9

Few days ago I heard a professional scammer explaining how he exploits the banks, I cant find the right word to describe his actions, even the word scam does not fit as he is not breaking the law but exploiting it.

He was explaining how he gets on a cheap flight and during the journey he buys as much as he can of goods using his credit card. According to him the pin verification happens locally without the need for any kind of communication with the bank and that is why he has to use his credit card (he can use a stolen one but he is not a thief and he does not want to go to prison).

However the credit limit on that card cant be determined unless there is some kind of communication between the card and the bank and that's not possible on cheap flights as using mobile phones is not allowed.

In simple words: he can borrow more than he is allowed to.

I might have got it wrong since he was not explaining to me, I was only sitting next to his table in a public place.

3 Answers 3

14
+50

This isn't so much an authorization question as it is a fraud question. The defrauder is taking advantage of the known offline condition to incur a debt that he does not intend to repay.

As a prior answer explained, there are two phases in using a credit card. The first phase is authorization, where the merchant gives the account information and transaction amount to their payment processor. The processor contacts the "issuing bank", who issued the card to the customer. The bank examines the customer's account, makes sure the credit limit is high enough, that the bills are being paid on time, that sort of thing, and creates their approval in the form of a randomly generated number, called an approval code. This number is proof that the authorization took place at the bank, and it is the signal that the bank is willing to accept the risk of this transaction not being paid in the future by the cardholder. The approval code is sent back to the merchant, who prints it on the receipt.

In the second phase, the settlement process is where the merchant sends the day's transactions to the payment processor, and this will include all transactions, whether or not they have approval codes. As a part of settlement, all the money from all those transactions, including the unapproved transactions, will be transferred from the banks to the merchant's account. (The processor brokers these exchanges for a fee.)

The merchant (in this case the airline) may be willing to accept the risk of conducting credit transactions without authorization. An airline would generally have only small transactions for in-flight goods and services (a few dollars for alcoholic drinks, a movie rental, or perhaps a more expensive upgrade to first class.) It's not an amount that puts their business at risk, and the overall amount of money lost to in-flight fraud may be less than the cost of owning in-flight credit authorization terminals. When they accept these transactions they are offline and obviously cannot get an approval code from the bank. At the end of the flight, the airline sends them all to their processor for payment.

Later, the issuing bank will send a bill to the person, asking for him to repay his debt. If he refuses, the bank will look at the transaction and say "this came from Pseudo Payment Processors, who got it from Mythical Airlines, but we never gave them an approval code saying we authorized the charge." The bank will then issue a "chargeback" to the processor, who will in turn pass the chargeback to the airline. A chargeback is simply a request to repay the money. Since they have no approval code as evidence they received the bank's authorization to conduct the transaction, the money comes back out of the airline's pocket, and the airline is not paid for the goods and services they provided in-flight. The airline may then attempt to collect the money another way.

Make no mistake: taking the goods while misrepresenting intent to pay for them meets the legal definition of fraud. The person "at the next table" was a thief.

2

This Yahoo Help article explains it quite nice. As explained there, credit card payment processing takes place in two phases: authorization (getting approval for the transaction that's stored with the order) and settlement (processing the sale, which transfers the funds from the issuing bank to the merchant's account).

I'll put in the authorization image from that site:

Credit card payment authorisation process

In offline or manual transactions (which is the official term for transactions that aren't online processed), steps 2, 3, 4 and 5 are processed asynchronous. That is: steps 1 and 6 are processed, and later on, steps 2, 3, 4 and 5 are (often batch) processed. The financial risk lies at the merchant store (unless agreed otherwise between the issuing bank and the merchant).

2

First, let me start by saying that it may or may not be illegal for your friend to do this, but it will catch up with him. The vendor still has his information and a bill and can still collect it. The simple fact that he was over-drafting the card doesn't mean that he doesn't have to pay when he is tracked down.

Similarly, it may actually cost him more as many cards charge for going over your credit limit but may still allow transactions that occurred without being able to verify it, they just charge you an extra fee.

As for the actual security question about how the card is verified, it depends on the type of card. If it is a simple mag-stripe card, then there is a verification algorithm that can run a checksum on the card details and make sure that the card number is in a valid form, but it can't tell for sure that it is a valid card.

For chip and pin, the card actually signs a transaction. A secret key is held on your card and is in-accessible to the outside world. When you make a payment, the transaction details are sent to the chip on the card and your pin is entered in to the card. The chip then uses this information to generate an identifier that the merchant can use to prove they had the card and that the transaction amount wasn't altered.

In both cases, there isn't actually any validation that it is a valid account unless the issuing bank can be contacted. It is actually entirely possible to make a fake card that will pass the mag stripe validation tests and most likely is possible for the chip and pin as well, but it wouldn't actually be tied to any account in the real world. This is possible because the security around cards isn't so much to ensure that the card is valid as it is to ensure that the card is a) correctly read and b) actually present and used by an authorized holder in the case of chip and pin transactions.

The credit card system doesn't work without eventually communicating back to the network to place the charges, so the validation that the number is valid is only handled at that time. (It is theoretically possible to build a chip and pin system with a signing authority that could validate the keys used by banks to verify a chip and pin is validly linked to a credit account, but I don't think this actually has been done. My knowledge of chip and pin is a bit weak though as we don't have it in the states.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .