60,000 Credit Cards Numbers Stolen Online 232
robl writes "140,000 credit card numbers were tested for validity yielding about 62,000 valid credit card numbers and $300,000 of fraudulent charges. A good quote: "There wasn't a system in place to say, 'you've generated 140,000 charges, that's more than your normal volume.'" As Schneier-heads would say, it's a brittle system -- when the security fails, it fails badly."
swwwwwwwweeeeeeeeet! (Score:2, Funny)
Credit Card (Score:2, Insightful)
Re:Credit Card (Score:5, Interesting)
You are already guaranteed limited liability to $50 and chargeback rights by law. The credit card companies sell that fraud protection because they know it doesn't really cost them anything, since it's mostly what they have to provide anyway.
Re:Credit Card (Score:1)
This was about 12 years ago, and was a card that never left my posession - I suspect an oil-change reciept stolen from the car was used to "burn" a new card.
The most hilarious thing charged was about $1400 to a legal firm!
Could be because (Score:2)
If you read most contracts, you will find you have zero liability if someone scams your number somehow and uses it.
Re:Could be because (Score:2)
No, it is only if there is a signature that the $50 deductable applies. If it is a MOTO transaction the deductable is ZERO, you are covered in full.
I don't see the point in the scam. While the scam artist now knows that the 60K cards were valid he has tipped off the card companies to the fact the numbers have been stolen.
Re:Credit Card (Score:2)
Re:Credit Card (Score:3, Informative)
Scam is putting it mildly.
Re:Credit Card (Score:2)
funneh (Score:2)
Re:Credit Card (Score:3, Informative)
Re:Credit Card (Score:2)
Re:Credit Card (Score:2)
The clerks NEVER check the CC# which is scanned and, in the unlikely event they actually check the name and signature of the person in front of them it matches the card because the card was indeed issued to the person holding it. Only the CC# wasn't. Doesn't work if they are making a purchase where the card is imprinted, but that is so rare now...
Re:Credit Card (Score:5, Interesting)
My girlfriend is working as a cashier at a drug store. Somebody came in and bought around $50 worth of stuff. He wanted to put it on his visa - she takes the card, runs it through, and puts the card down beside her register while the transaction goes through. The guy asks for his card back and she says she'll give it back after she verifies the signature - and the guy freaks out!
(Keep in mind, she's very polite and friendly, not speaking with a "fuck off, I'll give it back when I'm ready" type attitude)
He reaches across the counter, grabs the card, rants about how much money he makes and how stupid she must be (incidently, she has a university degree and will be starting her first technical writing contract soon).
I used to get annoyed that cashiers don't check signatures - now I see why. Credit card fraud happens all the time but my girlfriend never had it happen on her register (unlike others at her store).
Re:Credit Card (Score:2)
And just so people know -- no, "My mom told me to go shopping" doesn't cut it, not even if I were dumb enough to call the number you give me for "verification".
And for Christ's sake, sign the card. Don't worry about giving the thief a signature sample, because he doesn't need a sample if you leave the strip blank -- he'll just sign it himself. Some cards, in fact, must be signed to be valid, and in some cases the signature must match the name on the front (so Daddy's card with Junior's signature isn't valid.)
Just tell her that she's protecting the customer because sh's a decent and responsible human, even if the customer is too fuckwitted to understand. I used to phrase it as, "protecting the cardholder", which was deliberately vague as to whether or not it was the cardholder standing in front of me.
Re:Credit Card (Score:2, Informative)
When the customer applies for a credit or debit card they bring in a passport photo of themselves and provide a specimen signature. These are then printed onto the back of the card.
The customer doesn't forget to sign the card, it doesn't rub off like normal cards, and it's easy for the cashier to tell if the person standing in front of them looks like the picture on the back of the card.
Fraudsters might be able to print cards with these details too, but perhaps by adding a hologram then this wouldn't be a problem either?
Re:Credit Card (Score:2)
I don't mind showing several cards, if it comes to that, so long as my card isn't used by somebody twice my age and of a different race and the other gender.
Re:Credit Card (Score:2)
If the merchant follows all of the rules the CC company will eat the chargeback for most card present fraud, but the CC companies make these rules because it just makes it easier to force the chargebacks on the merchant.
It amazes me that to this day Circuit CIty and Best Buy are still the number one targets for stolen card fraud and they can't seem to figure out how to stop it. I saw a guy in BB yesterday, they wouldn't take his check because he left his DL in his "other wallet" but they took his CC without even checking the signature.
Re:Credit Card (Score:5, Informative)
Re:Credit Card (Score:3, Informative)
On August 17, while on vacation, I discovered some bogus transactions on my card on August 9 - 5 transactions, $800, to some card processor in Israel. I called my bank the same day and told them the transactions were bogus and they issued me a new card.
Yesterday my bank called back and said that the merchant had verified the transactions and that I would be responsible for them. The merchant's "proof" was a single page fax that basically said that the charges had been done for an online casino account that had been opened in my name. Since the account was in my name, and the account "had a unique username and password", that is all the proof that the bank needed that I had authorized the charges.
The fact that the casino account was opened on the same day that the charges were made didn't seem to make a difference. The fact that I had never heard of the casino, nor had I authorized them to open an account in my name didn't make a difference. The fact that on the day in question, I was on vacation and driving from Seattle to Montana (a 10 hour drive, with credit card receipts to prove it) didn't seem to make a difference.
According to my bank (this is US Bank), I am responsible for the charges, and my only recourse is to take it up with the casino and their credit card processor.
So much for anti-fraud protection.
I am still planning to fight this, BTW, so if anyone has any suggestions about a course of action, I'm all ears.
Re:Credit Card (Score:2)
Sufficient persistence applied this way could save you the legal fees it would take to correct the situation the hard way.
Good luck.
Re:Credit Card (Score:3, Insightful)
Send a letter in as follows:
Re fraudulent charges to account XYZ charges [list]
Under penalty of perjury I deny authorizing the charges specified above.
I hereby require you to produce the signed transaction receipts as required by Regulation E of the Federal Reserve regulations governing the use of credit cards.
As your legal department will confirm the laws of the United States govern all transactions concerning credit cards issues in the United States. These laws make the card issuer responsible for all fraudulent charges and not the consumer, the merchant or any other party.
These charges are in dispute. Any allegation made to a third party such as a credit agency alleging refusal to pay a legitimate debt shall be considered defamatory and action may be taken accordingly.
Question (Score:2)
Re:Credit Card (Score:2)
The law-based/automatic fraud protection and $50 liability that applies to Credit Cards DOES NOT apply to Debit Cards. If you are using a Debit Card, you are fully responsible for charges until you report your debit card is stolen.
Not the way it works... (Score:1)
Re:Credit Card (Score:2)
It's great protection for me. I am not really worried about CC # theft, but if it does happen I have not only Visa to back me, I also have the limited amount they can charge.
If you don't have the ability to get a 1x only CC # (like AMEX) then I suggest using this method of personal protection.
Just my worthless
Re:Credit Card (Score:2, Informative)
Are you sure that your debit card has fraud protection? most debit cards do not [essortment.com], as they are regulated differently than credit cards [cardweb.com].
My Visa debit card, for example, does not, so I put all my online transactions on my actual credit card.
Re:Credit Card (Score:2)
Came home last week (ironically from laying down a down payment on a new car) to a message on the answering machine stating that my Visa card # has been compromised and that the card's been cancelled. I panicked, and checked the account, but no strange charges were appearing. When I asked them what evidence they were going by, and they said they get a daily list of compromised cards from Visa. She said that when a card # shows up, "that usually means they were able to buy your card # off a hacker website." I was glad that no unauthorized charges came through, but I asked about their policy and they said I wouldn't be responsible for one dime. All I have to do is point out the unauthorized charges and it'll be taken care of.
Which reminds me, I should check the account and see if anything has trickled in since then..
Re:Credit Card (Score:2)
Your checks will probably also start bouncing if you don't check your balance that often.
Re:Credit Card (Score:2)
OK, so I have weird friends. A low-limit credit card would be just as effective. Tell me something I didn't know already!
Re:Credit Card (Score:2)
Financial irresponsibility is your only real protection.
MSNBC: Not The First Time (Score:5, Interesting)
Duh. From the article:
They then go on to talk about an earlier MSNBC expose reported in April. I suspect the testing of credit gateways happens far more often that MSNBC suggests. Actually, I was a "victim" of this sort of authorization fraud last month -- someone in Czechoslovakia breached a transaction system in North Carolina, posting $0.01 charges, then following up with larger charges for goods delivered to El Paso. Lovely. I only got hit up for the initial cent before cancelling the card, but the person with whom I spoke mentioned that many more people were tapped through their system.
People: check those statements. So many friends of mine don't, holding on to bank-issued VISA debit cards and not bothering to account for their money apart from "do I have anything in my account now that I'm standing in from of an ATM?"
and it will happen again, duh. (Score:2)
blame the user! (Score:2)
While Verisign actually performed the authorizations, Dunne blamed the reseller, Online Data, for the incident. She said the company issued poor passwords to its customers.
"We encourage resellers to assign strong passwords. The issue here appears to be the nature of passwords assigned to merchants," she said.
But Rante said the merchant was to blame for not changing its password often enough.
"All of us need to change our passwords," Rante said. "We issue a starter password just like most companies do. We strongly urge the merchant to go in and change their password. This merchant failed to change their password and they were hacked.
So remember that kiddies, you are RESPONSIBLE for your password and any foul deed commited when someone breaks the crummy buggy crap software that accepts it! So clueless. The software was inadequate and those inadequacies obviously aided criminals. The criminal is at fault, but the maker of the software deserves blame for protecting against an obvious event.
Business at the speed of stupid.
extraordinarily weak passwords? (Score:4, Insightful)
Use one-time use numbers (Score:5, Interesting)
Go online, log on, generate a one-time use number, plug that into the web site, only good for one transaction.
Re:Use one-time use numbers (Score:1)
Re:Use one-time use numbers (Score:5, Insightful)
When a merchant is hacked like this, even brute-force number generation can be done with a little bit of information to yield a good number of valid credit card numbers.
The problem is that the credit card companies are allowed to make their money back (from fraud) on interest, so they have no real incentive to reduce the fraud imposed by the lack of numberspace. The "one-time numbers" are just something to make people feel more comfortable about spending money online.
Re:Use one-time use numbers (Score:2)
Better gateways can verify both the CVV2 and address before accepting a transaction. This goes a long way towards preventing brute-force attacks, but is only really useful if all authorization gateways start requiring them in order to validate requests.
Re:Use one-time use numbers (Score:2)
Actually, the merchant is the one that eats the cost of fraud in most cases. If you dispute the charge, the merchant has to supply either:
A signed receipt (with the card either imprinted or read via magstripe)
Proof of delivery.
Without that, the merchant eats the charge. Either way the merchant pays a chargeback fee ($25ish). Get too many, and they pull the mrrchants acount.
Some card providers do check the expiration date, and most processors support using address verification (compares the first 4 digits in the street address and the 5 or 9 digit zip). Using the extra digits on the back of the card (CVV2) also helps. Some of the processors have services like Authorize.net's FraudScreen service, that watch for patterns, and flag suspicious orders.
Re:Use one-time use numbers (Score:2)
The merchant can try and collect the money owed via another method, but for small transactions, they usually just write it off.
Here's a detailed explanation of the chargeback rules for one processor: http://www.dpicorp.com/docs/ChargebackDoc.PDF [dpicorp.com]
Pay attention to the parts that talk about E-Commerce, and Mail Order/Telephone Order (MO/TO). Many things require a customer signature... Like not refunding shipping/handling charges when the item is returned and such.
American Express and Fraud (Score:2, Informative)
I had a few minutes of limited fame back then, including an appearance on Japanese tv. The story of that fraud, and a dicussion of cc fraud in general, is here [faughnan.com]. (Alas, the site is hosted by myhosting.com, and as on many Sunday mornings it is now down!)
Only the banks can fix the problem, but with the very notable exception of American Express they've done very little. I now use AMEX for all recurring internet transactions, and if they ever got their Quicken support working reliably (they've failed for 3 years) I'd use them for all online transactions. AMEX has the best attention to security, and the best response to fraud, and the most sustained interest in combating fraud.
Barring litigation, the VISA/MC franchise will only fix this problem if customers stop using their cards. So use AMEX instead.
john faughnan
jfaughnan@spamcop.net
www.faughnan.com
Re:Use one-time use numbers (Score:2)
So the thieves have lost out this time (Score:1)
If so, the thieves must be kicking themselves for being so greedy.
Although knowing the way that institutions work, I somehow doubt that that has happened yet!
Remember Maxus "The Credit Card Master" ? (Score:1)
about 25,000 credit card numbers and publish them on the net!
Check here for his page [pc-radio.com]
Though he never get caught....
Related Links
http://www.internetnews.com/ec-news/article.php/4
http://www.wired.com/news/technology/0,1282,33539
Re:Remember Maxus "The Credit Card Master" ? (Score:2)
I remember him: my number was one of the ones stolen from cduniverse. My card was cancelled, but they didn't tell me until I was at the front of a many-deep line at Best Buy. In fact, the clerk "called it in" and contacted Discover security, who then wanted to talk to me. When you're seventh in line, it's not moving, and the clerk and the customer are on the phone, now you know why. Sorry, I didn't enjoy it either.
Ironically, my number was stolen and the card pre-emptivly cancelled for a second time just two weeks ago. Fortunately, through both incidents, I haven't had to pay a dime.
Why weren't the numbers cosschecked with zip codes (Score:1)
Re:Why weren't the numbers cosschecked with zip co (Score:1)
Not as brittle as you think (Score:4, Informative)
Admittedly the incident caused a lot of annoyance and no small expense for card issuers, and there are ways security could be improved, but in the end, the hack didn't cause a disaster.
Re:Not as brittle as you think (Score:4, Insightful)
Assuming they re-issie card numbers to the people affected.
People who have to wait for a new card.
People who might not be at liberty to pick it up (ie what if they were overseas, with a now defunct credit card, or worse, have to keep using a compromised credit card?.
People who still have to look for erroneous charges to their old card.
People who would then still have to re-instate any auto-debits they have charging to that card number.
There was annoyance to more than just the card issuers... and it wasn't even the card issuers fault, they shouldn't have had the annoyance any more than the card owner!
It's high time that credit card transaction processors were forced to pay up for the inconveniences as well as the charges they cause when their systems are breached.
Re:Not as brittle as you think (Score:2)
And you're right; Mastivisa might decide not to cancel the old card numbers. Still, considering the banks would have to bear most of the burden of any false charges, they will probably do so.
Re:Not as brittle as you think (Score:1)
This type of behavior won't change until the credit card companies change their systems, reengineering them for increased security and better verification procedures. They need to quit jerking their customers around and find effective solutions. The only people who suffer from this are the consumers and businesses; credit card companies will always make sure they are getting their share. It's up to the public to put pressure on these credit card companies to make effective changes.
Re:Not as brittle as you think (Score:2)
Insurance (Score:3, Informative)
I was pissed off recently because I can't use my Switch (Debit Card) on Dabs [dabs.com], but looking at it realisticly, it makes sense because with most banking online in the UK, most (if not all)Credit Cards have insurance against online theft (wheras I don't think the Debit Cards have the same protection).
But I know that isn't the point (relying on the insurance), because the systems (and banks) need to catch up with the standards that the internet/online world requires. Not only the banks have problems, but remember Amazon.com keeping quiet about major breaches of security and customers bank details being overly exposed... I never saw the image, but didn't someone modify their logo so that it said 'Shhhh!'?,
Just my 2 fruadulently obtained cents (processed through 'Online Data Corp's credit card transaction processor).
Re:Insurance (Score:1)
So most bnanks debit cards are protected...
a 3rd cent, maybe 4 (Score:2)
Credit cards don't *NEED* insurance against online theft usually... fraudulent charges are NOT your responsbility, PERIOD.
It is the responsbility of the merchants to ensure that transactions are legit, or they lose out, not you.
A single call from a cardholder declaring a transaction as unauthorized is all it takes to get you off the hook for the cash. They will investigate, of course, but the onus is heavily on the merchant to prove he had authorization to make the charge.
One good thing: It's been detected (Score:2, Insightful)
It shouldn't take too long for the credit card company to block all those cards. Of course, they've got 60K pissed off customers whose cards will have to be replaced, and that's not going to be that cheap!
VeriSign (Score:1)
2 Ways to make this less painful for you. (Score:3, Insightful)
The most basic way to protect yourself is to 1. You get a visa or mastercard with insurance/protection for that kind of fraud. If it's not available then go for a LOW limit on it, I did that with one, got about 700$ credit limit on it, I've taken the worst case scenario buying, more than that, if, let's say I would buy something for 2000$ off ebay, I'd simply send a cheque or if I don't trust the seller, I'll use an escrow service. For most e-commerce sites, 700$ for my personnal needs is okay, if I get frauded, it'll be ~500$ (balance) in the average, much less than if I'd use a 5K$ visa.
Banks are to blame on this though, we are users, we pay good money and good interests for this service and even in recessions they are still the ones making the most money, so why can't they come up with a better system? I don't have to THINK about that system, someone there is paid to do exactly that. I saw a report on TV the other night about how easy it is to empty bank accounts if you only have an account number and the complete address of the account number's owner... I mean... come on... basic service here. I'd gladly take an extra step that could make it less convinient to get better protection, this kind of situation shouldn't happen.
If you say "banks have nothing to do with E-merchants that don't protect their data" I'll say this: Banks indorectly or directly giving e-merchant status to people/companies, it's their responsibilities to make sure that their systems are safe and that their name won't be associated with being frauded to the bones. While I agree nothing is safe at 100%, there are some BASICS that should be covered, and the one in this article with over 100,000 queries is kinda OBVIOUS.
I fear we'll see more and more of this since now everything is continuing to be programmed at a higher and higher level without really knowing the insides and completely trusting the source tools (.NET for example, makes everything so much easier, but you don't even have to be a good programmer to use this). if the command becomes "securecheckout(items,price) return total; Charge(inputcreditcard)" well, if you are a good programmer, you'll check that "charge" function and how it works, if you are like most programmers out there, on a rush with a crazy deadline, you won't bother or take the time, hense, this will happen more and more. (I won't get into the rushed/incomplete software developping as well we all know the effects of that).
my
Re:2 Ways to make this less painful for you. (Score:3, Informative)
If you're crazy enough to buy that 30$ item or that 200$ basket with a GOLD Visa that has no protection, you're asking for trouble. The most basic way to protect yourself is to [...] get a visa or mastercard with insurance/protection for that kind of fraud.
No, the most basic form of protection is to not have a card at all. Seriously, though, as others have pointed out elsewhere, there are federal liability statues that limit fradulent purchase charges to, at most, $50. Enrolling in fraud protection programs offered by credit card companies it just not worth it -- over the lifetime of the card, balanced against the risk of a fraudulent charge appearing on your statement in excess of $50, you're paying for more than you're getting.
Banks are to blame on this though[...]
I suspect a fair amount of exaggeration here. I will agree that "bank cards" that act as credit accounts area danger. They are not subject to the same fraud protection that "true" credit accounts are. I wouldn't fault the banks for that headache, though, I'd blame consumers who flash them around without considering the consequences. Sometimes, I wonder whether VISA check cards and their ilk were such a good idea at all.
Your points about the significance of proper software development are important. However, the issues aren't confined to "e-merchants", as brick and mortar merchants are quite open to credit fraud, too.
Re:2 Ways to make this less painful for you. (Score:2)
-Tommy
Re:2 Ways to make this less painful for you. (Score:2)
Re:2 Ways to make this less painful for you. (Score:2)
If someone hits your account (because of fraud, entering a wrong amount,...) then you get hit with bank fees for going over the amount. Every try to get thouse undone? With most large banks, you can't with debit cards or it will take far more time than its worth. Credit cards already put the risk on the bank (who pushes it on to the merchant).
I've been hit by credit card fraud a few times over the past 15 years and my total time to deal with it was less than 5 minutes. A single mistake involing a debit card will take at least a few hours to clear up.
Re:2 Ways to make this less painful for you. (Score:2)
Re:2 Ways to make this less painful for you. (Score:3, Insightful)
The rest of it is pretty silly. Credit cards are useful because you can use them lots of places. Banks simply can _not_ audit everybody's software. That's impossible. If they tried it, you'd pay way much higher interest than you do already on your credit card - as if it wasn't bad enough.
It works fine as it stands. Somebody steals your credit card number, you don't pay a dime, the credit card company nails the company that was the root of the problem (the one with the security hole), and that's the end of it.
I'm sure others will point it out.. (Score:2)
You are not responsible for fraudulent use of your card. Period. At all. In any way.
The only way you ARE responsible is usually for up to $50 IF THE CARD ITSELF IS STOLEN., and that's only if the charges happen before you report the card as stolen.
Merchants are hte ones who get stung when cards are used fraudulently, not visa, and not the cardholder.
Stolen Credit Cards (Score:3, Informative)
Big, enormous, credit card companies could make usage of credit cards more secure (and difficult) but they haven't because they probably don't want to do anything that will lower or hinder usage.
Because these guys make an enormous amount of money from credit card interest, I don't think they will make any major changes anytime soon.
-Sean
Re:Stolen Credit Cards (Score:3, Informative)
Yeah, but it can be a bit of a pain. It takes at least a phone call, and in some cases it'll require cooperating with police, insurance companies, random companies you've never dealt with before but who lost money, and swearing affidavits, something that can require considerable time.
It's also indicative of the poor security that many (most?) corporations give to personal data, which is a true "consumer/yro" issue.
It goes on your credit record (Score:2, Informative)
Therefore until the record has to be removed by law, your credit record can be hosed. And since nothing was actually stolen from you, if the credit card company chooses not to pursue (which from their point of view is a risk/reward issue involving the amount that a lawsuit would cost), you have no standing to sue about it.
The same thing happens with identity fraud, but tends to be larger because they can rack up quite the bill before anyone figures out that you don't live at the black hole that the bills are going to.
For more see Database Nation [oreilly.com].
Quote (Score:2, Interesting)
Hmm... Would you expect a store to want to deliberately shut down its systems because it is getting too much business? I mean what if slashdot had given them a posting about some great new product they had, or cnn.com, or any large media outlet. Can you really expect a merchant to build in a shutdown to its system on the extremely small chance that some hacker is going to use their site as a testbed, and potentially lose millions of dollars in sales? I do not think you can really blame the system here, for either its lack of foresight, or lets say they did forsee this scenario, or its unwillingness to refuse lots of orders. The article was kind of sparse on details but I am guessing this was an all at once kind of transaction, and even if there was some kind of alert sounded, that by the time anyone realized what was going on, the transactions would have taken place already. The passwords, while a little on the weak side, did contain a mixture of letters and numbers, and I am going to go under the assumption that the number was randomly generated. I dont think you can really place much blame on the merchant here- Could their security have been made stronger? Yes. Would stronger security have even prevented the event? Maybe.
Re:Quote (Score:2)
Re:Quote (Score:2)
That is exactly what happened.
Velocity checks are the primary responsibility of the merchant acquirer. The gateway merely secures the connection to the merchant acquirer system.
If you have a sudden vast number of bogus transactions go through then warning lights are going to go on. However that does not mean that the system is going to shut off the service.
If the bad guys have hit you with 1000 charges of which 60% were blocked cards you are going to want the connection to continue as long as possible so you can mark the other 40% of the cards as probably compromised. If you have the capability you would probably like to do a network trace and call in the cops. However that type of thing is difficult to set up on the fly. Most card scammers do not do anything so conveniently obvious.
The main protection built in against this type of fraud is that the merchant does not get paid straight away. There is no real point in verifying so many card numbers in a way that is so obvious that it causes the cards that verify to be cancelled.
Re:Quote (Score:2)
Hmm... Would you expect a store to want to deliberately shut down its systems because it is getting too much business?
Yes, I would, because that's almost guaranteed to be fraudulent use, and it's a pain in the ass for the store to have to clear up the resulting mess. But apart from that, I wouldn't expect the *store* to do it anyway. I'd expect the card processor (First Data or similar) to do it. I work for a UK based credit card [accucard.com], and we *do* have systems in place to check for abnormal usage (although I don't know if they'd have helped in this case -- they certainly pick up unusual patterns per card, but this was only one transaction per card). I'd hope that FDE [firstdatacorp.co.uk] have similar checking, but I don't know for sure. I'd assumed it was routine, but found out it wasn't when my girlfriend's card was cloned. Sure, her bank eventually refunded the fraudulent transactions, but made no attempt to stop them in the first place. From speaking to our fraud people, it seems it's up to the individual issuer whether or not they do it.
Funny... (Score:2, Insightful)
1. I can dispute charges (I suppose you can't do this with all credit card companies).
2. They ALWAYS call me if there is any "suspicious activity" on my card.
There have been times when I used my card 5 times in a single day, and of course the call me to make sure its all legitimate. I guess I don't know if all credit card companies extend such benefits to the customers, but my cards always have (Platinum, gold, and even those crappy ones you get in college when all you really wanted was a candy bar.)
Granted, this does not excuse sloppy software and ISP's leaving our credit card numbers exposed to the world, but it does increase my confidence in my credit card.
Re:Funny... (Score:2)
There have been times when I used my card 5 times in a single day, and of course the call me to make sure its all legitimate. I guess I don't know if all credit card companies extend such benefits to the customers, but my cards always have (Platinum, gold, and even those crappy ones you get in college when all you really wanted was a candy bar.)"
I don't know either, but my Canadian student visa card from my bank with a relatively low spending limit gets this protection. Just about 3 weeks ago I got a call from the bank telling me they had cancelled my card due to suspicious activity (passed through an unauthorised scanner) and were sending me a new one. They went through the last few charges on the phone with me and everything seemed in order.
Strangely enough, a few weeks earlier the same thing happenned to my dad with his card provided from the same bank.
But still, it was good for piece of mind, and for knowing that the number for the card I had use in many (SSL secured) online transactions was now useless to any potential fraudsters.
I don't want to give out who my credit card issuer in a public forum but e-mail me if you are interested in getting such a thing for yourself and I will tell you which bank it is.
Show me where... (Score:2)
Not always true... (Score:5, Interesting)
Each year, we would have a huge warehouse sale. We would gather about 10,000 previewed VHS tapes and sell them for anywhere from $1 up to $10. There were some really great deals.
Anyway, since the warehouse was actually behind and attached to one of the stores, we would just run one of the telephone lines and charge machines to the warehouse.
During that weekend, we would see tens of thousands of dollars in transactions, up from the normal activity on our account, usually measured in the hundreds of dollars a day in charges.
Each year we were called by the authorizing agent during the sale to make sure the sales were not fraudulent. In addition, one year we had to show a random sampling of the signed receipt copies from the sales.
I find it strange that the credit card company did not look into the matter any quicker than it did.
how long would it take? (Score:2, Interesting)
lets just say they can handle 100 transactions a second (not unreasonable) then all 140000 transaction could happen in 23 minutes,
so lets say a computer flagged unusual activity and after 40000 transactions it would still take a t least fifteen minutes for the guy who saw the flag to ask his manager what he should do about it and make the call, by that timeit could be over.
This could happen much faster than the video stores big business day.
So whose fault is it? (Score:1)
Damn. And nobody noticed until irate customers started calling? Who dropped the ball here? Presumably Spitfire is ultimately responsible for not paying attention to the transactions through their own website, but I imagine Online Data comes in for some of the blame, since they were actually processing the payments. Interesting to see where the most fingers end up pointing (probably depends on who has the best legal department).
Also: In a situation like this, is Verisgn obligated to contact 62,000 credit card holders to warn them about a possible fraudulent transaction using their card?
Where were the velocity controls? (Score:5, Interesting)
Want to scare yourself sometime? (Score:5, Interesting)
Now, go on-line and try to find information about STORING credit cards. There's very little in the way of useful information on how to do this securely. Most of the good security people simply advise not doing at all. In spite of that many on-line businesses are doing credit card storage and you quickly get the sense that few of them have any idea how to store this information in a secure way.
Re:Want to scare yourself sometime? (Score:2)
That's right, online merchants should never store a CC number and I won't shop anyplace that does (not that I shop online - or over the phone either).
Incidently (so I don't get modded redundant) do online merchants use the 3 digit security number on the back of cards? I'm Canadian and in order to check my balance, etc, online with my CC I have to use it when I login (well, I did until they moved to a more secure password protected security model).
Is that 3 digit code a Canadian thing or is it global?
That's one reason. (Score:2)
The numbers get stolen all the time and abused and they charge you for things you haven't bought like expensive cars, tall buildings and anti-tank missiles. And then you get into trouble.
The other reason why I don't own such a silly credit card is only known to the credit card companies, which won't tell me.
New Scams, Old Scams (Score:2)
The place I work at (which I'm not going to disclose right now) asked us for:
- Rent receipts
- My financial breakdown
- Cost of schooling
- Credit Card receipts
on our job application, so that I can "prove" I need the job badly enough (it's a student job, partly paid for by gov't wages).
How's that for fraudulent? I'd sue, but I don't think I'd win (the place I'm working for is pretty damn big). Ho hum.
Needless to say, they're not getting the receipts until the talk to me personally. Hasn't been a problem yet.
Does anyone else find it incredibly ironic... (Score:3, Insightful)
Online Data, the payment processor, is a reseller of Verisign credit card gateway services.
And Verisign sells digital certificates, which provide authentication, identification, and non-repudiation of data signed with those certificates.
And yet they are relying on passwords, rather than requiring the use of an X.509 certificate for an established security association, so that no client machines other than the ones owned by the merchants themselves can be used to make credit card authorization requests.
And each of these people *has* a certificate in hand, since they have to have one to run an HTTPS (SSL based) server in the first place!
That's a bit like the U.S. Marines deciding to hire school crossing guards to provide the security for Fort Knox, isn't it?
And now they are blaming people for not hiring the right school crossing guards, or not firing olld school crossing guards, and hiring different ones "often enough"...
-- Terry
Too much information? (Score:2, Funny)
Hynek told MSNBC.com the merchant password issued to him by Online Data was âoeOnlneAp16501.â
In related news, the Pentagon said that all of its intelligence computers also use a certain top-secret, confidential password by default. MSNBC.com was told that this password is âoe0$@m@.â
This is why I use paypal... (Score:2)
Those poor folks. Saved some time and money building their web app by cutting requesty generation tracking out of the order system and the result was massive fraud. All their fault -- and yet, I can't see the proposal for these features being too popular at a staff meeting, either.
Hell, I had to fight to get SSL up -- and we're too poor to afford a cert.
I know what happened... (Score:2)
Passport (Score:2, Funny)
Yes. (Score:2)
The onus is on the merchant to PROVE that I authorized those charges, and not the other way around. It SHOULD be like this on every other visa card issuer out there. If it's not, change (i'd be surprised)
IF you see a charge on your card that isn't yours, a single phone call is all that should be required to get rid of it.
WE have to remember, the credit card is the property of the issuer, not the holder. The money was not stolen from you, it was stolen from VISA.
Re:Yes. (Score:2)
If you sell widgets, and you take payment by visa, and the cardholder says "I never authorized that charge", YOU don't get paid, unless YOU can prove that the charge you put through the system was authorized.
They weren't stolen. (Score:2)
How hard is it to make an idiot proof system? (Score:2)
Here is an example:
Have an ID system a la passport (preferably a company with no other interests at hand other than providing this service and high security). Now I can identify myself.
I login to shop.on.the.net and register myself (I let them know who I am), I can set what kind of news I want, and I can shop for stuff. Goodie. I choose to buy thing A, thing B, and thing Q, and I press "ORDER".
Now I have to log into my bang account, here I see that shop.on.the.net wants $XXX from me, and I say "yes I would like that". Now you have had two different systems that had to be broken before you can hack it.
Now what happens is that the order is sent to one of a few addresses that I have registered at my bank, no other addresses will be sent to. There is also a mentioning on my pages on the banks site of where it was sent.
Now, this system would not be hard to use (probably would take less time to order than for me to write this down for you), and it could probably be improved upon further, in terms of ease of use and security. And it is surely much better than a system with a stupid number and almost no control over it.
Re:How hard is it to make an idiot proof system? (Score:2)
OK, don't take this criticism personally. Here it is:
Quit spouting off solving the problems of the world without first taking a small look at the problems and the consequences of the solution.
Merchants won't like this system. You keep forgetting that if your great aunt Tilly would be confused, no merchant will touch it.
Second, the merchants will see this as "taking control away" from them. Never mind that it isn't, that's how they will see it.
Third, Visa/Master Card won't like this system. It will cut down fraud, which is one of the items they roll out when accused of usury. "All that fraud going on, we have to make more money!". Also, Visa, and Master Card won't like it because it will take some control away from them. You are talking a second level of control here, and controlling the card is what the issuer does.
Fourth, Visa/Master Card will really hate it because it puts the authorizing company in line for some of the commission, and none of the charge backs.
Over all, it's not a bad idea, just one that will never be put in place. I've been involved (indirectly, getting asked "can we do..." kind of things) with a few round table discussions on this. Bottom line, they don't want to change anything because there is no or negitive incentive to do so.
Amex used to generate a kind of sub-credit-card number for their customers, but I haven't seen it lately. They used to generate a one-time number with a specific credit limit you selected. The first time the number is used is the last time it's good. That worked well because people didn't have too much to do to make it work. On the other hand, you had to dial a number or visit a web site to set up a sub-number before you could purchase anything.
Ooohhh... credit card inspector (Score:2)
Obligatory Simpsons reference:
Snake: "OOhhhh.. wallet inspector."
Nerds: "I think everything's in order." (hand over wallets)
Snake: "I can't believe that worked."
Re:Ooohhh... credit card inspector (Score:2)
Both sites are running IIS on Windows... (Score:2)
Geez, I wonder how the Online Data Corp web site got hacked so easily... Let's see on Netcraft...
Yep, "The site www.onlinedatacorp.com is running Microsoft-IIS/5.0 on Windows 2000" [netcraft.com] (and with an uptime of less than a day at that).
And what about the vendor with a guessed password? Netcraft it again... You, ahem, guessed it: The site TalkingTP.com is running Microsoft-IIS/5.0 on Windows 2000 [netcraft.com].
I dunno about you, but whenever I see a web page with the magical .asp suffix, I carefully avoid to even turn on cookies. Much less give them my name and CC number. Because I know that it's only a question of time before they get hacked, owner and stripped from their customer files.
Re:Here is my credit card number (Score:1)
Re:Why I don't use credit cards on line period (Score:1)
Re:Why I don't use credit cards on line period (Score:1)