The underground world of credit card network exploitation
chargebackstop.com
The underground world of credit card network exploitation
1–10 of 280 posts
Re: The underground world of credit card network exploitation
#2Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SMS, phone app, ...)
Re: The underground world of credit card network exploitation
#3Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SMS, phone app, ...)
That’s not the case in US.
It’s kinda funny, but the only time Chase and Amex credit cards asked me for 2FA (I didn’t even know they had 2FA) was when I used them to purchase some things in Indian website through local payment provider (Razorpay).
Re: The underground world of credit card network exploitation
#4Why does the US still accept hand-typed cards?
My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up?
What's different about Europe that they seem to have figured this out decades ago?
Re: The underground world of credit card network exploitation
#5Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SMS, phone app, ...)
"banks (usually American ones) will happily accept transactions that have incorrect full name, invalid CVV / CVC, wrong expiration date, only partial billing address provided, with incorrect ZIP code.
All of the above is still not enough to trigger a 3D secure authorisation"
The solution indeed is to write manual rules to trigger 3D secure.
Re: The underground world of credit card network exploitation
#6Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?
> What's different about Europe that they seem to have figured this out decades ago?
Our governments actually care about monopolies and security. The PSD2 directive was an utter pain to deal with, but at least it stopped a lot of common scams and thefts in its tracks, and it forced banks and other payment actors to open up their system.
Re: The underground world of credit card network exploitation
#7Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?
Not sure I understand. Does everyone outside the US have a card reader attached to their PC and phone?
Re: The underground world of credit card network exploitation
#8Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?
It is just lobbying preventing good policy. If we moved to chip + pin, we'd get rid of almost 100% of CC fraud. But retailers don't want the friction so instead the consumer pays for the fraud instead.
Re: The underground world of credit card network exploitation
#9Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SMS, phone app, ...)
"banks (usually American ones) will happily accept transactions that have incorrect full name, invalid CVV / CVC, wrong expiration date, only partial billing address provided, with incorrect ZIP code. All of the above is still not enough to trigger a 3D secure authorisation" The solution indeed is to write manual rules to trigger 3D secure.
I’ve seen verified by visa triggered a few times for online purchases
Re: The underground world of credit card network exploitation
#10Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?
Not sure I understand. Does everyone outside the US have a card reader attached to their PC and phone?
Most people have an NFC reader at least built into their phone.