The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

65

If you deface a credit card, you are likely to find it will be rejected for all transactions. The merchant really needs all the info on the card to be valid - it's part of how they protect themselves from fraud. So my answer would be: none! Instead of worrying about that, concern yourself more with how the merchants handle your card. In the UK, for example,...


51

I put a small sticker over the CVV to avoid it being casually seen. The CVV is the three-digit code on the back of the card beside the signature, needed when you buy things on the Internet but not otherwise. A merchant who takes your card and checks the signature can easily remember the three digits, and I think this was what happened the one time my credit ...


40

You don't actually need the CVV to perform transactions, they're just required by most retailers as a means of verifying that you have the physical card in your possession. From Wikipedia (unsourced): It is not mandatory for a merchant to require the security code for making a transaction, hence the card is still prone to fraud even if only its number is ...


37

The telephone system has been designed so that a caller can replace their phone number with a fake, and some unscrupulous companies use this to change their number to appear to be local to the person they are calling. They aren't using specific numbers of people you know, just something picked at random. The thinking is that a person is more likely to pick ...


35

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


33

Should I report this as a security issue or will it come under fraud management? There may be a business risk issue, which you can document under security, but how significant it is depends on the business. You say the web site accepts ... credit card numbers for reservations. What are those reservations for? If it's a hotel room, then there is ...


30

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


27

I'm not an expert at using stolen credit cards... but from what I know: You could resell the numbers on the black market. You could buy stuff and have it shipped to a rube who reships it to you. You could "quickswap" on eBay. (Use the credit card to purchase an item that is shipped directly to the auction winner, and you pocket the money from the auction ...


27

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


26

There are many ways to track user's location on a mobile device (I will go into how that works later). None of the tracking methods are particularly easy to spoof. It can be done but it is simply outside of the realm of the average user as it generally requires either a modified device (physically or programmatically) or external gear. Moreover, it is far ...


24

Given that you have strong verification of name / address, etc., it's most likely that your site is known to return different values for different types of errors. The best thing you can do to discourage card testing is to ensure that any declined transactions provide the same result regardless of the reason that the processor told you it was declined.


21

You can use a "CAPTCHA" mechanism to limit brute force attacks. Depending on the product, you could possible configure the CAPTCHA to block a user from submitting another transaction after some many fails attempts; and or, introduce a time limit (e.g. 15~20 secs) between transactions. If possible, you could also try an authentication mechanistic for your ...


20

Changing your e-mail and phone number is silly. Your phone number, unless unlisted, is a matter of public record and easily discoverable. Even if unlisted, it is still a publicly shared identifier that can be discovered with some investigating. Your e-mail address is also a public identifier and can be discovered with some effort. Having identifiers in ...


19

As GdD said, it's CallerID spoofing with the hope of tricking you into answering a 'local' call. I've had this happen where they used my own number as the Caller ID number! I answered because I thought there might have been a glitch in the matrix and that it was a legitimate caller, but no, it was spam (and yes, I should have known better.) Their real ...


18

Aside from the already mentioned attacks involving unauthorized usage of a credit card, the credit card information can also be used for social engineering and identity theft. As a somewhat current example, see how Mat Honan got hacked last summer : http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ In his case, Apple only required ...


16

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


15

You're attempting to uniquely identify something through a system that was somewhat designed to not require a unique identity. Short of tying and validating to a 3rd party (usually physical) identifier, this is impossible. Instead, your best bet is to restrict voting altogether, in a manner that discourages automation and/or quick results. If your system ...


13

Basically, someone stealing CC numbers will need to find a way to monetize them. This can be done for instance by printing fake cards with the stolen info, using them to buy goods and then sell those goods again. For someone who only wants to do the hacking part (not the real-life monetizing part that includes shopping), selling the stolen CC no's to people ...


13

You would need CVV and expiration date for verification, although expiration date is on the front face of a card. Also required is the billing address, or at a minimum, the zip code of the billing address, neither of which are on the front or back of the card. However, this depends on whether you're buying something retail, in person versus online. If you ...


13

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit a ...


12

Here's an example of a scam to pull money from stolen credit cards by gambling online: Obtain 10,000 credit card #s. Sign up for online gambling accounts using these cards, attempting to charge $100 to gamble with. Let's say 10% actually work - now you have 1,000 accounts and $100,000 to gamble with. Play these accounts, losing to a select few accounts. ...


12

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a losing battle and you take a chance every time you use an ATM. Security is relative, that ...


12

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...


11

It's worth mentioning that American Express credit cards do have the CVV on the front side (not the back), along with the card number, the cardholder name, and the expiration date. Therefore, disclosing the front face of an Amex card would allow arbitrary purchases, even card-not-present purchases.


11

Is there anything I can do to prevent them from tarnishing my [...] E-mail address In short: no. In general, you can't prevent anyone from using your email address and sending email on your behalf. You can do a little something by using forwarders that adopt SPF. This means that to be able to send an email to me, pretending to be from you, someone would ...


11

There are multiple ways to exploit a compromised certificate. If you have a compromised website certificate, you need to get people onto your server when they type the address of the compromised one. This can be done: By getting control of a DNS server, there you can basically change the association of a website URL to your server IP address. By ...


11

Can an attacker get information off the card? Yes, at least some can, and the UK consumer group Which? mentioned in the question did it: Our researchers tested 10 cards (six debit and four credit, from volunteers) to assess security risks. Contactless cards are coded to 'mask' personal data, but using an easily obtainable reader and free software to ...


10

If your debit card has an NFC chip on it (the "tap to pay"), it's possible. This presentation discusses two methods. One is skimming an NFC card and using the recovered data for making Card Not Present transactions online. The other is called a "pre-play" attack, where "future transactions" are skimmed from the card in your pocket, and used to make ...


9

If your attackers are using sequential account numbers then that's a giveaway you can use to filter attempts. If someone tries 001, then 002, then 003 it's a pretty good guess that they are carding and you can then filter attempts from that IP address. The thing is that smart attackers will then modify their attacks by randomizing the card numbers they try,...


9

@logicalscope raises some good suggestions, but overall you still have to deal with one cold hard fact: Technically speaking, even this Nigerian prince guy is a perfectly valid user. The only problem with him, is that he does not own the credit cards which he is providing - notwithstanding the fact that he provided all the validation necessary. ...


Only top voted, non community-wiki answers of a minimum length are eligible