Hot answers tagged

65

If you deface a credit card, you are likely to find it will be rejected for all transactions. The merchant really needs all the info on the card to be valid - it's part of how they protect themselves from fraud. So my answer would be: none! Instead of worrying about that, concern yourself more with how the merchants handle your card. In the UK, for example,...


51

I put a small sticker over the CVV to avoid it being casually seen. The CVV is the three-digit code on the back of the card beside the signature, needed when you buy things on the Internet but not otherwise. A merchant who takes your card and checks the signature can easily remember the three digits, and I think this was what happened the one time my credit ...


41

You don't actually need the CVV to perform transactions, they're just required by most retailers as a means of verifying that you have the physical card in your possession. From Wikipedia (unsourced): It is not mandatory for a merchant to require the security code for making a transaction, hence the card is still prone to fraud even if only its number is ...


37

The telephone system has been designed so that a caller can replace their phone number with a fake, and some unscrupulous companies use this to change their number to appear to be local to the person they are calling. They aren't using specific numbers of people you know, just something picked at random. The thinking is that a person is more likely to pick ...


35

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


33

Should I report this as a security issue or will it come under fraud management? There may be a business risk issue, which you can document under security, but how significant it is depends on the business. You say the web site accepts ... credit card numbers for reservations. What are those reservations for? If it's a hotel room, then there is ...


30

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


27

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


26

There are many ways to track user's location on a mobile device (I will go into how that works later). None of the tracking methods are particularly easy to spoof. It can be done but it is simply outside of the realm of the average user as it generally requires either a modified device (physically or programmatically) or external gear. Moreover, it is far ...


24

Given that you have strong verification of name / address, etc., it's most likely that your site is known to return different values for different types of errors. The best thing you can do to discourage card testing is to ensure that any declined transactions provide the same result regardless of the reason that the processor told you it was declined.


21

You can use a "CAPTCHA" mechanism to limit brute force attacks. Depending on the product, you could possible configure the CAPTCHA to block a user from submitting another transaction after some many fails attempts; and or, introduce a time limit (e.g. 15~20 secs) between transactions. If possible, you could also try an authentication mechanistic for your ...


20

Changing your e-mail and phone number is silly. Your phone number, unless unlisted, is a matter of public record and easily discoverable. Even if unlisted, it is still a publicly shared identifier that can be discovered with some investigating. Your e-mail address is also a public identifier and can be discovered with some effort. Having identifiers in ...


19

As GdD said, it's CallerID spoofing with the hope of tricking you into answering a 'local' call. I've had this happen where they used my own number as the Caller ID number! I answered because I thought there might have been a glitch in the matrix and that it was a legitimate caller, but no, it was spam (and yes, I should have known better.) Their real ...


18

Aside from the already mentioned attacks involving unauthorized usage of a credit card, the credit card information can also be used for social engineering and identity theft. As a somewhat current example, see how Mat Honan got hacked last summer : http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ In his case, Apple only required ...


16

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


13

You would need CVV and expiration date for verification, although expiration date is on the front face of a card. Also required is the billing address, or at a minimum, the zip code of the billing address, neither of which are on the front or back of the card. However, this depends on whether you're buying something retail, in person versus online. If you ...


13

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit a ...


12

It's worth mentioning that American Express credit cards do have the CVV on the front side (not the back), along with the card number, the cardholder name, and the expiration date. Therefore, disclosing the front face of an Amex card would allow arbitrary purchases, even card-not-present purchases.


12

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a losing battle and you take a chance every time you use an ATM. Security is relative, that ...


12

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...


12

TeamViewer has noticed that scammers often come from India (or other places where scams often originate), and so when you get an incoming connection from India TeamViewer will give you a warning saying that this could be a scam. If the scammer can get the victim to connect to the scammer's computer first and then reverse the connection (by clicking a button ...


11

Is there anything I can do to prevent them from tarnishing my [...] E-mail address In short: no. In general, you can't prevent anyone from using your email address and sending email on your behalf. You can do a little something by using forwarders that adopt SPF. This means that to be able to send an email to me, pretending to be from you, someone would ...


11

There are multiple ways to exploit a compromised certificate. If you have a compromised website certificate, you need to get people onto your server when they type the address of the compromised one. This can be done: By getting control of a DNS server, there you can basically change the association of a website URL to your server IP address. By ...


11

Can an attacker get information off the card? Yes, at least some can, and the UK consumer group Which? mentioned in the question did it: Our researchers tested 10 cards (six debit and four credit, from volunteers) to assess security risks. Contactless cards are coded to 'mask' personal data, but using an easily obtainable reader and free software to decode ...


10

If your debit card has an NFC chip on it (the "tap to pay"), it's possible. This presentation discusses two methods. One is skimming an NFC card and using the recovered data for making Card Not Present transactions online. The other is called a "pre-play" attack, where "future transactions" are skimmed from the card in your pocket, and used to make ...


9

If your attackers are using sequential account numbers then that's a giveaway you can use to filter attempts. If someone tries 001, then 002, then 003 it's a pretty good guess that they are carding and you can then filter attempts from that IP address. The thing is that smart attackers will then modify their attacks by randomizing the card numbers they try,...


9

This is precisely as secure as depositing a check at the ATM. You could go up to an ATM, pop in your debit card and say you're depositing $3500, put a blank piece of paper in a deposit slip and deposit it. Same rules apply with the tech you describe as an ATM: Try to fool it, and when time comes around to actually push the routing numbers and bank account ...


9

Ask your credit card provider for a one-time card number. Or get a new account with a low limit. Put the credit card number (and maybe a short random string) in a plain text file. 7zip this file with AES encryption. Email the hotel with this file as an attachment. Phone them and tell them the password to decrypt the file. (You might have to do a bit of "...


8

All that is required to run a credit card transactions is the PAN (Primary Account Number), which is basically the 16 digits found on the front of a card. That's all that really happens when a card is swiped - the machine reads the PAN that is encoded onto the card's magnetic strip. Therefore - if someone has the front face of your card, your account is ...


8

Payment protocols have many variants. However, they mostly boil down to the three following: The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently ...


Only top voted, non community-wiki answers of a minimum length are eligible