Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

251–260 of 280 posts

Re: The underground world of credit card network exploitation

#251

Post by vsl »

delusional wrote: post #98
paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

Your causality chain doesn't track for me. Here in Denmark we have the same consumer protections, the ability to do chargebacks and the (government funded) guarantee that the consumer does not lose any money if their bank account is drained. Yet we still have very strong protections at the time of purchase with mandatory chip-and-pin as well as 3D secure (which replaced Verified by Visa). I don't really think there's…

Did you ever try a chargeback? With EU banks, it’s a bureaucratic process in my experience, filling forms, dealing with humans, waiting for merchant response, proving contact with them etc. US banks seem to operate on a magic word “chargeback”: you utter it, the charge is reversed, done.

Re: The underground world of credit card network exploitation

#252

Post by KirillPanov »

deathanatos wrote: post #147
zaroth wrote: post #118

Earlier quoted context omitted.

I don’t understand not checking CVV and Expiration Date at all… But for the other info, they could be carding for prepaid cards which have no name, address, or ZIP code to verify against?

Do prepaids not have ZIPs? So many things demand this info (heck, even some gas pumps…) … what do people enter at those prompts? (I left out name; I assume name isn't matched against, given how fuzzy of a field it is. Most sites don't even prompt for the information accurately enough to make a match anyways.)

> what do people enter at those prompts?

11111

I'm serious. That's the "zip code" assigned to cards without a zip code.

Re: The underground world of credit card network exploitation

#253

Post by t0mas88 »

paxys wrote: post #7
myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

Not sure I understand. Does everyone outside the US have a card reader attached to their PC and phone?

No it's much simpler than that. You either confirm the transaction on your phone with pin or FaceID, without the card involved. Or if the amount is too high (50k+ at my bank) or you don't have your phone, you use a small device provided by the bank.

The device reads your card, asks for the pin and then spits out a 2FA code to enter on the website or app. The old ones only did this code thing (usually with SMS as a backup way to get the code, but most banks have moved away from sms now). Some more advanced ones have a digital signing capability by taking a photo from a QR-like code on the computer screen and then displaying the signing code for you to enter.

These advanced ones are a bit out of use now that everyone uses the mobile app, except for business accounts and larger amounts like my bank's 50k limit on mobile app confirmation. But I don't regularly transfer more than 50k in one transaction anyway.

Edit: Here is a picture of one that we use with a large Dutch bank for our business account with the QR-code reading thing: https://4.bp.blogspot.com/-6c1NGHew1P8/VBqvTeqDQdI/AAAAAAAAf...

Re: The underground world of credit card network exploitation

#254

Post by nerdawson »

wpietri wrote: post #203
baby_souffle wrote: post #104

Earlier quoted context omitted.

> Things have definitely changed here recently. At least in San Francisco, at-table terminals are now the norm in sit-down restaurants. Staff generally use the same device for order-taking and payment. I used to work in PoS industry. This tech is new-ish to the US but not to the rest of the first-world. 15 years ago, paying with a CC @ the table was common in Europe, but the terminal could ONLY do payments. The devic…

For sure. "Bring the card to the device" and "bring the device to the card" seem about equivalent to me in convenience unless the device is something that the waitstaff is going to carry all the time anyhow.

In one scenario, the waitstaff disappear with your credit card for an extended period of time. In the other, the card never leaves your sight.

Re: The underground world of credit card network exploitation

#255

Post by saiya-jin »

kredd wrote: post #111
appplication wrote: post #86

Earlier quoted context omitted.

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

Frankly speaking, probably the latter. I've been using Copilot for over a year now, and obviously it makes stupid mistakes, but it sped up my general coding speed. Now, I don't have much experience (maybe around 10ish years of programming professionally) in comparison to greybeards, but it works. Haven't used ChatGPT much, but as long as the user understands its shortcomings and reviews/refines its outputs, it's fine…

Tons of production code, even in flows directly related to money (banks, payment portals etc) are hacked together from various stack overflow posts, not always with full understanding of the shortcomings, corner cases etc. Typical is some complex regex.

Re: The underground world of credit card network exploitation

#256

Post by lxgr »

cubefox wrote: post #171
Brystephor wrote: post #80

Earlier quoted context omitted.

I think "secure" is the key part that's missing here. There's no incentive for a consumer to use a payment method such as this when paying with a bank. The reason is that credit cards come with consumer protection that this just doesn't offer.

I don't think customer protection is necessary unless you are dealing with unusually small or shady companies. I live in Germany and do not own a credit card, they are uncommon here. Mostly we pay per bank transfer or debit card. Even with the possibility of fraud, this is probably significantly cheaper in expectation than paying a 2% credit card fee each time just to have the possibility of chargeback.

Have you ever considered that what’s keeping most companies proactively honest and consumer-friendly are consumer protection laws and regulations?

Re: The underground world of credit card network exploitation

#257

Post by lxgr »

pas wrote: post #197
carlosjobim wrote: post #165

Earlier quoted context omitted.

> The EU caps it at 0.3% maximum That's completely untrue. Most European businesses pay much more than that.

You're mixing up total cost of processing the card (which is what Stripe and other gateways charge) with the Visa/MC rent. https://ec.europa.eu/commission/presscorner/detail/fr/MEMO_1... "Therefore, the Regulation caps interchange fees for consumer debit cards to 0.2 % and consumer credit cards to 0.3 % of the value of the transaction."

The (now called) interchange fees go to the card issuing banks, not the card networks. Both network/scheme fees and processor fees come on top of that.

Re: The underground world of credit card network exploitation

#258

Post by lxgr »

acdha wrote: post #106
vladms wrote: post #38

Earlier quoted context omitted.

"Hassle free peace of mind" meaning you do not need to remember a 4 digit code (or clicking "yes" in a phone app), while you need to check your credit card transaction list regularly to reject fraudulent transactions? I find the effort of remembering the 4 digit code/having the phone much smaller than the alternative ...

I’ve never had a card stolen where either of those would have helped - they’re stopgaps trying to avoid upgrading the banking system to use public-key encryption with reuse protection. A couple of times, merchants with my card on file were compromised. The thief could make charges because the merchant had to be able to as well. What would have stopped that would have been having a way to restrict a charge to a partic…

> upgrading the banking system to use public-key encryption with reuse protection.

This is exactly what chip and PIN does. The chip is a smart card holding keys; the PIN authorizes its use. Online, there is 3DS which can be used similarly.

We’ve had both of these tools for over 20 years now. It’s just a question of how much the industry is choosing to cater to convenience and backwards compatibility, i.e. a security/availability trade off.

In Europe, the regulator has made the choice for the industry instead.

Re: The underground world of credit card network exploitation

#259

Post by lxgr »

np- wrote: post #126
nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

> In a culture that accepts widespread card fraud, costs increase to offset it. Maybe, maybe not, but this is a very simplistic way of looking at it. If credit card fraud is responsible for X% of total charges, they can spend effort to deal with it, OR they can simply not deal with it and keeping the transactions going while eating the cost, they may be able to serve Y% more customers where Y > X and thus end up with…

> serve Y% more customers where Y > X and thus end up with more profit in the long run.

That’s the micro/local view, and any rational company in the US will do something close to that. There is no local incentive to set the “fraud/friction” to anything other than their competitors.

On the macro level though, if the dial is moved for everyone (i.e. by regulation; the card schemes have tried to make this happen via incentives in the form of the liability shift, but it still wasn’t enough), there’s a chance for increased total efficiency.

The cool thing is that Europe is running this experiment currently – let’s see how it goes.

Post reply on HN