Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

21–30 of 280 posts

Re: The underground world of credit card network exploitation

#21

Post by mattnewton »

myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

If you don’t you significantly increase the friction in using your service and will lose business to those who do accept the hand typed card where the user doesn’t have to adopt new hardware or software.

Everyone would need to mandate the security feature while have a short term incentive to not.

Re: The underground world of credit card network exploitation

#22

Post by Veserv »

myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

Because the banks and vendors are liable for unauthorized charges in the US [1], not the user. The banks/vendors handle the fraud in aggregate on the backend. They could roll out fraud prevention at the end-user level, but they choose not to; which means it is probably not worth it for the issuer relative to the extra user convenience (and extra charges).

In contrast, in many places in Europe the user is responsible for unauthorized charges. Regular people care a great deal about not being wrongfully charged as that is almost always proportionally worse, so they demand robust end-user protection so they will not be wrongfully charged.

This is kind of a case of, “everybody would drive safer if instead of a airbag you had a bunch of knives that shoot out and kill you if you get in a crash”.

[1] https://www.law.cornell.edu/wex/fair_credit_billing_act_(fcb...

Re: The underground world of credit card network exploitation

#23

Post by __MatrixMan__ »

selimthegrim wrote: post #9
bonzini wrote: post #5

Earlier quoted context omitted.

"banks (usually American ones) will happily accept transactions that have incorrect full name, invalid CVV / CVC, wrong expiration date, only partial billing address provided, with incorrect ZIP code. All of the above is still not enough to trigger a 3D secure authorisation" The solution indeed is to write manual rules to trigger 3D secure.

I’ve seen verified by visa triggered a few times for online purchases

... Which is hell if you're in a country where your sim card doesn't work and your bank requires sms 2fa.

Re: The underground world of credit card network exploitation

#24

Post by drdaeman »

paxys wrote: post #7
myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

Not sure I understand. Does everyone outside the US have a card reader attached to their PC and phone?

I have never ever seen an online payment processor that was capable of using a card reader to perform a transaction from a webpage (on a non-specialized device). I don't think there is even any established standard for using a smartcard from a website. WebUSB/WebNFC may work (although browsers have blacklists of vendor IDs to disallow access to e.g. Yubikeys, so at least some smartcards may not be accessible this way), but that's all experimental and questionable stuff.

It might've been possible someone had something like that in ol' good '00s with ActiveX, but that must've been surely an exception (and a security nightmare).

Re: The underground world of credit card network exploitation

#25

Post by paxys »

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business.

Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes.

Banks and payments processors are themselves incentivized to push through transactions as quickly and easily as possible so people spend more (yay consumerism!), and like the author said you mostly don't even need to input the right expiry date, billing address or zip code.

The drawback of course is that all of the liability is pushed on to the business, and so they have to raise prices for everyone to make up for it.

Re: The underground world of credit card network exploitation

#26

Post by lotsofpulp »

alsodumb wrote: post #3
Faaak wrote: post #2

Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SMS, phone app, ...)

That’s not the case in US. It’s kinda funny, but the only time Chase and Amex credit cards asked me for 2FA (I didn’t even know they had 2FA) was when I used them to purchase some things in Indian website through local payment provider (Razorpay).

I have seen it multiple times at BestBuy.com and HomeDepot.com, and probably others.

Re: The underground world of credit card network exploitation

#27

Post by appplication »

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves.

This author is jumping out of the frying pan and into the fire. ChatGPT is cool and all, but the fact that they’re trusting it to write critical code for handling their customers money speaks volumes. They’re incredulous at how they feel Stripe violated their trust in it to manage fraud, but then go ahead and blindly place it in another technology they don’t understand. The problem isn’t Stripe (though, yes, they should fix this), it’s the fact that they are just giving away trust and hoping for the best.

Re: The underground world of credit card network exploitation

#28

Post by lotsofpulp »

Veserv wrote: post #22
myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

Because the banks and vendors are liable for unauthorized charges in the US [1], not the user. The banks/vendors handle the fraud in aggregate on the backend. They could roll out fraud prevention at the end-user level, but they choose not to; which means it is probably not worth it for the issuer relative to the extra user convenience (and extra charges). In contrast, in many places in Europe the user is responsible…

Not even banks, only vendors are responsible if they do not upgrade their POS systems since sometime in the late 2010s I think.

See EMV fraud liability shift.

https://www.mastercard.us/content/dam/mccom/en-us/documents/...

Re: The underground world of credit card network exploitation

#29

Post by _feus »

Usually these transactions are automated with the checkers. Some are as simple as a PHP script replaying a request, some are more sophisticated that use residential proxies, some are parts of huge enterprises like try2check. If you have a list of IPs, you can scan them for 80/443 open and sometimes catch simple checkers in action.

Re: The underground world of credit card network exploitation

#30

Post by notyourwork »

paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

I'm not sure how much extra I pay but the hassle free peace of mind I have seems worth it.
Post reply on HN