141–150 of 158 posts
I use Stripe so this isn't much use to me, but looking at their other canary tokens I could see the AWS key canary being useful. https://docs.canarytokens.org/guide/
I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.
I use Privacy.com, which basically turns every card I use with them into a canary. The first time you charge on one of their virtual cards, they become merchant-locked. No other merchant can charge to that number, and if someone tries, I get an alert. I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.
Bank of America used to have this feature with virtual cards and I was using it a lot. They killed that service few years ago and I was really sad they did that. Not sure if other banks are offering virtual cards for free. I might give Privacy.com a try.
I use Stripe so this isn't much use to me, but looking at their other canary tokens I could see the AWS key canary being useful. https://docs.canarytokens.org/guide/
I think this service isn't aiming at individuals but at companies who want to know, sooner rather than later, if they've been breached (by storing Canary CC numbers either in with their actual CC numbers or on an internal honeypot).
Earlier quoted context omitted.
Its my understandingn that Visa does offer the service to banks, they just haven't implemented it. There is to my knowledge no regulatory red tape, it's just not seem as profitable. The banks here in Denmark har just less competitive and more entrenched than in the US
My Swedish bank (Swedbank) had this service from some time in the 00's up until 2017 when they discontinued it. So they were way ahead of the game but for some reason dropped it.
Earlier quoted context omitted.
It's also frankly absurd that no such service exists for European customers. I've been looking the past few days for someone who does something like this and it's just not available, for what I can only assume are regulatory reasons.
Its my understandingn that Visa does offer the service to banks, they just haven't implemented it. There is to my knowledge no regulatory red tape, it's just not seem as profitable. The banks here in Denmark har just less competitive and more entrenched than in the US
Earlier quoted context omitted.
I’ve been afraid of this because I’m pretty sure their protection level is the same as a debit card, which is to say nothing really.
That‘s really no longer true for most debit cards these days. Issuers can process disputes for debit and credit cards in the exact same way (at least for transactions on Visa and Mastercard, i.e. practically for all online payments). Higher tier credit cards often have additional insurance that goes beyond what the chargeback mechanism is designed for, though, but for fraud, you shouldn’t need these.
And if it's international dispute raised after 14 days you might get no where.
Earlier quoted context omitted.
Well to be honest Honey Tokens is being used since beginning of the 2000s, https://en.wikipedia.org/wiki/Honeytoken . I personally implemented them in a Bank, 20 years ago, generating some fake credit cards number (and other information) and having them being monitored in AV, IDS, IPS, Antifraud solutions like browser extensions, google search and etc.. So maybe we can say that I'm a random infosec nerd, but i guess,…
How would the operator of an ecommerce website have gotten their hands on these things to seed their data with them? Is this something they would've known to ask for?
Very interesting tool. I'm going to write the canary CC onto a physical card and swipe it first when shopping. If I ever see it randomly accessed, I'll know my 2nd card (actual payment card) is burnt. >Credit Card Rate-Limiting currently in place. Please try again later. Maybe tomorrow.
Hmmm … I like the idea but my hunch was that disposable card numbers would fail at POS because the network knows that card should never have been issued physically? If you run this experiment, would you do a tell HN ?