Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

111–120 of 280 posts

Re: The underground world of credit card network exploitation

#111

Post by kredd »

appplication wrote: post #86
flutas wrote: post #60

Earlier quoted context omitted.

> the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks Feels like a mischaracterization tbh. He had it make a script to go through and accept the chargebacks for these accounts, not handle payment processing or do anything to the chargebacks other than click "accept" essentially. > And based on the context in the article, the author sounds like they lacked th…

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

Frankly speaking, probably the latter. I've been using Copilot for over a year now, and obviously it makes stupid mistakes, but it sped up my general coding speed. Now, I don't have much experience (maybe around 10ish years of programming professionally) in comparison to greybeards, but it works. Haven't used ChatGPT much, but as long as the user understands its shortcomings and reviews/refines its outputs, it's fine.

People who write code also make mistakes, yet we don't consider it "inherently risky practice". We just review others' code, tweak it, make it more appropriate for prod and voila. Same thing applies here.

Re: The underground world of credit card network exploitation

#112

Post by toomuchtodo »

cubefox wrote: post #79
BaseballPhysics wrote: post #55

Earlier quoted context omitted.

A massively diverse and deregulated banking sector. The US has literally thousands of small regional banks across 50 fairly independent states. Rolling out major new technologies in that environment is far far harder.

The number of banks in the US seems perfectly normal. Germany has ~1500 for 80 million inhabitants, the US has ~4800 for 300 million.

https://www.npr.org/2023/05/16/1176513695/does-the-u-s-have-...

https://www.marketplace.org/2023/05/05/heres-why-the-u-s-has...

Re: The underground world of credit card network exploitation

#113

Post by xyst »

Yet another reason why the credit card industry needs to go. Security protocols non-existent or haven't been upgraded since the turn of the 21st century. The amount of middleman abuses is innumerable as well. The costs of dealing with these nuisances is passed on to the merchant (via higher transaction fees, charge back fees, ...), and inevitably passed on to the consumer.

Let's not forget that the CC industry encourages the worst spending habits for consumers thus perpetuating the never ending cycle of slaves to debt.

Re: The underground world of credit card network exploitation

#114

Post by bmicraft »

danudey wrote: post #87
ActivePattern wrote: post #65

Earlier quoted context omitted.

As a Canadian, it does feel like stepping out of a time machine when you pay at restaurants in the USA. Instead of using a terminal at the table to pay yourself, you need to give the server your card and wait for them to manually process it somewhere. Maybe things have progressed in recent years. But we haven't done it that way in Canada since the early 2000's.

I was visiting Seattle (from Vancouver) a few years ago, and they didn't want me to use my chip card as a chip card because if they did then I couldn't tip. What the heck is that all about? Also, we're still hearing stories about merchants in the US starting to accept Apple Pay, whereas it worked fine in almost every retailer in Canada the day it was available - even though it wasn't available in Canada for a long ti…

> What the heck is that all about?

Tax fraud? I've never seen a card reader in a restaurant (here in europe) where they couldn't either enter a completely arbitrary amount to pay, or add a tip.

Re: The underground world of credit card network exploitation

#115

Post by pimpl »

appplication wrote: post #107
pimpl wrote: post #32

Earlier quoted context omitted.

Article author here. I carefully reviewed and tested the ChatGPT scripts before executing them. It helped me save a lot of time manually writing these scripts! I wouldn't say I lack technical expertise in this area, I'm just trying to use my time as efficiently as possible.

Glad to see you active here in the comments. Apologies if my comment comes off harshly, my intent is not to tear you down. I think there is a lot of gray space when it comes to using LLMs for generating code. Your usage here is certainly interesting, and I appreciate the additional context and discussion you’ve been providing.

No worries at all! I agree that there's probably lots of people blindly copying and running code from LLMs without any reflection. Just like it often happened with StackOverflow snippets before ChatGPT (to the point it became a meme). I'm definitely not one of them.

Re: The underground world of credit card network exploitation

#116

Post by i_am_jl »

b112 wrote: post #100
mrdatawolf wrote: post #95

Earlier quoted context omitted.

My current suggestion is to consider it the work of a just on-boarded intern. It will save you some time but you still need to walk thru the code to make sure it will work as intended.

My experience has been it's faster to write code yourself, than via a just on boarded intern + review + fixes.

The time savings isn't down to quality, the difference is that an LLM does in seconds what an intern does in hours or days.

Re: The underground world of credit card network exploitation

#117

Post by tobi1449 »

delusional wrote: post #98
paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

Your causality chain doesn't track for me. Here in Denmark we have the same consumer protections, the ability to do chargebacks and the (government funded) guarantee that the consumer does not lose any money if their bank account is drained. Yet we still have very strong protections at the time of purchase with mandatory chip-and-pin as well as 3D secure (which replaced Verified by Visa). I don't really think there's…

My guess is the difference lies in the fact that the EU limits credit card fees to something around 0.5% That means the CC companies can't offload the financial burden of this onto the vendors (and they in turn onto their customers), which leads to them having an actual incentive to improve security.

Re: The underground world of credit card network exploitation

#118

Post by zaroth »

deathanatos wrote: post #48
nickdothutton wrote: post #39

I’ve always found it incredible that US banks often require only the card number to perform a transaction. All those “card generators” I used to see uploaded to BBS in the late 80s and early 90s make sense.

That part of the article was news to me. Like, why do I have to deal with CVVs, expiration dates, zip codes, (not to mention the resulting work from the fallout from the fraud) … if it doesn't even matter? How many person years of human life per year could pursue something … worthwhile … if we checked the CVV?

I don’t understand not checking CVV and Expiration Date at all…

But for the other info, they could be carding for prepaid cards which have no name, address, or ZIP code to verify against?

Re: The underground world of credit card network exploitation

#119

Post by notyourwork »

vladms wrote: post #38
notyourwork wrote: post #30

Earlier quoted context omitted.

I'm not sure how much extra I pay but the hassle free peace of mind I have seems worth it.

"Hassle free peace of mind" meaning you do not need to remember a 4 digit code (or clicking "yes" in a phone app), while you need to check your credit card transaction list regularly to reject fraudulent transactions? I find the effort of remembering the 4 digit code/having the phone much smaller than the alternative ...

I think you misunderstood me. Peace of mind is in not having to worry about fraud being my responsibility to fight or dispute. I can call CC company or through mobile app, flag transaction, get my money back and never spend another minute on the issue.

Re: The underground world of credit card network exploitation

#120

Post by tptacek »

cubefox wrote: post #79
BaseballPhysics wrote: post #55

Earlier quoted context omitted.

A massively diverse and deregulated banking sector. The US has literally thousands of small regional banks across 50 fairly independent states. Rolling out major new technologies in that environment is far far harder.

The number of banks in the US seems perfectly normal. Germany has ~1500 for 80 million inhabitants, the US has ~4800 for 300 million.

The US is 50 related but different regulatory regimes, not 1.
Post reply on HN