Wouldn't the attacker only charge these after charging dozens/hundreds of legitimate customer cards too?
Seems to me this is the wrong solution to the problem this is trying to solve.
Detect breaches with Canary credit cards
11–20 of 158 posts
Re: Detect breaches with Canary credit cards
#12Wouldn't the attacker only charge these after charging dozens/hundreds of legitimate customer cards too? Seems to me this is the wrong solution to the problem this is trying to solve.
The responsibilities don't end when the breach happens. And while the cat is out of the bag, knowing it has happened is also important to contact customers, fulfil legal disclosure with regulators (eg. GDPR), and for triggering investigations and forensics.
Re: Detect breaches with Canary credit cards
#13Oooo. This is fantastic. I’ll start using this with scam callers. Do they also give you the info on the entity that made the charge?
Re: Detect breaches with Canary credit cards
#14Wouldn't the attacker only charge these after charging dozens/hundreds of legitimate customer cards too? Seems to me this is the wrong solution to the problem this is trying to solve.
Usually they test the set of cards with small charges. This allows them to sell pre-tested cards at higher value.
So if you can find out that one of your canary cards have been tested, you can have some confidence that your whole set has been compromised.
Re: Detect breaches with Canary credit cards
#15I have wanted something like this to give to scammers, to help aid in their detection and capture. This is part of that puzzle.
Now if only law enforcement would give a shit and do something about all of the rampant fraud. Sadly, I do not believe that will ever happen.
Re: Detect breaches with Canary credit cards
#16Wouldn't the attacker only charge these after charging dozens/hundreds of legitimate customer cards too? Seems to me this is the wrong solution to the problem this is trying to solve.
It’s mitigation, not a perfect prevention, but those are extremely useful for security: if the attacker trips a warning after hundreds of charges are approved that still allows the bank to take action before the number is in the thousands of cards and makes it possible to retroactively revoke the transactions which were just approved. In the common case where someone is making purchases using stolen cards that allows goods never to leave the warehouse, and if the attacker slows their usage rate to avoid that they’re getting much less profit.
Re: Detect breaches with Canary credit cards
#17Very interesting tool. I'm going to write the canary CC onto a physical card and swipe it first when shopping. If I ever see it randomly accessed, I'll know my 2nd card (actual payment card) is burnt.
>Credit Card Rate-Limiting currently in place. Please try again later.
Maybe tomorrow.
Re: Detect breaches with Canary credit cards
#18I have wanted something like this to give to scammers, to help aid in their detection and capture. This is part of that puzzle. Now if only law enforcement would give a shit and do something about all of the rampant fraud. Sadly, I do not believe that will ever happen.
Near as I can tell, a lot of the fraud is exploitation of the known and not yet solved ‘remote jurisdiction’ issue.
When someone is far away, and in a different jurisdiction, it’s hard to track them down and do anything to them.
Not likely to get better anytime soon, unfortunately.
Re: Detect breaches with Canary credit cards
#19Looks neat and thanks for sharing idea. Aren't professionnal going to just discard all numbers associated with this "bank", then ?
Many canaries are avoidable if you pay perfect attention - but people slip up, and even if they don't, paying perfect attention does increase the cost for the attacker. (And e.g. throwing out all Amex corporate credit cards (one example of the "banks" they use) as you suggest does reduce the value of stolen data too)
Also, attackers who are so diligent could often make more money not doing criminal things.
Re: Detect breaches with Canary credit cards
#20The fact that the Payment Card Industry association hasn't been pushing this for decades, and it's up to some random infosec nerds to invent it, is yet more evidence that our entire payment infrastructure is fundamentally flawed.