Tag Info

Hot answers tagged

28

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


26

You don't actually need the CVV to perform transactions, they're just required by most retailers as a means of verifying that you have the physical card in your possession. From Wikipedia (unsourced): It is not mandatory for a merchant to require the security code for making a transaction, hence the card is still prone to fraud even if only its number ...


25

I'm not an expert at using stolen credit cards... but from what I know: You could resell the numbers on the black market. You could buy stuff and have it shipped to a rube who reships it to you. You could "quickswap" on eBay. (Use the credit card to purchase an item that is shipped directly to the auction winner, and you pocket the money from the auction ...


23

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


21

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


20

Given that you have strong verification of name / address, etc., it's most likely that your site is known to return different values for different types of errors. The best thing you can do to discourage card testing is to ensure that any declined transactions provide the same result regardless of the reason that the processor told you it was declined.


19

You can use a "CAPTCHA" mechanism to limit brute force attacks. Depending on the product, you could possible configure the CAPTCHA to block a user from submitting another transaction after some many fails attempts; and or, introduce a time limit (e.g. 15~20 secs) between transactions. If possible, you could also try an authentication mechanistic for your ...


15

Aside from the already mentioned attacks involving unauthorized usage of a credit card, the credit card information can also be used for social engineering and identity theft. As a somewhat current example, see how Mat Honan got hacked last summer : http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ In his case, Apple only required ...


14

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


13

Basically, someone stealing CC numbers will need to find a way to monetize them. This can be done for instance by printing fake cards with the stolen info, using them to buy goods and then sell those goods again. For someone who only wants to do the hacking part (not the real-life monetizing part that includes shopping), selling the stolen CC no's to people ...


13

You're attempting to uniquely identify something through a system that was somewhat designed to not require a unique identity. Short of tying and validating to a 3rd party (usually physical) identifier, this is impossible. Instead, your best bet is to restrict voting altogether, in a manner that discourages automation and/or quick results. If your system ...


12

Here's an example of a scam to pull money from stolen credit cards by gambling online: Obtain 10,000 credit card #s. Sign up for online gambling accounts using these cards, attempting to charge $100 to gamble with. Let's say 10% actually work - now you have 1,000 accounts and $100,000 to gamble with. Play these accounts, losing to a select few accounts. ...


10

You would need CVV and expiration date for verification, although expiration date is on the front face of a card. Also required is the billing address, or at a minimum, the zip code of the billing address, neither of which are on the front or back of the card. However, this depends on whether you're buying something retail, in person versus online. If you ...


10

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a purely loosing battle and you take a chance every time you use an atm. Security is ...


10

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit ...


9

If your attackers are using sequential account numbers then that's a giveaway you can use to filter attempts. If someone tries 001, then 002, then 003 it's a pretty good guess that they are carding and you can then filter attempts from that IP address. The thing is that smart attackers will then modify their attacks by randomizing the card numbers they ...


9

This is precisely as secure as depositing a check at the ATM. You could go up to an ATM, pop in your debit card and say you're depositing $3500, put a blank piece of paper in a deposit slip and deposit it. Same rules apply with the tech you describe as an ATM: Try to fool it, and when time comes around to actually push the routing numbers and bank account ...


8

Any thoughts on how we can prevent this situation? 1) Fraud is higher with CNP (Card Not Present) transactions, not the least because it's easiest to get away with. If the purchaser says they never received it and files with the card company, the card company takes their side unless you have a signed slip - which CNP transactions never have. So for ...


7

Payment protocols have many variants. However, they mostly boil down to the three following: The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently ...


7

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...


6

Voting systems are "gamed" by people voting more times than should be normally allowed (e.g. voting several times). The only way to prevent this is to have a way to identify voters and to prevent multiple votes. Reliable methods entail authenticating users, e.g. with passwords, but this has two drawbacks, namely that 1. users don't like it, and 2. this does ...


6

The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering. A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...


6

Is there anything I can do to prevent them from tarnishing my [...] E-mail address In short: no. In general, you can't prevent anyone from using your email address and sending email on your behalf. You can do a little something by using forwarders that adopt SPF. This means that to be able to send an email to me, pretending to be from you, someone ...


5

Is a fake certificate only useful in combination of a DNS hijack (or any other method that will point the fake cert's target domain to a fraudulent IP, e.g. modifying hosts file etc?) ... or man-in-the-middle by means of ARP or routing table changes by an ISP. In any case, some redirection that is undesirable for the end user must also occur. The area ...


5

The only technical solution you may have available to you is to train the user data (such as name, address, IP, etc. information) within some form of spam agent. Similar to an email spam categorizer, this could be used to create your "evil Turing test" that you require. You may consider treating this like a spam problem and see what kinds of solutions ...


5

@logicalscope raises some good suggestions, but overall you still have to deal with one cold hard fact: Technically speaking, even this Nigerian prince guy is a perfectly valid user. The only problem with him, is that he does not own the credit cards which he is providing - notwithstanding the fact that he provided all the validation necessary. ...


5

The industry's answer to this is Chip-and-PIN (as it's known in the UK), where the card holder must enter their personal identification number into the card terminal for every card-present transaction. It has reduced card-present fraud by around 80%. Unfortunately, it has not yet seen widespread deployment in the US, which is causing problems for US card ...


5

I don't think this person (people) care about whether or not they get valid numbers since as you say you're validating with addresses as well, and they are trying sequentially. Getting blocked by CC processor could actually be a goal, especially if they are your competitors or they're doing it for the lulz. There's a couple of options I can add to the list: ...


5

When this was happening to an organization I know, they told their processor to decline all charge amounts below a certain threshold. This stopped the low value transactions completely, and the carders quickly left their site alone. If you haven't done anything about it yet, consider contacting your local FBI office. They may be interested in the case. ...


5

It all depends on the scope of the audit. If the audit is purely of the code (ie give the auditor a copy of the code, they audit it and return a report) then it could be very easy to tamper with it after the fact. If the audit is a bit more comprehensive, and includes the code development, test and promotion to live environment procedures, then you should ...



Only top voted, non community-wiki answers of a minimum length are eligible