I've been using a platform called Chargeblast.io and it's been doing wonders; literally saved my business from closing down. I haven't found another platform like it - best price, best value
The underground world of credit card network exploitation
141–150 of 280 posts
Re: The underground world of credit card network exploitation
#142Stripe is god awful at fraud prevention and it's intentional. They are explicitly outsourcing the cost of risk management to their clients. It's obscene. I work in the credit card fraud prevention field, and I'm not even that good at my job, but our team of like 3.5 people easily built and maintained a system that prevents this exact kind of carding attack. The primary way for a business to prevent carding attacks is…
They want to nickel and dime you and make you pay for Radar. It's the exact same strategy with Stripe Taxes and their terrible currency conversions. Provide no service up front and eventually you realize your stripe transaction hits two digit percentage of your overall price.
Re: The underground world of credit card network exploitation
#143Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…
What's super interesting to me, lot of countries that you would expect to be behind the US on that topic actually have state-of-the-art banking techs. Even the EU is behind some of the stuff I've seen in LATAM.
Re: The underground world of credit card network exploitation
#144Worked as the catch-all systems/CI/infrastructure/software engineer for an ecommerce company last year. This sort of stuff was so common. I'd spend at least one day a week trying to determine the newest pattern and prevent it. They were using our system to validate credit cards.
Eventually I stopped more or less all attacks on our cart/checkout. But the requests were still coming. Eventually while trolling logs for an unrelated PHP problem one of the software engineers mentioned there was a huge amount of traffic hitting our page to save a payment for later. The platform would issue a $1.00 charge to verify that the CC was real and they'd moved to using that to "churn" cards.
These CC thieves are very resourceful.
Re: The underground world of credit card network exploitation
#145Earlier quoted context omitted.
Sure, it doesn't nail it 100% on the first prompt 100% of the time. Sometimes it takes a few prompts. It's no big deal. If you can't get it to write effective code, either you're working in a very niche area, or you haven't figured out how to use it properly.
Another reason someone can’t get it to write effective code is if they don’t know how to code or aren’t a very good programmer. I use it a ton. Most of the time it’s very helpful, sometimes I can’t get it to write effective code. If the code it outputs doesn’t meet my standards, I just don’t use it. But I know what I’m looking for, and when ChatGPT generates it, if not only saves me a shitload of time, but more impor…
I concur. It's just like any other tool, it's only as good as the person using it. I just can't understand the resistance of people in this field. I was a naysayer on a number of things like Docker when it first came out because it didn't solve any of my problems at the time. Then, k8s came out and Docker was a pivotal part of that solution, and k8s solves many problems.
ChatGPT writing code so you don't have to, I just can't conceptualize how that's not an instant win for just about everyone.
Re: The underground world of credit card network exploitation
#146Earlier quoted context omitted.
ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…
It's terrible, but not far removed from what's been already happening with "developers" copying and pasting StackOverflow comments into a text editor and making uninformed compiler-error-guided-edits until it runs then done! The root of the problem here is people making production stuff who don't know wtf they're doing. If they turn to SO posts, LLMs, or "developers" on fiverr/upwork doing the same thing, is there re…
Just seems like programming will be joining the ranks of most tools. There will always be craftsmen, there will always be professionals, and then there will be the guy bolting together ice chests and garbage disposals to make margarita mixers on his patio or the kid with a duct tape exhaust rig on his Honda Civic.
I guess, to your point, it's only trouble if the margarita mixer guy is put in charge of something that matters? :D
(might be a bad example, I've known some fine engineers and mechanics that are absolutely margarita mixer guy, but hopefully my point is taken lol)
Re: The underground world of credit card network exploitation
#147Earlier quoted context omitted.
That part of the article was news to me. Like, why do I have to deal with CVVs, expiration dates, zip codes, (not to mention the resulting work from the fallout from the fraud) … if it doesn't even matter? How many person years of human life per year could pursue something … worthwhile … if we checked the CVV?
I don’t understand not checking CVV and Expiration Date at all… But for the other info, they could be carding for prepaid cards which have no name, address, or ZIP code to verify against?
Do prepaids not have ZIPs? So many things demand this info (heck, even some gas pumps…) … what do people enter at those prompts?
(I left out name; I assume name isn't matched against, given how fuzzy of a field it is. Most sites don't even prompt for the information accurately enough to make a match anyways.)
Re: The underground world of credit card network exploitation
#148Earlier quoted context omitted.
And that is in addition to the outrageous fees CC companies charge merchants. In the US it's typically around 2% of the transaction! The EU caps it at 0.3% maximum, which still seems like a lot when you consider how much money they move. That's another cost that gets socialized and passed on to the consumer of course, even shoppers who pay cash have to pay for this through higher prices. People should know btw that w…
> With phone 2FA all that needs to happen is you have your phone and wallet stolen. Are device passcode and app biometrics insufficient security measures in the event of device theft?
If they have your device pin code and your device, they have control of your entire digital life.
We’ve never been more vulnerable to petty crime.
Re: The underground world of credit card network exploitation
#149Earlier quoted context omitted.
I've started to see more and more servers using a mobile POS with built in credit reader and receipt printer. They hand it to you for tip and signature and you don't have to hand your card to anyone.
But now they get to see how much you're tipping them! Like they literally have to wait while you punch it in, increasing the social pressure to make up for a broken system. I don't go to restaurants anymore. Too much pressure.
Respectfully, this seems like social anxiety or hyperbole. You don't go to restaurants because of the stress of the cultural norm of tipping? Seems more accurate to say you don't like eating out in general or because of the price of eating out once you factor in a tip...
Re: The underground world of credit card network exploitation
#150Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…
In my view, the U.S. is leading the way in this area. Europe seems to be shifting the burden of fraud prevention onto customers with methods like SMS notifications and pins. In contrast, in the U.S., banks and businesses are primarily responsible for dealing with fraud.
It's more the case that US Consumers are indirectly funding crime by banks turning a blind eye to fraud.