Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detect breaches with Canary credit cards

blog.thinkst.com

Post reply on HN
Print view View original

151–158 of 158 posts

Re: Detect breaches with Canary credit cards

#151

Post by lxgr »

jameshart wrote: post #140
lxgr wrote: post #137

Earlier quoted context omitted.

To charge payments to customers? Yes, in many cases you can have your payment service provider store that data for you, but sometimes that's impracticable.

Interested in exactly when it becomes impractical. Personally I'm prepared to go to quite an extraordinary amount of effort to make sure PANs and cardholder data never comes near any system I am responsible for. Honestly shocked by how much pushback I've had on this on this thread. I feel like I made a fairly innocuous comment that, essentially, was just suggesting that it's probably best practice to avoid storing cu…

> Interested in exactly when it becomes impractical.

Having multiple payment service providers, for example (or the plan to do so in the near future).

Another example would be complex legacy systems (especially in the travel segment, constellations between various service providers get complex quickly).

> I'm prepared to go to quite an extraordinary amount of effort to make sure PANs and cardholder data never comes near any system I am responsible for.

No objections there :)

> you can't actually handle payments without storing CC numbers.

Now you're putting up a straw man. It's definitely not impossible, but in some circumstances, it can be very hard.

Also, somebody will have to store the PANs in a database in the end, even if it's just the payment service providers themselves. There are much less payment service providers than merchants out there, but by the same logic, that makes them a much more valuable goal for attackers.

Re: Detect breaches with Canary credit cards

#152

Post by lxgr »

psychphysic wrote: post #147
lxgr wrote: post #122

Earlier quoted context omitted.

That‘s really no longer true for most debit cards these days. Issuers can process disputes for debit and credit cards in the exact same way (at least for transactions on Visa and Mastercard, i.e. practically for all online payments). Higher tier credit cards often have additional insurance that goes beyond what the chargeback mechanism is designed for, though, but for fraud, you shouldn’t need these.

The biggest issue is that with a debit card you don't get that spending power back during the process. And if it's international dispute raised after 14 days you might get no where.

> with a debit card you don't get that spending power back during the process.

At least for consumer debit cards, that's not the case. Regulation E requires provisional credits (until the investigation and/or chargeback process is complete) in essentially all instances of fraud.

> And if it's international dispute raised after 14 days you might get no where.

Where do you get that number from?

At least in the US, federal law limits liability for lost and stolen cards to $50 (when reported within two business days) or $500 (within 60 days after receiving your statement). For non-lost/stolen cards, which covers all online fraud (due to stolen card numbers, compromised merchants etc.), there is no such time limit, as far as I know.

And these are just the legal caps on consumer liability: Most issuers go far above and beyond that, and extend zero liability for effectively all scenarios, just like for credit cards.

Re: Detect breaches with Canary credit cards

#153

Post by remram »

whstl wrote: post #9
remram wrote: post #4

Those are free? Wouldn't those cost them something to create or operate?

This is a late-2000s story but: I once worked for a small-time credit card emitter and the only money leaving us was the money from the transactions themselves. It was quite interesting, AFAIK we had a range of CC numbers that we could use, and we had to "answer" to an API call (a "lower-level webhook", it wasn't HTTP) that provided all the user data for verification, and we had to authorize in a maximum amount of ti…

Very interesting! Given the fees charged to sellers, I assumed that Visa/MasterCard/... would tax the banks as well.

Re: Detect breaches with Canary credit cards

#154

Post by b3morales »

davchana wrote: post #127
b3morales wrote: post #69

Earlier quoted context omitted.

Capital One does still have these: https://www.capitalone.com/digital/eno/ though caveat the feature is only available via a browser plugin, I assume because they want to be able to scrape your shopping habits/history in the process.

Now its available through their own app, and if/once you save actual card in Google Chrome, its directly available from Chrome in any credit card box. No need of Eno now.

Oh, thanks for the info!

Re: Detect breaches with Canary credit cards

#155

Post by eastbayjake »

jameshart wrote: post #140
lxgr wrote: post #137

Earlier quoted context omitted.

To charge payments to customers? Yes, in many cases you can have your payment service provider store that data for you, but sometimes that's impracticable.

Interested in exactly when it becomes impractical. Personally I'm prepared to go to quite an extraordinary amount of effort to make sure PANs and cardholder data never comes near any system I am responsible for. Honestly shocked by how much pushback I've had on this on this thread. I feel like I made a fairly innocuous comment that, essentially, was just suggesting that it's probably best practice to avoid storing cu…

> Interested in exactly when it becomes impractical

A couple examples where the Stripe model and scale of tokenization breaks down today:

- You're an airline and you need to have a digital wallet that stores payment details so you can buy your ticket on web, upgrade your seat on mobile, and buy a drink in-flight using the flight attendant's POS device

- You sell a product at high-risk of chargebacks that is not permitted by the major tokenization providers' terms-of-service (there are some surprises here that rule out several Fortune 100 use cases!)

- You're a $10B+ retailer where the difference between a 2.9% payment processing cost and a 1.6% payment processing cost pays for an entire team of people to focus on minimize processing costs by routing different payments to different gateways depending on fees (eg American Express goes one place, Visa goes another)

Now: if you are a mom-and-pop scale DTC shop selling only via web, you should probably be taking advantage of tokenization instead of storing credit card data yourself!

The PCI-DSS council does give guidance on how you handle credit card information securely when you cannot use a tokenization approach, and a lot of it boils down to what we'd consider foundational software engineering practices. (Don't let engineers have access to production data! Rotate your credentials periodically! Log events and maintain those logs so they can be audited!) It does increase your costs, complexity, and talent needs but it's also not an antipattern and there is relatively straightforward guidance on how to do so securely.

Re: Detect breaches with Canary credit cards

#156

Post by psychphysic »

lxgr wrote: post #152
psychphysic wrote: post #147

Earlier quoted context omitted.

The biggest issue is that with a debit card you don't get that spending power back during the process. And if it's international dispute raised after 14 days you might get no where.

> with a debit card you don't get that spending power back during the process. At least for consumer debit cards, that's not the case. Regulation E requires provisional credits (until the investigation and/or chargeback process is complete) in essentially all instances of fraud. > And if it's international dispute raised after 14 days you might get no where. Where do you get that number from? At least in the US, fede…

You know I've no idea where I got 14 days from. But I'm not US based and the last time I disputed something was in the EU at the start of the pandemic.

I'm probably entirely wrong!

Re: Detect breaches with Canary credit cards

#157

Post by kalleboo »

fragmede wrote: post #145
kalleboo wrote: post #121

Earlier quoted context omitted.

My Swedish bank (Swedbank) had this service from some time in the 00's up until 2017 when they discontinued it. So they were way ahead of the game but for some reason dropped it.

Was it a flash applet? Moving the tech forwards wasn't something Bank of America could manage to do, so they shut down their version (Shopsafe).

On the web it was a flash applet but they had an iPhone app as well
Post reply on HN