Tag Info

Hot answers tagged

26

You don't actually need the CVV to perform transactions, they're just required by most retailers as a means of verifying that you have the physical card in your possession. From Wikipedia (unsourced): It is not mandatory for a merchant to require the security code for making a transaction, hence the card is still prone to fraud even if only its number ...


25

I'm not an expert at using stolen credit cards... but from what I know: You could resell the numbers on the black market. You could buy stuff and have it shipped to a rube who reships it to you. You could "quickswap" on eBay. (Use the credit card to purchase an item that is shipped directly to the auction winner, and you pocket the money from the auction ...


21

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


20

Given that you have strong verification of name / address, etc., it's most likely that your site is known to return different values for different types of errors. The best thing you can do to discourage card testing is to ensure that any declined transactions provide the same result regardless of the reason that the processor told you it was declined.


19

You can use a "CAPTCHA" mechanism to limit brute force attacks. Depending on the product, you could possible configure the CAPTCHA to block a user from submitting another transaction after some many fails attempts; and or, introduce a time limit (e.g. 15~20 secs) between transactions. If possible, you could also try an authentication mechanistic for your ...


15

Aside from the already mentioned attacks involving unauthorized usage of a credit card, the credit card information can also be used for social engineering and identity theft. As a somewhat current example, see how Mat Honan got hacked last summer : http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ In his case, Apple only required ...


13

Basically, someone stealing CC numbers will need to find a way to monetize them. This can be done for instance by printing fake cards with the stolen info, using them to buy goods and then sell those goods again. For someone who only wants to do the hacking part (not the real-life monetizing part that includes shopping), selling the stolen CC no's to people ...


13

You're attempting to uniquely identify something through a system that was somewhat designed to not require a unique identity. Short of tying and validating to a 3rd party (usually physical) identifier, this is impossible. Instead, your best bet is to restrict voting altogether, in a manner that discourages automation and/or quick results. If your system ...


12

Here's an example of a scam to pull money from stolen credit cards by gambling online: Obtain 10,000 credit card #s. Sign up for online gambling accounts using these cards, attempting to charge $100 to gamble with. Let's say 10% actually work - now you have 1,000 accounts and $100,000 to gamble with. Play these accounts, losing to a select few accounts. ...


10

You would need CVV and expiration date for verification, although expiration date is on the front face of a card. Also required is the billing address, or at a minimum, the zip code of the billing address, neither of which are on the front or back of the card. However, this depends on whether you're buying something retail, in person versus online. If you ...


10

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a purely loosing battle and you take a chance every time you use an atm. Security is ...


9

If your attackers are using sequential account numbers then that's a giveaway you can use to filter attempts. If someone tries 001, then 002, then 003 it's a pretty good guess that they are carding and you can then filter attempts from that IP address. The thing is that smart attackers will then modify their attacks by randomizing the card numbers they ...


9

This is precisely as secure as depositing a check at the ATM. You could go up to an ATM, pop in your debit card and say you're depositing $3500, put a blank piece of paper in a deposit slip and deposit it. Same rules apply with the tech you describe as an ATM: Try to fool it, and when time comes around to actually push the routing numbers and bank account ...


8

Any thoughts on how we can prevent this situation? 1) Fraud is higher with CNP (Card Not Present) transactions, not the least because it's easiest to get away with. If the purchaser says they never received it and files with the card company, the card company takes their side unless you have a signed slip - which CNP transactions never have. So for ...


7

Payment protocols have many variants. However, they mostly boil down to the three following: The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently ...


6

Voting systems are "gamed" by people voting more times than should be normally allowed (e.g. voting several times). The only way to prevent this is to have a way to identify voters and to prevent multiple votes. Reliable methods entail authenticating users, e.g. with passwords, but this has two drawbacks, namely that 1. users don't like it, and 2. this does ...


6

The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering. A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...


5

Is a fake certificate only useful in combination of a DNS hijack (or any other method that will point the fake cert's target domain to a fraudulent IP, e.g. modifying hosts file etc?) ... or man-in-the-middle by means of ARP or routing table changes by an ISP. In any case, some redirection that is undesirable for the end user must also occur. The area ...


5

The only technical solution you may have available to you is to train the user data (such as name, address, IP, etc. information) within some form of spam agent. Similar to an email spam categorizer, this could be used to create your "evil Turing test" that you require. You may consider treating this like a spam problem and see what kinds of solutions ...


5

The industry's answer to this is Chip-and-PIN (as it's known in the UK), where the card holder must enter their personal identification number into the card terminal for every card-present transaction. It has reduced card-present fraud by around 80%. Unfortunately, it has not yet seen widespread deployment in the US, which is causing problems for US card ...


5

I don't think this person (people) care about whether or not they get valid numbers since as you say you're validating with addresses as well, and they are trying sequentially. Getting blocked by CC processor could actually be a goal, especially if they are your competitors or they're doing it for the lulz. There's a couple of options I can add to the list: ...


5

When this was happening to an organization I know, they told their processor to decline all charge amounts below a certain threshold. This stopped the low value transactions completely, and the carders quickly left their site alone. If you haven't done anything about it yet, consider contacting your local FBI office. They may be interested in the case. ...


5

It all depends on the scope of the audit. If the audit is purely of the code (ie give the auditor a copy of the code, they audit it and return a report) then it could be very easy to tamper with it after the fact. If the audit is a bit more comprehensive, and includes the code development, test and promotion to live environment procedures, then you should ...


5

Ultimately, authentication of this kind is very hard when the person being authenticated is the attacker. If there are reliable government records, requiring these be presented (if allowed) is probably a good start. Proper training of security staff is also critical to ensure that they perform a thorough check regardless of the possibility of conflict. ...


5

AJ Henderson has the right solution IMHO. To expand on his approach here are the basics: There has to be a security briefing for invigilators explaining the various ways that official government ID can be checked. They should be warned that your company will stage fake impersonations to test their attention. Invigilators who would check IDs have to be ...


5

Two factor authentication with Biometrics will definitely do the job but I would like to point out some issues with this technology. It is costly. This includes the cost of the devices and the manpower required to develop the system handle the registrations. There is no single standard to store the biometric data that the world follows. Different devices ...


5

Phone numbers are easy to come by as are credit card numbers. Most credit card companies offer 1 time use credit card numbers and phone numbers can be had for less than a couple of bucks per month. It wouldn't be that hard to setup many SkypeIn or Google Voice numbers for example to get around the phone system issue. It would make things a little bit ...


4

If I am correct in saying that you issue a live paper check to someone one measure to put in place is the address. If you structure it like radio stations do and make it so only one entry per household / address this could prevent some cheating. In terms of trying to prevent someone from cheating in the first place you probably want to look at the online ...


4

@logicalscope raises some good suggestions, but overall you still have to deal with one cold hard fact: Technically speaking, even this Nigerian prince guy is a perfectly valid user. The only problem with him, is that he does not own the credit cards which he is providing - notwithstanding the fact that he provided all the validation necessary. ...


4

It's worth mentioning that American Express credit cards do have the CVV on the front side (not the back), along with the card number, the cardholder name, and the expiration date. Therefore, disclosing the front face of an Amex card would allow arbitrary purchases, even card-not-present purchases.



Only top voted, non community-wiki answers of a minimum length are eligible