Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

31–40 of 280 posts

Re: The underground world of credit card network exploitation

#31

Earlier quoted context omitted.

I’ve seen verified by visa triggered a few times for online purchases

... Which is hell if you're in a country where your sim card doesn't work and your bank requires sms 2fa.

Then it's a good thing that many banks in the EU now have 3DSecure validation through the phone app instead of SMS

Re: The underground world of credit card network exploitation

#32

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

Article author here. I carefully reviewed and tested the ChatGPT scripts before executing them. It helped me save a lot of time manually writing these scripts!

I wouldn't say I lack technical expertise in this area, I'm just trying to use my time as efficiently as possible.

Re: The underground world of credit card network exploitation

#33

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

> I created a restricted key in Stripe with lowest possible permissions, and prompted ChatGPT to create a script to accept the chargebacks.

From my understanding, it also seems that the author submitted a Stripe API key alongside the prompt to create the scripts. This is pretty much a big security no no regardless of the permissions of the key.

Re: The underground world of credit card network exploitation

#34

Re: Chargeback fees - Visa acquired a company called Verifi a few years back. Their new products are Rapid Dispute Resolution (RDR) and Order Insight. RDR effectively lets you automatically refund a transaction before it gets turned into a chargeback and Visa charges a $4 fee (Assuming your MCC code is not high risk). Order insight lets you provide certain data about a questioned charge immediately and if the custome…

Article author here. Really valuable stuff, thanks for sharing!

Do you handle this for Mastercard in any way? I've heard of Ethoca (they are really good at SEO), it seems quite similar to Verifi.

Re: The underground world of credit card network exploitation

#35

Earlier quoted context omitted.

I’ve seen verified by visa triggered a few times for online purchases

... Which is hell if you're in a country where your sim card doesn't work and your bank requires sms 2fa.

My US bank requires SMS 2FA and SMS works for free because I am connected to Wifi. I have VoWiFi enabled. My US phone plan is with a budget carrier I only pay $15 a month for voice, sms, and data.

Re: The underground world of credit card network exploitation

#36

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

> I created a restricted key in Stripe with lowest possible permissions, and prompted ChatGPT to create a script to accept the chargebacks. From my understanding, it also seems that the author submitted a Stripe API key alongside the prompt to create the scripts. This is pretty much a big security no no regardless of the permissions of the key.

Author here. GPT only got minimal context it needed to run the prompt. No customer data, no IDs, definitely no API keys were passed as a prompt.

Re: The underground world of credit card network exploitation

#37

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

Probably helps maintain dollar hedgemony by allowing a wider swath of the global population (criminals, poor people) to use the system unencumbered.

"hegemony" n. leadership or dominance, especially by one state or social group over others.

"Hedgemony" is a war game focused on connecting policy and strategy. https://www.usmcu.edu/Outreach/Marine-Corps-University-Press...

Re: The underground world of credit card network exploitation

#38
post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

I'm not sure how much extra I pay but the hassle free peace of mind I have seems worth it.

"Hassle free peace of mind" meaning you do not need to remember a 4 digit code (or clicking "yes" in a phone app), while you need to check your credit card transaction list regularly to reject fraudulent transactions?

I find the effort of remembering the 4 digit code/having the phone much smaller than the alternative ...

Re: The underground world of credit card network exploitation

#40
post #34

Re: Chargeback fees - Visa acquired a company called Verifi a few years back. Their new products are Rapid Dispute Resolution (RDR) and Order Insight. RDR effectively lets you automatically refund a transaction before it gets turned into a chargeback and Visa charges a $4 fee (Assuming your MCC code is not high risk). Order insight lets you provide certain data about a questioned charge immediately and if the custome…

Article author here. Really valuable stuff, thanks for sharing! Do you handle this for Mastercard in any way? I've heard of Ethoca (they are really good at SEO), it seems quite similar to Verifi.

Ya, for Mastercard we use their Ethoca network. They are much more expensive, like $25 per resolved charge but now our chargeback rate is near 0% for Visa / MC and get incredible rates on the front end from such clean processing. Plus we never have to worry about chargebacks threatening our merchant account again.
Post reply on HN