Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

191–200 of 280 posts

Re: The underground world of credit card network exploitation

#191

Post by inopinatus »

appplication wrote: post #86
flutas wrote: post #60

Earlier quoted context omitted.

> the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks Feels like a mischaracterization tbh. He had it make a script to go through and accept the chargebacks for these accounts, not handle payment processing or do anything to the chargebacks other than click "accept" essentially. > And based on the context in the article, the author sounds like they lacked th…

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

The latter, I'd have to suggest. GPT-4 generates code that is slightly better than the average junior programmer, which is to say, it is often confidently incorrect and needs review before committing, but either option remains a net productivity gain than no assistant at all.

"Your job will not be taken by an AI. Your job will be taken by someone assisted by an AI."

The process touched on in the article, with thorough review before commit by a human with in-depth experience of the language and APIs and the domain in question, is exactly how AI-generated code should be incorporated into a workflow. The earlier slander against the author's technical ability seems misguided and unsupportable.

Re: The underground world of credit card network exploitation

#192

Post by inopinatus »

kredd wrote: post #111
appplication wrote: post #86

Earlier quoted context omitted.

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

Frankly speaking, probably the latter. I've been using Copilot for over a year now, and obviously it makes stupid mistakes, but it sped up my general coding speed. Now, I don't have much experience (maybe around 10ish years of programming professionally) in comparison to greybeards, but it works. Haven't used ChatGPT much, but as long as the user understands its shortcomings and reviews/refines its outputs, it's fine…

forty years behind the keyboard or elbow-deep in a rack, beard not actually grey yet, but still, yes; those who do not adapt will be left behind.

Re: The underground world of credit card network exploitation

#194

Post by creeble »

nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

None of these comments seem relevant to TFA, which is specifically about card-not-present fraud.

Chip and PIN doesn't work for internet payment.

Bank transfers don't work well internationally.

It is trivial to turn on AVS (address verification) and CVV, but it can result in more declined-yet-legitimate transactions. Sometimes that outweighs the fraud risk that these catch.

The responsibility for fraud is pushed to the merchant, not the customer. Yes, customers pay higher prices because merchant fraud gets passed on eventually, but only in the sense that all fraud costs get passed on to consumers eventually.

Re: The underground world of credit card network exploitation

#195

Post by topato »

delfinom wrote: post #94
paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

Hah, I found the focus on American banks funny because, the one telegram photo said to use the address of Paris France. Let me tell you, on two different organizations I am part of, I have ran in the last 2 years, both got hit by automated credit card checking bots using French banks and alot of those cards succeeded. (Of course there's a whole story about how both these orgs have resisted my previous warnings about…

Was it at least one of the hardened forks of Magento 1?!

Re: The underground world of credit card network exploitation

#196

Post by trompetenaccoun »

dheera wrote: post #160
tobi1449 wrote: post #117

Earlier quoted context omitted.

My guess is the difference lies in the fact that the EU limits credit card fees to something around 0.5% That means the CC companies can't offload the financial burden of this onto the vendors (and they in turn onto their customers), which leads to them having an actual incentive to improve security.

> That means the CC companies can't offload the financial burden of this Most CC company (CCC) revenue comes from charging the poor people who can't pay their bills ("interest"). Merchant fees are only a small portion of revenue for most cards [1]. In the case of Discover for example it's less than 10% of their revenue, and in the case of Amex it's less than 33%. Other cards fall in-between. [1] https://www.valuepeng…

Your link explains that the issuing banks charge interest, not the credit card companies - which are merely the payment processors. I don't know all of the companies listed, it's possible that some are two in one and have their own bank as well. Some payment processors are partly owned by major banks too. But take the largest CC company, Visa: They don't extend credit at all, they don't even issue their own cards iirc. All their profit comes from fees, because the fees are too damn high™.

They've successfully convinced the public of the opposite though. It's a very common misconception that only "suckers" who buy on credit pay for it and that everyone else is getting a free service as long as they pay off their cards in time. In reality everyone pays because the merchants have to pay those fees and they pass the cost on to the consumer.

Re: The underground world of credit card network exploitation

#197

Post by pas »

carlosjobim wrote: post #165
trompetenaccoun wrote: post #46

Earlier quoted context omitted.

And that is in addition to the outrageous fees CC companies charge merchants. In the US it's typically around 2% of the transaction! The EU caps it at 0.3% maximum, which still seems like a lot when you consider how much money they move. That's another cost that gets socialized and passed on to the consumer of course, even shoppers who pay cash have to pay for this through higher prices. People should know btw that w…

> The EU caps it at 0.3% maximum That's completely untrue. Most European businesses pay much more than that.

You're mixing up total cost of processing the card (which is what Stripe and other gateways charge) with the Visa/MC rent.

https://ec.europa.eu/commission/presscorner/detail/fr/MEMO_1...

"Therefore, the Regulation caps interchange fees for consumer debit cards to 0.2 % and consumer credit cards to 0.3 % of the value of the transaction."

Re: The underground world of credit card network exploitation

#198

Post by inopinatus »

dylan604 wrote: post #179
MetaWhirledPeas wrote: post #178

Earlier quoted context omitted.

> the simple fact that most people using LLMs (in general) are not understanding this How do you know most people using LLMs are not understanding this?

Because ChatGPT has been opened to the public

PHP also lowered the bar to programming, and we got over the consequences of that. Eventually.

Re: The underground world of credit card network exploitation

#199

Post by dheera »

trompetenaccoun wrote: post #196
dheera wrote: post #160

Earlier quoted context omitted.

> That means the CC companies can't offload the financial burden of this Most CC company (CCC) revenue comes from charging the poor people who can't pay their bills ("interest"). Merchant fees are only a small portion of revenue for most cards [1]. In the case of Discover for example it's less than 10% of their revenue, and in the case of Amex it's less than 33%. Other cards fall in-between. [1] https://www.valuepeng…

Your link explains that the issuing banks charge interest, not the credit card companies - which are merely the payment processors. I don't know all of the companies listed, it's possible that some are two in one and have their own bank as well. Some payment processors are partly owned by major banks too. But take the largest CC company, Visa: They don't extend credit at all, they don't even issue their own cards iir…

I used CC companies loosely as in {issuing banks + credit card companies} and their collective profit model.

> In reality everyone pays

Not really, credit card companies give you cash back if you pay on time, which is percentage-wise similar to merchant fees.

Re: The underground world of credit card network exploitation

#200

Post by sigwinch28 »

tlogan wrote: post #166
pests wrote: post #102

Earlier quoted context omitted.

I've started to see more and more servers using a mobile POS with built in credit reader and receipt printer. They hand it to you for tip and signature and you don't have to hand your card to anyone.

Definetly not a better experience for all consumers. Or waiter. I do know that some restaurant owners are removing these things. They do not want to look like Olive Garden :) But it really depends on a restaurant: is it high end, type of food / drinks, it is a date place, etc. Majority of restaurant is all about experience and event payment system should match that experience.

> Majority of restaurant is all about experience and event payment system should match that experience.

I'm in the UK. I go to many high-end restaurants, cocktail bars, etc. Portable card terminals are essentially universal in these places. The fact it's the same everywhere is a feature, not a bug.

It's quick. Your card never leaves your sight. No pen is required. Payments up to £100 can be done using contactless on a physical card. Even higher amounts with smartphones/smart watches. Tipping is often integrated into the terminal where tipping is common. It's rare to have to put the card into the terminal.

I don't think it detracts from the experience. On the contrary, I think it streamlines the bit between being finished and wanting to leave:

"Please can I have the bill and a card machine, please".

Post reply on HN