Tag Info

Hot answers tagged

28

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


23

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


18

Changing your e-mail and phone number is silly. Your phone number, unless unlisted, is a matter of public record and easily discoverable. Even if unlisted, it is still a publicly shared identifier that can be discovered with some investigating. Your e-mail address is also a public identifier and can be discovered with some effort. Having identifiers in ...


14

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


11

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit ...


8

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...


7

Is there anything I can do to prevent them from tarnishing my [...] E-mail address In short: no. In general, you can't prevent anyone from using your email address and sending email on your behalf. You can do a little something by using forwarders that adopt SPF. This means that to be able to send an email to me, pretending to be from you, someone ...


6

If the attacker gained access to your PayPal account via your username and password, the best thing to do is change your email and bank passwords. I'm hoping that you did not use the same password for all of these accounts. If you did re-use your password for PayPal on other accounts (Amazon, Ebay, etc), I would highly recommend changing those passwords as ...


5

Interesting thought. What you need is a digital signature. A digital signature is a mathematical scheme for demonstrating the authenticity of a digital message or document. A valid digital signature gives a recipient reason to believe that the message was created by a known sender (authentication) and that the message was not altered in transit ...


4

Yes, it is a good strategy if a disk has held sensitive data and may be accessible by others. A Google search for "wipe disk free space" finds numerous such tools. There are a couple of other considerations. One is "slack space." That's the unused space in the last cluster of a file. It's not part of free space, so it won't get wiped by many disk wiping ...


4

There are many ways to track a users location on a mobile device (I will go into how that works later). None of the tracking methods are particularly easy to spoof. It can be done but it is simply outside of the realm of the average user as it generally requires either a modified device (physically or programmatically) or external gear. Moreover, it is ...


3

You can't. The way the mail system is designed does not ensure that sender email addresses must be verified. The email system we used was originally designed for a closed environment where all the members of the network were known and trusted, security and verification of sender address was not a requirement. When the internet was created there was no ...


2

Please remember that SSN numbers are NOT random. They include data like where it was issued, and what year it was issued. This might not be hard data, but it can be used to infer data about the person it was issued to. http://www.ssa.gov/history/ssn/geocard.html http://www.stevemorse.org/ssn/ssn.html ...


2

If you live in an area where no ATM and other cash terminal needs the magnetic strip, you can use a strong magnet to scramble the magnet strip. I personally have done this using a recycled neodymium magnet out of a decommissioned hard drive. Note: never put your debit card in a microwave if you intend to use it afterwards.


2

In many cases the merchant can check the amount before shipping the item. However many payment gateways implement a checksum value that is hashed with a secret key and if the hash don't match the value the transaction is aborted. There are several flaws with this approach, I gave a presentation at blackhat asia last year that illustrate some of them. You can ...


2

I would say: Ask your acquirer. If you roll your own library or use a 3rd party service, the rate limiting might not Count towards you in "fraud fighting score" at all, and you will still be liable if the order makes it through. If you select such services by your acquirer, then the acquirer knows that you are actively fighting against fraud, and the ...


2

In addition to the chance that a replacement card with the same PAN, but new expiration date and CVV has been issued (as noted by others in the comments), it can of course be used for spearphishing. Just knowing that John Smith has a platinum card with XYZ bank, and used it to pay for a 10-pack of Nutella sandwich spread opens up for sending him an email or ...


1

Yes, you can generate off of a BIN (Bank Identification Number) which is the first 6 digits in the 16 digit credit card string. And if the BIN you are using expires, then depending on if it's a Visa or MasterCard, you can literally keep the month and increase the year by 3 or 4 years. But a far as numbers in general..... If you have a good high limit ...


1

The two main methods that I have considered for this are: 1. User Defined Questions Most of the default questions I see on sites seem to be the same or very similar, easily researchable through social media, etc. I would generally think that allowing users to write their own security questions would be better with some guidance. e.g., "Come up with two ...


1

You didn't specify what your site is built with. If by chance you're using Ruby, there is an excellent rack-attack library by Kickstarter.


1

Alternatively, just delete your files securely in the first place, using a tool such as shred.


1

Owen's answer above reminded me of something very low tech but simple and effective that I've tried. To get an idea of how badly bots are skewing my click stats, -- right next to my affiliate banner graphic -- I have a single-pixel, transparent gif that's also wrapped in an href tag. I think it's safe to assume that only bots would be clicking that invisible ...


1

I don't know about the magnetic strip. I guess you can. In my country almost all shops have chip-readers. And if the card doesn't work, report it broken and you get a new one. CSC / CVV But what about the card security code (CSC or CVV). With your credit card number, expiration date and CSC anyone can shop online. No need to steal a card! It's just a ...


1

Why not write "VOID" (or "CHIP & PIN ONLY") in big letters in the signature field on the card (and take a photo of it for your records)? That should only allow it to be used for chip and PIN transactions. If a merchant does allow it to be used for a signature transaction, then the merchant and bank are going to have a hard time justifying allowing the ...


1

For Ingress, Google's global wargame, a range of anti-spoofing measures are used. Google are keeping quiet about the full range, but two that have been demonstrated are: Speed limitation: 40mph maximum allowed in game Corroborating measures: cross referencing wifi SSID's received with their location database


1

From my knowledge the way you spoof the locations is to : 1) Use developer mode with mock locations. There are ways of detecting that you are using developer mode so the developer can decide that the GPS is not to be trusted in this case. So they will use other ways of finding your location like wifi networks. 2) You can fake your position when your phone ...


1

This organisation should have a specific landing point for customers to receive/verify/modify their PIN code, which does not depend on departments, and department staff should be trained to not give this information just as they would not give other sensitive personal information. The reason is you can't ask departments to reason about the sensitivity of ...



Only top voted, non community-wiki answers of a minimum length are eligible