Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

121–130 of 280 posts

Re: The underground world of credit card network exploitation

#121

Post by xyst »

paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

Americans (yes both Canadians and people from the states) are shielded from the chaos that happens to process a single transaction. They only see the paltry rewards in the form of 1-2 (maybe 5) cents per dollar charged, which is translated into "points" (1 cent == 100 points is what I have seen with some "premium" cards) and makes it seem worthwhile.

What they don't see is: the 3-5% or more markup of goods across the board (doesn't matter if you pay cash or card, especially for big box stores), the number of charge backs and the costs of dealing with it, fraudulent charges, poor security (places still accept mag stripe in the states), innumerable numbers of middleman to process transactions (bank fees, issuing card fees, network fees, premium card fees, ...)

It's fucking chaos. I hate it.

With FedNow, I am hoping that will change. Eliminate all of these middleman that are siphoning funds from people across the board. Eliminate the parasites. Eliminate the waste.

Re: The underground world of credit card network exploitation

#122

Post by tptacek »

danudey wrote: post #87
ActivePattern wrote: post #65

Earlier quoted context omitted.

As a Canadian, it does feel like stepping out of a time machine when you pay at restaurants in the USA. Instead of using a terminal at the table to pay yourself, you need to give the server your card and wait for them to manually process it somewhere. Maybe things have progressed in recent years. But we haven't done it that way in Canada since the early 2000's.

I was visiting Seattle (from Vancouver) a few years ago, and they didn't want me to use my chip card as a chip card because if they did then I couldn't tip. What the heck is that all about? Also, we're still hearing stories about merchants in the US starting to accept Apple Pay, whereas it worked fine in almost every retailer in Canada the day it was available - even though it wasn't available in Canada for a long ti…

That's not a thing. Americans universally pay for restaurant meals on cards.

Re: The underground world of credit card network exploitation

#123

Post by tamimio »

Credit cards payments are exactly just like SMS 2FA, both are insecure by design and served the purpose before the internet, trying to shove old tech into new one and expecting it to work well is just naive. Instead of spending time and resources by big corporations to create such “web environment integrity”, how about creating a better more secure, fraudulent proof system instead?

Re: The underground world of credit card network exploitation

#124

Post by skybrian »

paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

I expect it’s path-dependent legacy practices more than anything else. Credit cards were invented in the US, so the tech is old and upgrades take a long time.

For manual payments, UPI in India sounds pretty great. Apparently the customer approves each payment on their phone before it goes through?

Re: The underground world of credit card network exploitation

#125

Post by zaroth »

zer0x4d wrote: post #97
bonzini wrote: post #5

Earlier quoted context omitted.

"banks (usually American ones) will happily accept transactions that have incorrect full name, invalid CVV / CVC, wrong expiration date, only partial billing address provided, with incorrect ZIP code. All of the above is still not enough to trigger a 3D secure authorisation" The solution indeed is to write manual rules to trigger 3D secure.

The author is wrong about this. Banks don't choose to accept incorrect name, invalid CVC, invalid exp date or wrong billing address. It's up to the user (in this case him) to enable CVC Check and AVS in his payment processor to fail payments that don't pass this check. It's also up to him/Stripe to implement 3D secure and trigger it. https://stripe.com/docs/disputes/prevention/verification#cvc...

From your link;

“Radar includes a rule to block any payments that fail the CVC verification check, which you can enable or disable within the Dashboard (this doesn’t affect payments where the CVC check couldn’t be performed).”

Also;

“…Support for both types of AVS checks varies by country and card issuer (for example, certain countries don’t use a postal code or some card issuers don’t support street address verification)”

So it appears there are cases where these checks can be enabled on your Dashboard, but skipped by Stripe or not actually performed by the issuer, I’m thinking like for prepaid cards?

Re: The underground world of credit card network exploitation

#126

Post by np- »

nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

> In a culture that accepts widespread card fraud, costs increase to offset it.

Maybe, maybe not, but this is a very simplistic way of looking at it. If credit card fraud is responsible for X% of total charges, they can spend effort to deal with it, OR they can simply not deal with it and keeping the transactions going while eating the cost, they may be able to serve Y% more customers where Y > X and thus end up with more profit in the long run.

This works for a lot of businesses in America because the sheer scale is massive (take McDonalds for example, they would probably be better off processing their lunch rush quickly due to the margins they are making rather than take even 1 second to verify there is no fraud). This may not work in Europe, but IMO you're missing an entire dimension when analyzing the true costs.

If the fraud/benefit scale ever tipped away from favoring the companies, I think we would see all these major fraud prevention mechanisms kick in almost immediately in the US.

Re: The underground world of credit card network exploitation

#127

Post by WirelessGigabit »

pests wrote: post #102
ActivePattern wrote: post #65

Earlier quoted context omitted.

As a Canadian, it does feel like stepping out of a time machine when you pay at restaurants in the USA. Instead of using a terminal at the table to pay yourself, you need to give the server your card and wait for them to manually process it somewhere. Maybe things have progressed in recent years. But we haven't done it that way in Canada since the early 2000's.

I've started to see more and more servers using a mobile POS with built in credit reader and receipt printer. They hand it to you for tip and signature and you don't have to hand your card to anyone.

But now they get to see how much you're tipping them! Like they literally have to wait while you punch it in, increasing the social pressure to make up for a broken system.

I don't go to restaurants anymore. Too much pressure.

Re: The underground world of credit card network exploitation

#128

Post by TechBro8615 »

appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

This guy is operating a profitable business, creating value for customers, shipping features, and openly publishing details and learnings about the threats he mitigated. He used ChatGPT to generate scripts to help him throughout this process. I don't know if he's non-technical or if he just wanted to save some time, but frankly he should be commended for his hustle and get-shit-done attitude. These scripts were not determining life or death, or even making business critical decisions - they were filtering bulk data and making his life easier by producing results that are easily manually checkable, but save tons of time either coding the scripts or hiring a programmer to write them.

To me it reads like a great example of where ChatGPT is most useful: as a force multiplier for time-constrained entrepreneurs who have a specific goal and need specialized knowledge for short periods of time (e.g. to write a script). It's now basically free and instant to produce what would previously require a multi-week process of sourcing, hiring and communicating with contractors to write a script that leads to the same end result.

The kneejerk reaction to call this "surprising" or irresponsible, while understandable, gives major "get off my lawn" energy. This is the future and as coders we should support the increased self-sufficiency of non-technical people. If you want to adapt to the change then maybe think about how to improve the process for entrepreneurs of asking ChatGPT to write a script.

Re: The underground world of credit card network exploitation

#129

Post by xyst »

myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

In the United States, there is minimal incentive to do so. It took many years to transition away from magnetic stripe cards to pin+chip. IIRC, the regulators kept pushing back the date for banks to re-issue pin+chip cards and for merchants to begin accepting them. I think it was only when the processors began to threaten merchants with 100% liability for fraudulent transactions processed with mag stripe is when it started to hit critical mass (2015-2016?).

Re: The underground world of credit card network exploitation

#130

Post by fxleach »

linuxftw wrote: post #108
appplication wrote: post #86

Earlier quoted context omitted.

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

I use ChatGPT to write code for work constantly. The quality is quite high, it saves me lots of time, on the order of hours typically. If a company prevents me from using ChatGPT, I will use it clandestinely unless they offer an equivalent. There's no going back.

This is outright false. I have used ChatGPT many times over the last couple months and I have caught it give me un-working code, unfinished code, and terribly buggy code. When you point this out it will say Oh sorry about that here is an updated version, and I've caught it give another bug, and another after that. If you are telling me the quality of code that ChatGPT gives you is high then it pains me to say but you must not provide high quality code yourself.
Post reply on HN