Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

41–50 of 280 posts

Re: The underground world of credit card network exploitation

#41

Post by gpvos »

paxys wrote: post #7
myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

Not sure I understand. Does everyone outside the US have a card reader attached to their PC and phone?

No. Until I read the comment above, I had no idea that that even was something people actually use to make payments from home.

Re: The underground world of credit card network exploitation

#42

Post by nerdawson »

Why does the US seem so far behind when it comes to banking?

- Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up.

- Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare.

- Since the EU introduced Strong Customer Authentication, most new payments have to be authorised in your mobile banking app or by some other means of 2FA.

- Even before SCA, you'd have to get the Postcode (often digits that mattered) and CVV correct at the very least.

These measures seem like a way of banks shifting the responsibility for fraud onto the customer. In either case though, it's the customer who loses out. In a culture that accepts widespread card fraud, costs increase to offset it.

Re: The underground world of credit card network exploitation

#43

Post by Invictus0 »

vladms wrote: post #38
notyourwork wrote: post #30

Earlier quoted context omitted.

I'm not sure how much extra I pay but the hassle free peace of mind I have seems worth it.

"Hassle free peace of mind" meaning you do not need to remember a 4 digit code (or clicking "yes" in a phone app), while you need to check your credit card transaction list regularly to reject fraudulent transactions? I find the effort of remembering the 4 digit code/having the phone much smaller than the alternative ...

I think OP is talking about never being liable for fraud

Re: The underground world of credit card network exploitation

#44

Post by fsociety »

notyourwork wrote: post #30
paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

I'm not sure how much extra I pay but the hassle free peace of mind I have seems worth it.

The last link the in the chain of payment processors pay for it.

Re: The underground world of credit card network exploitation

#45

Post by hn_throwaway_99 »

appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

I don't know why I see this type of invalid speculation so often. The author already responded that they reviewed the script and didn't post any sensitive data, so won't add more to that.

I'd just state that tons of us use ChatGPT effectively and never blindly trust the outputs - for me ChatGPT is a starting point, not the final product. We're not all so daft as that lawyer who cut and pasted hallucinated case references into a legal brief without verifying them first.

Re: The underground world of credit card network exploitation

#46

Post by trompetenaccoun »

paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

And that is in addition to the outrageous fees CC companies charge merchants. In the US it's typically around 2% of the transaction! The EU caps it at 0.3% maximum, which still seems like a lot when you consider how much money they move. That's another cost that gets socialized and passed on to the consumer of course, even shoppers who pay cash have to pay for this through higher prices.

People should know btw that with 3D secure the card owner can be held liable for fraudulent charges, because some banks have that in their terms for 3D secure. With phone 2FA all that needs to happen is you have your phone and wallet stolen. I've seen cases in the news where people lost thousands.

Re: The underground world of credit card network exploitation

#47

Post by thierryzoller »

What strikes me is the comment on 3DS challenges that passed. By law in Europe, once 3DS challenge is completed the Bank owns the risk and cost of the chargeback NOT the Online Shop. Can someone tell me how this is implemented in common processors ? Any experience?

Re: The underground world of credit card network exploitation

#48

Post by deathanatos »

nickdothutton wrote: post #39

I’ve always found it incredible that US banks often require only the card number to perform a transaction. All those “card generators” I used to see uploaded to BBS in the late 80s and early 90s make sense.

That part of the article was news to me. Like, why do I have to deal with CVVs, expiration dates, zip codes, (not to mention the resulting work from the fallout from the fraud) … if it doesn't even matter? How many person years of human life per year could pursue something … worthwhile … if we checked the CVV?

Re: The underground world of credit card network exploitation

#49

Post by pimpl »

hn_throwaway_99 wrote: post #45
appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

I don't know why I see this type of invalid speculation so often. The author already responded that they reviewed the script and didn't post any sensitive data, so won't add more to that. I'd just state that tons of us use ChatGPT effectively and never blindly trust the outputs - for me ChatGPT is a starting point, not the final product. We're not all so daft as that lawyer who cut and pasted hallucinated case refere…

100% agreed, this is how I always treat it and working on the problem from the article was not an exception from this rule. I share minimum input, and never trust the output blindly.

It gets 50-60% of work done, and a really good basis for me to work on it. Especially when working with one-off, end-to-end relatively short scripts.

Re: The underground world of credit card network exploitation

#50

Post by BaseballPhysics »

pimpl wrote: post #32
appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

Article author here. I carefully reviewed and tested the ChatGPT scripts before executing them. It helped me save a lot of time manually writing these scripts! I wouldn't say I lack technical expertise in this area, I'm just trying to use my time as efficiently as possible.

Genuinely curious: How much time would you say you saved prompting for and then carefully reviewing and testing those scripts for bugs, versus writing them yourself?

And for context what's the average line count we're talking about here? Tens of lines? Hundreds?

Post reply on HN