Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

Post reply on HN
Print view View original

91–100 of 280 posts

Re: The underground world of credit card network exploitation

#91

Post by Dma54rhs »

tlogan wrote: post #83
nerdawson wrote: post #42

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

In my view, the U.S. is leading the way in this area. Europe seems to be shifting the burden of fraud prevention onto customers with methods like SMS notifications and pins. In contrast, in the U.S., banks and businesses are primarily responsible for dealing with fraud.

It's not leading the way technically but for the end consumer it might be better. If I get charged unfairly my bank will tell me to go to the police. Americans can easily just refuse it.

Re: The underground world of credit card network exploitation

#92

Post by LelouBil »

TacticalCoder wrote: post #70
chpatrick wrote: post #13

Earlier quoted context omitted.

I've lived in Europe my whole life and I've never made an online payment with a card reader (even though my ThinkPad has one), or know anyone who has.

But you do use 2FA when paying with your credit card online. What kind of 2FA does the bank providing your credit card mandate you to use?

For me (in France) it's the bank app's 2FA or sms 2FA if not available.

Re: The underground world of credit card network exploitation

#93

Post by __MatrixMan__ »

myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

The rest of the world has to put up with the US banking system because when all you have is an overfunded military, everything looks like a target.

That logic doesn't quite translate internally, so it's important to maintain the perception that the banking system is all that stands between the little people and a hungry mob of scammers. If the scam problem were demonstrably easy to solve at the POS, it would be harder to justify the merchant fees and other bank-related overreach.

Re: The underground world of credit card network exploitation

#94

Post by delfinom »

paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

Hah, I found the focus on American banks funny because, the one telegram photo said to use the address of Paris France.

Let me tell you, on two different organizations I am part of, I have ran in the last 2 years, both got hit by automated credit card checking bots using French banks and alot of those cards succeeded.

(Of course there's a whole story about how both these orgs have resisted my previous warnings about hardening the payment sites...one of them even was still using Magento 1)

Anecdotal but meh, the real problem is credit cards are just as much as kludged relics as ACH that nobody wants to really fix meaningfully

Re: The underground world of credit card network exploitation

#95

Post by mrdatawolf »

appplication wrote: post #86
flutas wrote: post #60

Earlier quoted context omitted.

> the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks Feels like a mischaracterization tbh. He had it make a script to go through and accept the chargebacks for these accounts, not handle payment processing or do anything to the chargebacks other than click "accept" essentially. > And based on the context in the article, the author sounds like they lacked th…

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

My current suggestion is to consider it the work of a just on-boarded intern. It will save you some time but you still need to walk thru the code to make sure it will work as intended.

Re: The underground world of credit card network exploitation

#96

Post by bze12 »

Some advice I got a while ago about detecting fraud through stripe is you should probably train your own fraud detection model if you’re serious about limiting it and have enough volume. Even something like a simple logistic classifier would work. Stripe radar isn’t tuned to the specifics of your business, and there are other signals you can account for (like which products they’re buying, how long it takes them to buy after opening your site, etc). Custom Radar rules work to an extent.

I get that a lot of indie businesses probably don’t have the resources/want to do this, so there are solutions you can buy, but they’re expensive and mostly targeted at high volume merchants anyway. Maybe stripe launches a fine-tunable radar product someday?

Re: The underground world of credit card network exploitation

#97

Post by zer0x4d »

bonzini wrote: post #5
Faaak wrote: post #2

Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SMS, phone app, ...)

"banks (usually American ones) will happily accept transactions that have incorrect full name, invalid CVV / CVC, wrong expiration date, only partial billing address provided, with incorrect ZIP code. All of the above is still not enough to trigger a 3D secure authorisation" The solution indeed is to write manual rules to trigger 3D secure.

The author is wrong about this.

Banks don't choose to accept incorrect name, invalid CVC, invalid exp date or wrong billing address. It's up to the user (in this case him) to enable CVC Check and AVS in his payment processor to fail payments that don't pass this check. It's also up to him/Stripe to implement 3D secure and trigger it.

https://stripe.com/docs/disputes/prevention/verification#cvc...

Re: The underground world of credit card network exploitation

#98

Post by delusional »

paxys wrote: post #25

If you are a foreign company accepting payments from the USA, you should simply expect this as a cost of doing business. Credit card fraud here is socialized. The end consumer is never liable, and so we don't bother with chip and pin, 2FA, 3D secure or whatever else. If we notice a suspicious transaction we simply tap a button in the bank's app and the charge is reversed in minutes. Banks and payments processors are…

Your causality chain doesn't track for me. Here in Denmark we have the same consumer protections, the ability to do chargebacks and the (government funded) guarantee that the consumer does not lose any money if their bank account is drained. Yet we still have very strong protections at the time of purchase with mandatory chip-and-pin as well as 3D secure (which replaced Verified by Visa).

I don't really think there's a rational reason for why you don't have better card security in the US. You just seemingly don't want it.

Re: The underground world of credit card network exploitation

#99

Post by jon-wood »

paxys wrote: post #7
myself248 wrote: post #4

Why does the US still accept hand-typed cards? My friend had a USB smartcard reader in like 2001. He'd dip his AmEx to perform a transaction on his PC. It's twenty years later and the industry still hasn't caught up? What's different about Europe that they seem to have figured this out decades ago?

Not sure I understand. Does everyone outside the US have a card reader attached to their PC and phone?

They're less common in the UK now mobile apps have taken over, but in the early 2000s banks would issue a standalone device to every customer. When making payments via online banking you'd put your card in the device, hit a button, and give it a code that the online banking page provided. The device then did some magic via the chip on your card to provide a code that you'd give back to the online banking site to validate that you were in possession of your card.

Some banks may have used this for 3D Secure during online card payments as well, but I've never encountered one. Validation for that in my case evolved from setting a password on my account, which they'd ask for some characters from, to tokens sent via SMS to my registered phone number, to a push notification from my bank followed by FaceID to authorise payment.

In person Chip & PIN, and more recently contactless, is ubiquitous. Magstripe payments are so rare I have to explicitly enable them in my bank's app for the card, and it'll turn itself off again 7 days later. I never encountered chip & signature until going to the US, where everyone in the group I was with looked at it like some sort of joke (and indeed it is, because there's no signature recorded against my card for validation).

Re: The underground world of credit card network exploitation

#100

Post by b112 »

mrdatawolf wrote: post #95
appplication wrote: post #86

Earlier quoted context omitted.

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

My current suggestion is to consider it the work of a just on-boarded intern. It will save you some time but you still need to walk thru the code to make sure it will work as intended.

My experience has been it's faster to write code yourself, than via a just on boarded intern + review + fixes.
Post reply on HN