down and do anything to them. Not likely to get better anytime soon, unfortunately.

And even if you can both track them down and hand evidence of wrongdoing on a silver platter to law enforcement in their jurisdiction, often the places these criminals operate out of were selected specifically because their justice system is corrupt and easily bribed. Often, these fraudsters can even talk local politicians into seeing their (cover) businesses as “important local industries, employing local citizens,…

The US has the power to really cause damage to India (and well any other country). They can cause a stink on the UN front and if that does not work, escalate financially like they do to countries like Iran. Its just not that important for the extremely old and corrupt leadership at the top to care about though. I suspect once someone from the internet generation takes the presidency, there will be some chance of something changing.

Re: Detect breaches with Canary credit cards

#105

Post by namibj »

jddj wrote: post #102
vlabakje90 wrote: post #76

Earlier quoted context omitted.

Revolut has single use credit cards as part of their offering. You can either choose to create a new one for each transaction (disposable card) or a virtual credit card that you can use more than once but discard if something happens to it. Because both types are virtual prepaid type cards, some services (e.g. car rental) will not accept such cards.

(Transfer)wise offers virtuals too, though not prepaid

Capped to 3 virtuals, though.

Re: Detect breaches with Canary credit cards

#106

Post by codetrotter »

europeanguy wrote: post #52

This idea has an obvious problem. It's a lot of hard work. How many people are going to be diligent in planting canaries etc? And if you are, can you be diligent for the next 1, 2, 3 decades? That's a lot of time spent on this. You know what would be better? If every bank provided as a service/feature the ability to create single-use (and single-merchant!) debit cards. Revolut can do it, why can't huge banks do it as…

> Revolut can do it, why can't huge banks do it as well?

FWIW, I use Revolut and am a fan of their service. However, the one time I tried to use the single-use feature it just didn’t work for some reason. So I had to enter my “permanent” card details instead in order to proceed with payment.

Re: Detect breaches with Canary credit cards

#107

Post by flutas »

teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

I'll give you a warning about them, they won't issue a chargeback for anything. Even blatant fraud. They'll give you a vague response about rules with their processor.

I used them for a purchase, the company then blatantly lied about everything (tweeted that "everyone's order was shipped" 2 weeks before I even got a tracking number).

They asked me for the following:

- Order receipts

- Email communication with the company

- Tracking numbers

- FedEx investigation (consumers can't open these, only the shipper)

I showed them the chat history with FedEx refusing to open a claim, and provided the other information.

They then proceeded to IMPERSONATE ME to FedEx live chat "to prove I was lying." The sent screenshots only showed them asking if a tracking number had been delivered, not any of the actual data around the tracking number.

Needless to say, I've never used them for anything again and post this everywhere I see them mentioned.

Re: Detect breaches with Canary credit cards

#108

Post by lazide »

nebula8804 wrote: post #104
derefr wrote: post #82

Earlier quoted context omitted.

And even if you can both track them down and hand evidence of wrongdoing on a silver platter to law enforcement in their jurisdiction, often the places these criminals operate out of were selected specifically because their justice system is corrupt and easily bribed. Often, these fraudsters can even talk local politicians into seeing their (cover) businesses as “important local industries, employing local citizens,…

The US has the power to really cause damage to India (and well any other country). They can cause a stink on the UN front and if that does not work, escalate financially like they do to countries like Iran. Its just not that important for the extremely old and corrupt leadership at the top to care about though. I suspect once someone from the internet generation takes the presidency, there will be some chance of some…

If they wanted to do so. But historically, India hasn’t been very aligned with the US. They’re more Russian aligned.

Re: Detect breaches with Canary credit cards

#109

Post by notpushkin »

jddj wrote: post #102
vlabakje90 wrote: post #76

Earlier quoted context omitted.

Revolut has single use credit cards as part of their offering. You can either choose to create a new one for each transaction (disposable card) or a virtual credit card that you can use more than once but discard if something happens to it. Because both types are virtual prepaid type cards, some services (e.g. car rental) will not accept such cards.

(Transfer)wise offers virtuals too, though not prepaid

For a more traditional banking, Estonia's LHV allows (seemingly) unlimited free virtual cards.

Re: Detect breaches with Canary credit cards

#110

Post by ed25519FUUU »

flutas wrote: post #107
teilo wrote: post #67

I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.

I'll give you a warning about them, they won't issue a chargeback for anything. Even blatant fraud. They'll give you a vague response about rules with their processor. I used them for a purchase, the company then blatantly lied about everything (tweeted that "everyone's order was shipped" 2 weeks before I even got a tracking number). They asked me for the following: - Order receipts - Email communication with the com…

I’ve been afraid of this because I’m pretty sure their protection level is the same as a debit card, which is to say nothing really.
Post reply on HN