Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

231–240 of 280 posts

Re: The underground world of credit card network exploitation

#231

Post by Sylamore »

acdha wrote: post #106
vladms wrote: post #38

Earlier quoted context omitted.

"Hassle free peace of mind" meaning you do not need to remember a 4 digit code (or clicking "yes" in a phone app), while you need to check your credit card transaction list regularly to reject fraudulent transactions? I find the effort of remembering the 4 digit code/having the phone much smaller than the alternative ...

I’ve never had a card stolen where either of those would have helped - they’re stopgaps trying to avoid upgrading the banking system to use public-key encryption with reuse protection. A couple of times, merchants with my card on file were compromised. The thief could make charges because the merchant had to be able to as well. What would have stopped that would have been having a way to restrict a charge to a partic…

>What would have stopped that would have been having a way to restrict a charge to a particular merchant so the attacker couldn’t have been able to get the money out.

This is one of the primary use cases for privacy.com (if you are in the US). The virtual cards are either single-use only or they are merchant locked, plus you can set spending limits on the card. I use these for 100% of my online and recurring payment transactions now. The only downside is that it's linked to your bank account so it's debt transactions only, but that's not necessarily a downside to me.

Re: The underground world of credit card network exploitation

#232

Post by johnsimer »

KRAKRISMOTT wrote: post #142
mrguyorama wrote: post #138

Stripe is god awful at fraud prevention and it's intentional. They are explicitly outsourcing the cost of risk management to their clients. It's obscene. I work in the credit card fraud prevention field, and I'm not even that good at my job, but our team of like 3.5 people easily built and maintained a system that prevents this exact kind of carding attack. The primary way for a business to prevent carding attacks is…

They want to nickel and dime you and make you pay for Radar. It's the exact same strategy with Stripe Taxes and their terrible currency conversions. Provide no service up front and eventually you realize your stripe transaction hits two digit percentage of your overall price.

What do you recommend as an alternative to stripe?

Re: The underground world of credit card network exploitation

#233

Post by kshacker »

kiratp wrote: post #219
skybrian wrote: post #124

Earlier quoted context omitted.

I expect it’s path-dependent legacy practices more than anything else. Credit cards were invented in the US, so the tech is old and upgrades take a long time. For manual payments, UPI in India sounds pretty great. Apparently the customer approves each payment on their phone before it goes through?

UPI is a terrible thing. 0) makes every transaction a trivial SQL query away for the government. 1) everything needs an SMS code. Just as we are trying to get everyone off SMS 2FA 2) doesn’t work for non-Indian numbers or roaming devices 3) can’t get an Indian SIM without proof of address etc. No burners in India 4) regulation expressly forbids devic-local biometrics. This is why there is no Apple Pay in India. 5) Bi…

It may be a terrible thing but it has brought such a big change to the Indian economy. Imagine doing that in US which is a much smaller population and all you get is "choice" aka "freedom" to pay 3-5% credit card fee per transaction.

Re: The underground world of credit card network exploitation

#234

Post by [deleted] »

kredd wrote: post #111
appplication wrote: post #86

Earlier quoted context omitted.

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

Frankly speaking, probably the latter. I've been using Copilot for over a year now, and obviously it makes stupid mistakes, but it sped up my general coding speed. Now, I don't have much experience (maybe around 10ish years of programming professionally) in comparison to greybeards, but it works. Haven't used ChatGPT much, but as long as the user understands its shortcomings and reviews/refines its outputs, it's fine…

[deleted]

Re: The underground world of credit card network exploitation

#235

Post by nitwit005 »

cesarb wrote: post #74
deathanatos wrote: post #48

Earlier quoted context omitted.

That part of the article was news to me. Like, why do I have to deal with CVVs, expiration dates, zip codes, (not to mention the resulting work from the fallout from the fraud) … if it doesn't even matter? How many person years of human life per year could pursue something … worthwhile … if we checked the CVV?

It makes sense to me that zip codes don't matter (or might be a weak signal), since some countries might not have postal codes, or might have a different postal code format. But I agree with you that it doesn't make sense to not check the CVV and expiration date; both are printed directly in the card, and should match exactly (unlike the card owner name, which is also printed in the card, but the user might type it d…

Haven't dealt with credit cards, but people often have the zip code wrong on their address. The mail gets delivered if the rest of the information is correct.

I assume that makes it hard to be strict about zip code.

Re: The underground world of credit card network exploitation

#236

Post by Ubergeek99 »

Cloudflare has tools to prevent too many form submits. You can specify which page, how many submits and so on.

I found out about this when I had a problem of somebody running a script of trying different credit cards over a two hour window.

My payment processor told me I should prevent these types of things. So I investigated and never had this problem anymore.

Cloudflare is amazing at preventing all kinds of attacks. I love Cloudflare.

Re: The underground world of credit card network exploitation

#237

Post by KRAKRISMOTT »

johnsimer wrote: post #232
KRAKRISMOTT wrote: post #142

Earlier quoted context omitted.

They want to nickel and dime you and make you pay for Radar. It's the exact same strategy with Stripe Taxes and their terrible currency conversions. Provide no service up front and eventually you realize your stripe transaction hits two digit percentage of your overall price.

What do you recommend as an alternative to stripe?

You pool your payment providers using something like

https://hyperswitch.io

Re: The underground world of credit card network exploitation

#238

Post by [deleted] »

mrguyorama wrote: post #138

Stripe is god awful at fraud prevention and it's intentional. They are explicitly outsourcing the cost of risk management to their clients. It's obscene. I work in the credit card fraud prevention field, and I'm not even that good at my job, but our team of like 3.5 people easily built and maintained a system that prevents this exact kind of carding attack. The primary way for a business to prevent carding attacks is…

[deleted]

Re: The underground world of credit card network exploitation

#239

Post by [deleted] »

johnsimer wrote: post #232
KRAKRISMOTT wrote: post #142

Earlier quoted context omitted.

They want to nickel and dime you and make you pay for Radar. It's the exact same strategy with Stripe Taxes and their terrible currency conversions. Provide no service up front and eventually you realize your stripe transaction hits two digit percentage of your overall price.

What do you recommend as an alternative to stripe?

[deleted]

Re: The underground world of credit card network exploitation

#240

Post by ec109685 »

kredd wrote: post #111
appplication wrote: post #86

Earlier quoted context omitted.

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

Frankly speaking, probably the latter. I've been using Copilot for over a year now, and obviously it makes stupid mistakes, but it sped up my general coding speed. Now, I don't have much experience (maybe around 10ish years of programming professionally) in comparison to greybeards, but it works. Haven't used ChatGPT much, but as long as the user understands its shortcomings and reviews/refines its outputs, it's fine…

ChatGPT Plus even better. Uses GPT-4, so much more capable.
Post reply on HN