Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

201–210 of 280 posts

Re: The underground world of credit card network exploitation

#201

Post by climb_stealth »

b112 wrote: post #100
mrdatawolf wrote: post #95

Earlier quoted context omitted.

My current suggestion is to consider it the work of a just on-boarded intern. It will save you some time but you still need to walk thru the code to make sure it will work as intended.

My experience has been it's faster to write code yourself, than via a just on boarded intern + review + fixes.

Yes, but part of that time is an investment into the intern's professional development. Everyone started there at some point.

It can be hard to remember though when there are unrealistic deadlines and helping someone inexperienced to do the work is twice the effort.

Re: The underground world of credit card network exploitation

#202

Post by pas »

creeble wrote: post #194
nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

None of these comments seem relevant to TFA, which is specifically about card-not-present fraud. Chip and PIN doesn't work for internet payment. Bank transfers don't work well internationally. It is trivial to turn on AVS (address verification) and CVV, but it can result in more declined-yet-legitimate transactions. Sometimes that outweighs the fraud risk that these catch. The responsibility for fraud is pushed to th…

Lack of initial (mobile app push notification based) verification for saving the card data is the issue, no?

Re: The underground world of credit card network exploitation

#203

Post by wpietri »

baby_souffle wrote: post #104
wpietri wrote: post #75

Earlier quoted context omitted.

Things have definitely changed here recently. At least in San Francisco, at-table terminals are now the norm in sit-down restaurants. Staff generally use the same device for order-taking and payment.

> Things have definitely changed here recently. At least in San Francisco, at-table terminals are now the norm in sit-down restaurants. Staff generally use the same device for order-taking and payment. I used to work in PoS industry. This tech is new-ish to the US but not to the rest of the first-world. 15 years ago, paying with a CC @ the table was common in Europe, but the terminal could ONLY do payments. The devic…

For sure. "Bring the card to the device" and "bring the device to the card" seem about equivalent to me in convenience unless the device is something that the waitstaff is going to carry all the time anyhow.

Re: The underground world of credit card network exploitation

#204

Post by Jon_Lowtek »

tobi1449 wrote: post #117
delusional wrote: post #98

Earlier quoted context omitted.

Your causality chain doesn't track for me. Here in Denmark we have the same consumer protections, the ability to do chargebacks and the (government funded) guarantee that the consumer does not lose any money if their bank account is drained. Yet we still have very strong protections at the time of purchase with mandatory chip-and-pin as well as 3D secure (which replaced Verified by Visa). I don't really think there's…

My guess is the difference lies in the fact that the EU limits credit card fees to something around 0.5% That means the CC companies can't offload the financial burden of this onto the vendors (and they in turn onto their customers), which leads to them having an actual incentive to improve security.

The incentive for payment providers to improve their security is a regulation called PSD2 which directly requires strong customer authentication.

Re: The underground world of credit card network exploitation

#205

Post by aliceryhl »

TacticalCoder wrote: post #70
chpatrick wrote: post #13

Earlier quoted context omitted.

I've lived in Europe my whole life and I've never made an online payment with a card reader (even though my ThinkPad has one), or know anyone who has.

But you do use 2FA when paying with your credit card online. What kind of 2FA does the bank providing your credit card mandate you to use?

In Denmark, there's a national system for authentication used for government sites and banks. I have a small device with a single button on it that shows a 6-digit code when you press it. I enter that code along with a password any time I make a purchase online.

(There's also an app that most people use. But I like the hardware thingy better.)

Re: The underground world of credit card network exploitation

#206

Post by pas »

Detrytus wrote: post #188
alexvoda wrote: post #31

Earlier quoted context omitted.

Then it's a good thing that many banks in the EU now have 3DSecure validation through the phone app instead of SMS

What if you lose your phone? In my country banks only allow you to use one phone for mobile authorization, so you can't even have a backup phone. I really wish 3DSecure was optional so I can turn it of when going to foreign vacation.

On a vacation I have my card (and can use PIN auth), the issue is usually online transactions ("card not present", ie. vPOS transactions).

Re: The underground world of credit card network exploitation

#208

Post by TrackerFF »

cubefox wrote: post #79
BaseballPhysics wrote: post #55

Earlier quoted context omitted.

A massively diverse and deregulated banking sector. The US has literally thousands of small regional banks across 50 fairly independent states. Rolling out major new technologies in that environment is far far harder.

The number of banks in the US seems perfectly normal. Germany has ~1500 for 80 million inhabitants, the US has ~4800 for 300 million.

If Germany is anything like the Scandinavian countries, those banks will just be branches of a handful of different banks.

We really don't have any microbanks that need to roll out their own tech for everything - most are just part of the larger banks, and get all the infrastructure provided for them.

Re: The underground world of credit card network exploitation

#209

Post by headsupftw »

appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

What are you even talking about? Read the blog post one more time, please.

Re: The underground world of credit card network exploitation

#210

Post by AussieWog93 »

appplication wrote: post #86
flutas wrote: post #60

Earlier quoted context omitted.

> the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks Feels like a mischaracterization tbh. He had it make a script to go through and accept the chargebacks for these accounts, not handle payment processing or do anything to the chargebacks other than click "accept" essentially. > And based on the context in the article, the author sounds like they lacked th…

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

I've used ChatGPT (GPT-4) to write production code.

As long as you keep the scope small ("Write some example code that calls $API in Python", "Make it asynchronous; so I can queue up n calls and execute them in parallel"), it generates perfectly good code that is easy to understand too.

Post reply on HN