Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

81–90 of 280 posts

Re: The underground world of credit card network exploitation

#81

Post by BaseballPhysics »

cubefox wrote: post #79
BaseballPhysics wrote: post #55

Earlier quoted context omitted.

A massively diverse and deregulated banking sector. The US has literally thousands of small regional banks across 50 fairly independent states. Rolling out major new technologies in that environment is far far harder.

The number of banks in the US seems perfectly normal. Germany has ~1500 for 80 million inhabitants, the US has ~4800 for 300 million.

First, compared to the rest of the EU, Germany is a weird outlier with the number of banks they have (which, by the way, has been declining steadily for 15 years).

Setting that aside, you missed the "deregulated" part.

As I understand it (and I grant my understanding is pretty cursory) Germany has a much stronger central regulating body, and is subject to overall EU regulations as well.

The US has multiple regional banking authorities and a ton of responsibility is delegated to the states, and in general government intervention is seen as a last resort.

So it's both structural and cultural.

Re: The underground world of credit card network exploitation

#82

Post by pimpl »

itscodingtime wrote: post #77
appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

I find it odd Chatgpt was mentioned at all. It was almost like an advertisement. I have read post linked here similar to this one, but I can’t recall another instance in which the author abruptly said they relied on stackoverflow to code something unless the content was a meta commentary on coding and debugging itself.

Author here. My intention was to show that you can use it to help you get going quickly for a very practical, one-off, and self-contained use cases. As I mentioned in other comments already, I did not trust it blindly and did not share any sensitive data with it. Definitely not an ad!

Re: The underground world of credit card network exploitation

#83

Post by tlogan »

nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

In my view, the U.S. is leading the way in this area.

Europe seems to be shifting the burden of fraud prevention onto customers with methods like SMS notifications and pins. In contrast, in the U.S., banks and businesses are primarily responsible for dealing with fraud.

Re: The underground world of credit card network exploitation

#84

Post by mnw21cam »

nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

Chip and PIN isn't mandatory in the UK - it's just the default. My debit card is not Chip and PIN, because I asked the bank very nicely.

The problem isn't the Chip and PIN itself, although it has been implemented less securely than it could be. The problem, as you point out, is that the liability for fraud has been shifted in law to the card holder, and that is what I objected to. See https://www.chipandspin.co.uk/ for more.

Re: The underground world of credit card network exploitation

#85

Post by _puk »

arjvik wrote: post #54
nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

We have 3D Secure, but it's almost never implemented on sites!

Define "We".

With a UK card pretty much any transaction I do online requires me to Auth it in app.

I even found I had to do it recently for things like car hire, and those websites are generally just wrappers around local company searches (though higher sums overall).

Re: The underground world of credit card network exploitation

#86

Post by appplication »

flutas wrote: post #60
appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

> the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks Feels like a mischaracterization tbh. He had it make a script to go through and accept the chargebacks for these accounts, not handle payment processing or do anything to the chargebacks other than click "accept" essentially. > And based on the context in the article, the author sounds like they lacked th…

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure.

The fact that it works is insufficient proof that it was the right thing to do. Building a habit of relying on LLM generated code is an inherently risky practice, and ChatGPT will literally warn you against trusting its outputs. Sure, it lets you growth hack your way through sort term problems, but in the long term I’m not convinced this is responsible decision making at the current levels of LLM technology.

Or maybe I’m just a Luddite, stuck in my old ways.

Re: The underground world of credit card network exploitation

#87

Post by danudey »

ActivePattern wrote: post #65
nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

As a Canadian, it does feel like stepping out of a time machine when you pay at restaurants in the USA. Instead of using a terminal at the table to pay yourself, you need to give the server your card and wait for them to manually process it somewhere. Maybe things have progressed in recent years. But we haven't done it that way in Canada since the early 2000's.

I was visiting Seattle (from Vancouver) a few years ago, and they didn't want me to use my chip card as a chip card because if they did then I couldn't tip. What the heck is that all about?

Also, we're still hearing stories about merchants in the US starting to accept Apple Pay, whereas it worked fine in almost every retailer in Canada the day it was available - even though it wasn't available in Canada for a long time, American visitors (or Canadians with American credit cards) could use Apple Pay on launch day at any retailer that supported tap-to-pay, which was easily most of them.

Re: The underground world of credit card network exploitation

#88

Post by wpietri »

pimpl wrote: post #73
wpietri wrote: post #71

Earlier quoted context omitted.

I'm a huge LLM skeptic, but I'd disagree with you here. I think using ChatGPT to write long-lived code for a serious application is a bad idea. But I think it's fine for somebody knowledgeable to use it for throwaway and first-draft stuff in areas that aren't their daily work. Here's the author in question: [edit: wrong Piotr Mierzejewski in tech, see below] He looks perfectly competent to me to evaluate the effects…

Appreciate the comment! Just a quick note that this is my LI profile: https://www.linkedin.com/in/pmierzejewski/

Oops! Thanks for the correction. And even more able to evaluate the code.

Re: The underground world of credit card network exploitation

#89

Post by joncrocks »

toomuchtodo wrote: post #52
trompetenaccoun wrote: post #46

Earlier quoted context omitted.

And that is in addition to the outrageous fees CC companies charge merchants. In the US it's typically around 2% of the transaction! The EU caps it at 0.3% maximum, which still seems like a lot when you consider how much money they move. That's another cost that gets socialized and passed on to the consumer of course, even shoppers who pay cash have to pay for this through higher prices. People should know btw that w…

> With phone 2FA all that needs to happen is you have your phone and wallet stolen. Are device passcode and app biometrics insufficient security measures in the event of device theft?

If you have your phone set to wake-up/show notifications on new messages, and your bank simply sends an SMS code as verification, then the thief can just read the message(s) when they come in and input them.

Re: The underground world of credit card network exploitation

#90

Post by TacticalCoder »

mschuster91 wrote: post #6
myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

> What's different about Europe that they seem to have figured this out decades ago? Our governments actually care about monopolies and security. The PSD2 directive was an utter pain to deal with, but at least it stopped a lot of common scams and thefts in its tracks, and it forced banks and other payment actors to open up their system.

> The PSD2 directive was an utter pain to deal with, but at least it stopped a lot of common scams and thefts in its tracks

Inded. More specifically SCA (Strong Customer Authentication) which is required by PSD2. VISA says the "SYH" (Something You Have) is either "a mobile phone, a card reader or other device evidenced by a one-time passcode".

Note however that I cannot log nowadays to any of my bank in the EU without having a big banner saying something like (paraphrasing): "WARNING: scammers are trying to steal your funds. Neither the bank nor the police nor anyone else shall ask you your PIN or to confirm anything on your card reader."

Basically: life is harder for scammers so they try to trick (mostly old) people into validating transactions over the phone.

Post reply on HN