Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

71–80 of 280 posts

Re: The underground world of credit card network exploitation

#71

Post by wpietri »

appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

I'm a huge LLM skeptic, but I'd disagree with you here.

I think using ChatGPT to write long-lived code for a serious application is a bad idea. But I think it's fine for somebody knowledgeable to use it for throwaway and first-draft stuff in areas that aren't their daily work.

Here's the author in question: [edit: wrong Piotr Mierzejewski in tech, see below]

He looks perfectly competent to me to evaluate the effects of some one-shot scripting code, so I think "giving away trust and hoping for the best" is a wild exaggeration of what actually went on.

Re: The underground world of credit card network exploitation

#72

Post by cubefox »

treadmill wrote: post #53
trompetenaccoun wrote: post #46

Earlier quoted context omitted.

And that is in addition to the outrageous fees CC companies charge merchants. In the US it's typically around 2% of the transaction! The EU caps it at 0.3% maximum, which still seems like a lot when you consider how much money they move. That's another cost that gets socialized and passed on to the consumer of course, even shoppers who pay cash have to pay for this through higher prices. People should know btw that w…

Wild idea: What if secure digital payment was a public service.

FedNow:

https://www.federalreserve.gov/newsevents/pressreleases/othe...

Unfortunately not many banks support it yet.

Re: The underground world of credit card network exploitation

#73

Post by pimpl »

wpietri wrote: post #71
appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

I'm a huge LLM skeptic, but I'd disagree with you here. I think using ChatGPT to write long-lived code for a serious application is a bad idea. But I think it's fine for somebody knowledgeable to use it for throwaway and first-draft stuff in areas that aren't their daily work. Here's the author in question: [edit: wrong Piotr Mierzejewski in tech, see below] He looks perfectly competent to me to evaluate the effects…

Appreciate the comment! Just a quick note that this is my LI profile: https://www.linkedin.com/in/pmierzejewski/

Re: The underground world of credit card network exploitation

#74

Post by cesarb »

deathanatos wrote: post #48
nickdothutton wrote: post #39

I’ve always found it incredible that US banks often require only the card number to perform a transaction. All those “card generators” I used to see uploaded to BBS in the late 80s and early 90s make sense.

That part of the article was news to me. Like, why do I have to deal with CVVs, expiration dates, zip codes, (not to mention the resulting work from the fallout from the fraud) … if it doesn't even matter? How many person years of human life per year could pursue something … worthwhile … if we checked the CVV?

It makes sense to me that zip codes don't matter (or might be a weak signal), since some countries might not have postal codes, or might have a different postal code format. But I agree with you that it doesn't make sense to not check the CVV and expiration date; both are printed directly in the card, and should match exactly (unlike the card owner name, which is also printed in the card, but the user might type it differently, for instance typing in full their middle name when it's abbreviated in the card).

Re: The underground world of credit card network exploitation

#75

Post by wpietri »

ActivePattern wrote: post #65
nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

As a Canadian, it does feel like stepping out of a time machine when you pay at restaurants in the USA. Instead of using a terminal at the table to pay yourself, you need to give the server your card and wait for them to manually process it somewhere. Maybe things have progressed in recent years. But we haven't done it that way in Canada since the early 2000's.

Things have definitely changed here recently. At least in San Francisco, at-table terminals are now the norm in sit-down restaurants. Staff generally use the same device for order-taking and payment.

Re: The underground world of credit card network exploitation

#76

Post by DarkGauss »

nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

We still do not use chip-and-pin on credit cards in the US. We use chip-and-signature for most credit cards. I'm not saying there aren't credit cards with chip-and-PIN, there are a some.

We do use chip-and-PIN on most debit cards, but even that can be bypassed on 99% of terminals to fall back to chip-and-signature.

Re: The underground world of credit card network exploitation

#77

Post by itscodingtime »

appplication wrote: post #27

What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. This author is jumping out of the frying…

I find it odd Chatgpt was mentioned at all. It was almost like an advertisement.

I have read post linked here similar to this one, but I can’t recall another instance in which the author abruptly said they relied on stackoverflow to code something unless the content was a meta commentary on coding and debugging itself.

Re: The underground world of credit card network exploitation

#78

Post by TacticalCoder »

paxys wrote: post #7
myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

Not sure I understand. Does everyone outside the US have a card reader attached to their PC and phone?

Not everyone and it's not necessarily connected to the PC. Some card readers are, some aren't.

And there are two things that are not to be confused: electronic ID card readers (used for stuff like VAT tax filings, income tax filings, etc.) and debit/credit card readers (which may or may not be connected to the PC) used as 2FA (with a challenge/response). The ones that aren't connected to the PC generate a number which you then enter to confirm you login/order.

Many banks in the EU enforce at least one type of 2FA. The shittiest, most pathetic ones, still do it by SMS (but it's still 2FA and still better than nothing). Others use a card reader (in which you literally plug your bank card, which signs orders / challenge/response style and never leak the card's secret). Other give a physical RSA-like token with codes changing every x second. Others allow the use of an app on a smartphone to confirm transactions.

When I log to at least one of my bank I've got a list asking me which type of 2FA I'll use to log in and confirm payments. Card readers (two different types) are on the list.

I use that to log in, confirm wire transfer and buy stocks too.

Re: The underground world of credit card network exploitation

#79

Post by cubefox »

BaseballPhysics wrote: post #55
nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

A massively diverse and deregulated banking sector. The US has literally thousands of small regional banks across 50 fairly independent states. Rolling out major new technologies in that environment is far far harder.

The number of banks in the US seems perfectly normal. Germany has ~1500 for 80 million inhabitants, the US has ~4800 for 300 million.

Re: The underground world of credit card network exploitation

#80

Post by Brystephor »

cubefox wrote: post #72
treadmill wrote: post #53

Earlier quoted context omitted.

Wild idea: What if secure digital payment was a public service.

FedNow: https://www.federalreserve.gov/newsevents/pressreleases/othe... Unfortunately not many banks support it yet.

I think "secure" is the key part that's missing here. There's no incentive for a consumer to use a payment method such as this when paying with a bank. The reason is that credit cards come with consumer protection that this just doesn't offer.
Post reply on HN