7 ms·

How Carders Can Use EBay as a Virtual ATM

82 points by Turukawa 11y ago

studentrob 11y ago
Wow. The story and comments below it make me realize security is a lot more important than my data science background led me to believe. I had no idea people are working so hard to buy stuff with fake or stolen credit card information. Bots running on AWS to sell stuff on eBay, then actually purchase the sold item and have it sent to the buyer. Wow
- noonespecial 11y ago
  Its especially sad because that's clearly more than enough knowledge and skill to make a more-than-decent living and be a productive member of society.
  - bluedino 11y ago
    You could take a couple days to set some bots and accounts up, and potentially make tens of thousands of dollars. That'd take months as 'productive member of society'.
    - hippich 11y ago
      you do not need bots. just socks server running on free ec2 instance
  - hippich 11y ago
    people who do it, either live in countries where they can not really realize their skill in any meaningful way, or it is gang business, where scale is quite different. Globalization helps a lot to prevent former.
    - studentrob 11y ago
      Whoa, gang programmers? Is that a thing? I feel so innocent.
      - hippich 11y ago
        there is very little programming involved and a lot of social hacking skills.
  - kbart 11y ago
    It depends on society. Most of such people are young, bright and computer literate from the 3rd world countries where often doing even a small time scamming on Internet nets you way more than local office job.
    - studentrob 11y ago
      It seems to me if you're caught doing that you risk quite a bit of your future chances at an office job in a growing economy. I guess everyone has to make their own choices.
      - bwilliams18 11y ago
        The chance of actually getting caught in this situation is really rather low...being unsuccessful, sure, but truly caught, prosecuted, etc, probably won't happen.
        studentrob 11y ago
        Today, yes. Tomorrow, next year, 5 years. You don't know. The more successful you are the more attention you'll get. Plenty of uncatchable people have been caught. Ulbricht, Gottfrid, ...
  - prodmerc 11y ago
    Except the positions for making a decent living are already taken. And please don't blame only third world citizens - most of the time they're just grunts, the masterminds are usually in the countries where cards are actually stolen from (i.e. first world, rich, etc.)
    - studentrob 11y ago
      It's hard to get a job, therefore I steal? Sorry, I don't buy it. We don't know exactly the details of how these scams are happening or who is conscious of what they're doing. However, whoever does control the details of setting up on AWS can certainly make a living wage elsewhere. Stealing is not acceptable within any society. We are all human beings, we share this earth, let's share not steal.
      - Kalium 11y ago
        Imagine that you're smart, young, and faced with an awkward choice. You can live your life in an impoverished place, ekeing out a living producing mud in Elbonia. Or you can steal money from people who, from your perspective, have TONS. People who aren't even near you anyway, and who according to local thought are evil and oppressing you. Plus, that's a lot of money to you. Now couple it with the gang aspect.
        studentrob 11y ago
        I don't have to eke out a living making mud. I know how to work with AWS. I can find a job working for a web development shop and teach myself new skills along the way. I don't know what you mean by gang aspect. Yes organized crime exists and forces people to participate. Are you saying there's a high likelihood that the people who set up these scams are being forced to do it by a gang? I don't know anything about the likelihood of that. As far as I know, all participants in tech criminal rings are willing. If people are being forced to join against their will, someone should shed light on that.
      - throwaway2048 11y ago
        Crime is unquestionably coorlated with poverty, you can't just dismiss that with banal moralizations of how BAD these people are and how they ought live properly. If you want to solve most crime issues in a real way, stop it from being the only choice many people have to "get ahead" or even survive.
  - studentrob 11y ago
    Yeah. Unfortunately, the scammers may not even feel they're ripping off their own society. According to commenter Charles, whose story of being scammed seems as advanced as the OP, the accounts scamming him were registered via ebay.in. Given all the call centers and operations in India and the Philippines, for example, these low-wage countries may have a good number of people who understand how eBay and PayPal systems work. They certainly have a number of tech savvy and multi lingual folks. If these really are Indian based, I'd argue their modern robin hood efforts aren't a good idea. However I know next to nothing about Indian culture, and we don't really know where the origin of the scam is coming from. It could be US based. [rant] In general, I'm unimpressed with the ability of the US government to identify major online scamming patterns and execute effectively deterring consequences for the perpetrators, as well as enact legislation that is not overreaching. I recall one I got hit by a buyer's club called Reservation Rewards / Web Loyalty in 2007. They started in 2000. They still exist and are still scamming people under the name Affinion, Trilegiant and a host of other buyer's club names that they come up with. In 2007, I had entered my email address twice to receive some coupon after registering for a road race on active.com. Unbeknownst to me, this legally authorized them to share my credit card with another company and start billing me $10 monthly. Apparently at that time, entering your email into two different text boxes constituted a legal signature. I didn't read the fine print because it just looked like a coupon that would be emailed to me. It didn't look like I was buying anything. I never thought my CC # could be transferred like that and have me charged by a different company. I think the partnering company (active.com, fandango.com, and others) gets a kickback from RR's "coupon" scam which is a modern discount buyer's club. Anyway, I didn't notice the recurring charges for a few months. Once I did I found this company had been scamming people for years, since 2000. I called to get a refund and got it back in full. They put up some resistance, but having read other peoples' experiences, I knew what they would say and what I should say back. I wrote a few lengthy comments online, considered that my contribution and moved on. There was a TV report done on them in 2009, in which their CEO stated they were following all laws in all states [1] Web Loyalty was subsequently involved in a class action lawsuit, in which they settled [2] According to a review on Glassdoor from a former employee, the company has since been sold to another one called Affinion [3] There are several revealing Glassdoor reviews from current Affinion employees, this one is worth sharing [4] In October 2013, Affinion settled with 46 state attorneys general to refund $19 million to tricked consumers. [5] There are many complaints about Affinion on BBB.org, some of which look just like the old ones about Reservation Rewards / Web Loyalty. That is, charges for services for which people never signed up [6] There are also some recent complaints about "Web Loyalty" here on BBB although they really fall under Affinion now. [7] I recall reading one comment where a person was only billed once every six or 12 months, rather than monthly, so they nearly missed it. This company has been operation for 15 years and is clearly still scammy. I'm sure lawyers would look at this and tell you it happens all the time. It's their job to see this. To me, this is unacceptable. When you steal cash from a store you go to jail. When you scam people out of money over the internet, you get fined some amount less than your profit, make some minimal adjustment to your scamming service, perhaps sell the business to another one, get a new name and then resume as usual with a small hit to profit. Our society does not benefit from the little money coming back via these fines. When is our government going to learn that fines are not a proper deterrent for super scale larceny? [1] https://www.youtube.com/watch?v=v0RzjkOirHg https://www.youtube.com/watch?v=v0RzjkOirHg [2] http://www.xconomy.com/boston/2009/08/27/webloyalty-customers-eligible-for-payments-under-class-action-settlement/ http://www.xconomy.com/boston/2009/08/27/webloyalty-customer... [3] https://archive.is/FCXKT https://archive.is/FCXKT [4] https://archive.is/91Hf1 https://archive.is/91Hf1 > "A sinking ship with part of the hull still miraculously above water. Affinion is a "Business Parody" at best." > Pros > I cannot, in all honesty, find one single benefit of choosing Affinion as an employer as opposed to the next company. Like quicksand, every reason for working there gets sucked into an abyss. > Cons > The only benefit of ever working at Affinion would be the lesson one could learn about how unethical companies with a sketchy business model are able to survive this long. At best, it is a sinking ship on its last leg of survival. > Advice to Management > Those in "upper management" play their "oblivious" roles to perfection. The fact is, the emperor has no clothes on...and yet every one of them can describe the non-existent clothes to the last thread. [5] http://www.cleveland.com/consumeraffairs/index.ssf/2013/10/affinion_webloyalty_to_refund.html http://www.cleveland.com/consumeraffairs/index.ssf/2013/10/a... [6] http://www.bbb.org/connecticut/business-reviews/buying-clubs-and-group-purchasing-service/affinion-group-inc-in-stamford-ct-41001179/complaints http://www.bbb.org/connecticut/business-reviews/buying-clubs... [7] http://www.bbb.org/connecticut/business-reviews/buying-clubs-and-group-purchasing-service/webloyalty-com-inc-in-stamford-ct-77000102/complaints http://www.bbb.org/connecticut/business-reviews/buying-clubs... [/rant]
kbart 11y ago
"Shipping to PayPal registered address only" is in order to prevent such activity, no?
- hippich 11y ago
  I was ordering good on ebay quite often to different address, sometime international (legitimately) and this never was a problem somehow. May be it is because my ebay and paypal accounts are quite old and rules will be different for freshly made accounts, but i fail to see how this stop hackers, who use stolen ebay/paypal accounts.
  - kbart 11y ago
    As I understand, this rule is up to the merchant, so most might choose not to follow it. What I meant to say, that tools to prevent such fraud exists, it only needs to be used more often. "i fail to see how this stop hackers, who use stolen ebay/paypal accounts." It won't. But this article says nothing about stolen Ebay/Paypal accounts, that's completely different problem.
- SixSigma 11y ago
  What's to stop Fraudster simply changing the Paypal address to match where the order is going ?
  - kbart 11y ago
    Taken from https://www.paypal.com/cgi-bin/?cmd=p/pop/confirmed_address_checkout-outside https://www.paypal.com/cgi-bin/?cmd=p/pop/confirmed_address_...: "A buyer's Confirmed Address is checked against the credit card billing address maintained by his or her credit card company, or is verified by PayPal" So if you do change shipping address to match the card holder's, item will be shipped to the legitimate card holder and the whole scheme becomes pointless -- you just bought unwanted item for somebody using their own money and probably get disputed by the buyer, whose order didn't arrive. A more simple way to achieve the same goal would be "take money and disappear", but it's not quite the same as "ATM on Ebay".
hippich 11y ago
This can be done even easier. Find popular product on ebay, list same product for 5 bucks less and when you receive order, order from real merchant with stolen paypal account.
- gesman 11y ago
  It's harder to steal paypal account than to trick small merchant with stolen CC
djb_hackernews 11y ago
This seems pretty easy to mitigate If the merchant enforces a rule like if this is your first N orders, require the shipping and billing to match, or more loosely, an alternative address you've registered with your CC Nowadays it is very easy to register an alternative address with your CC that the merchant can verify so besides that bit of friction I don't see the merchant losing much business.
- michaelt 11y ago
  My bank doesn't support alternative addresses, so merchants who enforce that policy have lost my business for the past 12 years - firstly because I've been moving about annually, so I've kept my cards registered at my family's home; and secondly because I want parcels sent to my workplace, where there will be someone to receive them, not to the place I'm living. Given that Amazon and Ebay accept my card, if another retailer rejects it they'd need a pretty compelling offer for me to take a day off work to receive their delivery.
Fradow 11y ago
That begs the question: isn't fraud important enough that we should have more security on credit card? 2-factor authentication is now a well known process. How come you can still order things with a card number and nothing else whatsoever? Well, here are my 2 guess, not exclusive: - fraud prevention is actually a lucrative business, and having better security would destroy a cash cow - the added security is deemed too hard for a large part of the population, and would raise support cost too much
- 5h 11y ago
  I think it's more due to the volume of ancient systems out there that do not & will not support added security measures. Visa 3d secure is popular now though.
  - chkuendig 11y ago
    The crazy thing is that both visa 3d secure and the same thing from mastercard dont require 2FA either at my bank. All they need is a password. in comparison, all online banking transactions go through a challenge-response process with an separated card reader and my debit card.
  - scoates 11y ago
    Verified By Visa is (almost?) always embedded into a merchant's page (on their domain) as an iframe. At least in Canada. It's nearly impossible for normal users to verify that they're sending their password to their bank, and not to the merchant. Training users to send merchants sensitive bank passwords is a step backwards.
    - 5h 11y ago
      True, it shows a prompt specified by the user at registration ... presumably that might be to establish trust? (it's been a long time since i registered mine & can't remember off hand) ... if so that's probably security theatre I think the reset process requires postcode & DOB (in the UK anyway) which would high a good probability of being available in the data-dump type scenario.
gcb0 11y ago
this is apaypal issue, not ebay or credit card. ebay do not let you sell or buy without a paypal account. which only allows credit card from a single country. so why can't the police link the two things easily? seems to me people are either hacking paypal to somehow get the money out or paypal is going out of the way to make it disappear. either that or using stolen credit cards for online purchase is completely safe.
- rosege 11y ago
  You can have your paypal account linked to only one country but you can have multiple countries credit cards in that account - I know because I do.
  - gcb0 11y ago
    weird. i am pretty sure that was denied for me. but either way, the criminal is receiving the money via paypal, famous for withholding funds for the most banal of reasons. why in those cases it allow money to be drawn with no records that law enforcement can use?
ianhawes 11y ago
The only important innovation here on the part of the carders is the use of automated ordering programs. In the same way that cartels use hundreds of drug mules to smuggle drugs across the border knowing that a certain percentage will be caught and a certain percentage will succeed, carders are now using this same pattern. Instead of placing a small number of orders for a high value, place a large number of orders for a medium-to-high value under the assumption that some will go through. Looking at the e-commerce store mentioned in Brian's article, it seems they're simply new to the scene and haven't understood that credit card fraud using physical items follows 3 patterns: 1. Billing and shipping address are different. 2. IP address is geographically far from the billing address OR its a server/EC2/VPN. Note: Yes, carders sometimes use proxies near the billing address BUT ask yourself, if they're shipping it to a separate address with (presumably not to attract suspicion) the same "ship to" name as the "bill to" name, why would they ship it elsewhere? I have seen carders that will use the same last name but with a different name, making it appear that its a relative or family member, but those are usually few and far between and still flagged for other reasons. 3. Credit card number was pasted instead of typed.
- ShaneOG 11y ago
  I store all my card details in 1Password and thus my card number is always pasted and not typed. Is this really a signal? I've never had issues with this.
- agopaul 11y ago
  > 3. Credit card number was pasted instead of typed. This wouldn't probably work. You have to consider that some browsers (eg. Chrome) save the CC data, so you don't have to type them. This validation step would block legit customers from buying what they want. Also, bots can run on real browsers simulating real humans using infected PCs as proxy so that their IP addresses result on the same country/state of the real customer.
  - ianhawes 11y ago
    The jQuery event "pasted" seems to work well. And it was used in our fraud scores, so it didn't necessarily block the tx, just score it.
gesman 11y ago
Off all of this - the act of placing an ecommerce order from EC2 (or from any hosting VPS/server for that matter) should trigger manual review. This could cut fraud drastically - that is if merchant has any clues about security.
- gesman 11y ago
  And besides why credit card companies are not implementing super cheap and working security method - two factor auth-ORIZATION? Send me SMS or email saying: "Your card just been used to buy X for $N at Y. Click here if you think it's not authorized". Or more proactive: "... click here to confirm" - this way IP of email click could be used additionally to detect possible phishing victim. This could cut the fraud drastically and allows to catch a few fraudsters while still "warm". Way cheaper, simpler and more efficient then struggling with EMV.
  - iak8god 11y ago
    For every transaction? I'd end up ignoring them and then miss the fraudulent ones anyway.
  - tw04 11y ago
    They do. I get an email anytime a purchase is made on my AMEX without the card being present (no swipe). I could have it for ANY transaction but I don't feel the need.
devy 11y ago
The bottom of this blog post, Brain Krebs mentioned the name a company who specialized in fraud prevent. That sounds like a product placement advertising to me (he does do CPM based ad placement on his blog[0], so I am more suspicious about product placement). Additionally, I lost the respect for him when he questioned the validity of Ashley Madison site data breach, disregarding confirmation of many other sources but solely based on the interview he had with Raja Bhatia, ex-CTO of ‎Avid Life Media, who was proven to be clueless about security in retrospect. Brian Krebs later did retract his original reporting with an update shortly after overwhelming evidences proved he was wrong.[1] Basically, he's neither a security research nor a good investigative journalist IMMO. [0]: http://krebsonsecurity.com/cpm/ http://krebsonsecurity.com/cpm/ [1]: http://krebsonsecurity.com/2015/08/was-the-ashley-madison-database-leaked/ http://krebsonsecurity.com/2015/08/was-the-ashley-madison-da...
- snowwrestler 11y ago
  Krebs has broken a number of significant cybercrime stories both at the Post and running his own blog. Temporarily expressing skepticism about one breach (or running ads) is not enough to counter his substantial history of good reporting.

82 points by Turukawa 11y ago

Wow. The story and comments below it make me realize security is a lot more important than my data science background led me to believe. I had no idea people are working so hard to buy stuff with fake or stolen credit card information. Bots running on AWS to sell stuff on eBay, then actually purchase the sold item and have it sent to the buyer. Wow

noonespecial 11y ago
Its especially sad because that's clearly more than enough knowledge and skill to make a more-than-decent living and be a productive member of society.
- bluedino 11y ago
  You could take a couple days to set some bots and accounts up, and potentially make tens of thousands of dollars. That'd take months as 'productive member of society'.
  - hippich 11y ago
    you do not need bots. just socks server running on free ec2 instance
- hippich 11y ago
  people who do it, either live in countries where they can not really realize their skill in any meaningful way, or it is gang business, where scale is quite different. Globalization helps a lot to prevent former.
  - studentrob 11y ago
    Whoa, gang programmers? Is that a thing? I feel so innocent.
    - hippich 11y ago
      there is very little programming involved and a lot of social hacking skills.
- kbart 11y ago
  It depends on society. Most of such people are young, bright and computer literate from the 3rd world countries where often doing even a small time scamming on Internet nets you way more than local office job.
  - studentrob 11y ago
    It seems to me if you're caught doing that you risk quite a bit of your future chances at an office job in a growing economy. I guess everyone has to make their own choices.
    - bwilliams18 11y ago
      The chance of actually getting caught in this situation is really rather low...being unsuccessful, sure, but truly caught, prosecuted, etc, probably won't happen.
      - studentrob 11y ago
        Today, yes. Tomorrow, next year, 5 years. You don't know. The more successful you are the more attention you'll get. Plenty of uncatchable people have been caught. Ulbricht, Gottfrid, ...
- prodmerc 11y ago
  Except the positions for making a decent living are already taken. And please don't blame only third world citizens - most of the time they're just grunts, the masterminds are usually in the countries where cards are actually stolen from (i.e. first world, rich, etc.)
  - studentrob 11y ago
    It's hard to get a job, therefore I steal? Sorry, I don't buy it. We don't know exactly the details of how these scams are happening or who is conscious of what they're doing. However, whoever does control the details of setting up on AWS can certainly make a living wage elsewhere. Stealing is not acceptable within any society. We are all human beings, we share this earth, let's share not steal.
    - Kalium 11y ago
      Imagine that you're smart, young, and faced with an awkward choice. You can live your life in an impoverished place, ekeing out a living producing mud in Elbonia. Or you can steal money from people who, from your perspective, have TONS. People who aren't even near you anyway, and who according to local thought are evil and oppressing you. Plus, that's a lot of money to you. Now couple it with the gang aspect.
      - studentrob 11y ago
        I don't have to eke out a living making mud. I know how to work with AWS. I can find a job working for a web development shop and teach myself new skills along the way. I don't know what you mean by gang aspect. Yes organized crime exists and forces people to participate. Are you saying there's a high likelihood that the people who set up these scams are being forced to do it by a gang? I don't know anything about the likelihood of that. As far as I know, all participants in tech criminal rings are willing. If people are being forced to join against their will, someone should shed light on that.
    - throwaway2048 11y ago
      Crime is unquestionably coorlated with poverty, you can't just dismiss that with banal moralizations of how BAD these people are and how they ought live properly. If you want to solve most crime issues in a real way, stop it from being the only choice many people have to "get ahead" or even survive.
- studentrob 11y ago
  Yeah. Unfortunately, the scammers may not even feel they're ripping off their own society. According to commenter Charles, whose story of being scammed seems as advanced as the OP, the accounts scamming him were registered via ebay.in. Given all the call centers and operations in India and the Philippines, for example, these low-wage countries may have a good number of people who understand how eBay and PayPal systems work. They certainly have a number of tech savvy and multi lingual folks. If these really are Indian based, I'd argue their modern robin hood efforts aren't a good idea. However I know next to nothing about Indian culture, and we don't really know where the origin of the scam is coming from. It could be US based. [rant] In general, I'm unimpressed with the ability of the US government to identify major online scamming patterns and execute effectively deterring consequences for the perpetrators, as well as enact legislation that is not overreaching. I recall one I got hit by a buyer's club called Reservation Rewards / Web Loyalty in 2007. They started in 2000. They still exist and are still scamming people under the name Affinion, Trilegiant and a host of other buyer's club names that they come up with. In 2007, I had entered my email address twice to receive some coupon after registering for a road race on active.com. Unbeknownst to me, this legally authorized them to share my credit card with another company and start billing me $10 monthly. Apparently at that time, entering your email into two different text boxes constituted a legal signature. I didn't read the fine print because it just looked like a coupon that would be emailed to me. It didn't look like I was buying anything. I never thought my CC # could be transferred like that and have me charged by a different company. I think the partnering company (active.com, fandango.com, and others) gets a kickback from RR's "coupon" scam which is a modern discount buyer's club. Anyway, I didn't notice the recurring charges for a few months. Once I did I found this company had been scamming people for years, since 2000. I called to get a refund and got it back in full. They put up some resistance, but having read other peoples' experiences, I knew what they would say and what I should say back. I wrote a few lengthy comments online, considered that my contribution and moved on. There was a TV report done on them in 2009, in which their CEO stated they were following all laws in all states [1] Web Loyalty was subsequently involved in a class action lawsuit, in which they settled [2] According to a review on Glassdoor from a former employee, the company has since been sold to another one called Affinion [3] There are several revealing Glassdoor reviews from current Affinion employees, this one is worth sharing [4] In October 2013, Affinion settled with 46 state attorneys general to refund $19 million to tricked consumers. [5] There are many complaints about Affinion on BBB.org, some of which look just like the old ones about Reservation Rewards / Web Loyalty. That is, charges for services for which people never signed up [6] There are also some recent complaints about "Web Loyalty" here on BBB although they really fall under Affinion now. [7] I recall reading one comment where a person was only billed once every six or 12 months, rather than monthly, so they nearly missed it. This company has been operation for 15 years and is clearly still scammy. I'm sure lawyers would look at this and tell you it happens all the time. It's their job to see this. To me, this is unacceptable. When you steal cash from a store you go to jail. When you scam people out of money over the internet, you get fined some amount less than your profit, make some minimal adjustment to your scamming service, perhaps sell the business to another one, get a new name and then resume as usual with a small hit to profit. Our society does not benefit from the little money coming back via these fines. When is our government going to learn that fines are not a proper deterrent for super scale larceny? [1] https://www.youtube.com/watch?v=v0RzjkOirHg https://www.youtube.com/watch?v=v0RzjkOirHg [2] http://www.xconomy.com/boston/2009/08/27/webloyalty-customers-eligible-for-payments-under-class-action-settlement/ http://www.xconomy.com/boston/2009/08/27/webloyalty-customer... [3] https://archive.is/FCXKT https://archive.is/FCXKT [4] https://archive.is/91Hf1 https://archive.is/91Hf1 > "A sinking ship with part of the hull still miraculously above water. Affinion is a "Business Parody" at best." > Pros > I cannot, in all honesty, find one single benefit of choosing Affinion as an employer as opposed to the next company. Like quicksand, every reason for working there gets sucked into an abyss. > Cons > The only benefit of ever working at Affinion would be the lesson one could learn about how unethical companies with a sketchy business model are able to survive this long. At best, it is a sinking ship on its last leg of survival. > Advice to Management > Those in "upper management" play their "oblivious" roles to perfection. The fact is, the emperor has no clothes on...and yet every one of them can describe the non-existent clothes to the last thread. [5] http://www.cleveland.com/consumeraffairs/index.ssf/2013/10/affinion_webloyalty_to_refund.html http://www.cleveland.com/consumeraffairs/index.ssf/2013/10/a... [6] http://www.bbb.org/connecticut/business-reviews/buying-clubs-and-group-purchasing-service/affinion-group-inc-in-stamford-ct-41001179/complaints http://www.bbb.org/connecticut/business-reviews/buying-clubs... [7] http://www.bbb.org/connecticut/business-reviews/buying-clubs-and-group-purchasing-service/webloyalty-com-inc-in-stamford-ct-77000102/complaints http://www.bbb.org/connecticut/business-reviews/buying-clubs... [/rant]

kbart 11y ago

"Shipping to PayPal registered address only" is in order to prevent such activity, no?

hippich 11y ago
I was ordering good on ebay quite often to different address, sometime international (legitimately) and this never was a problem somehow. May be it is because my ebay and paypal accounts are quite old and rules will be different for freshly made accounts, but i fail to see how this stop hackers, who use stolen ebay/paypal accounts.
- kbart 11y ago
  As I understand, this rule is up to the merchant, so most might choose not to follow it. What I meant to say, that tools to prevent such fraud exists, it only needs to be used more often. "i fail to see how this stop hackers, who use stolen ebay/paypal accounts." It won't. But this article says nothing about stolen Ebay/Paypal accounts, that's completely different problem.
SixSigma 11y ago
What's to stop Fraudster simply changing the Paypal address to match where the order is going ?
- kbart 11y ago
  Taken from https://www.paypal.com/cgi-bin/?cmd=p/pop/confirmed_address_checkout-outside https://www.paypal.com/cgi-bin/?cmd=p/pop/confirmed_address_...: "A buyer's Confirmed Address is checked against the credit card billing address maintained by his or her credit card company, or is verified by PayPal" So if you do change shipping address to match the card holder's, item will be shipped to the legitimate card holder and the whole scheme becomes pointless -- you just bought unwanted item for somebody using their own money and probably get disputed by the buyer, whose order didn't arrive. A more simple way to achieve the same goal would be "take money and disappear", but it's not quite the same as "ATM on Ebay".

hippich 11y ago

This can be done even easier. Find popular product on ebay, list same product for 5 bucks less and when you receive order, order from real merchant with stolen paypal account.

gesman 11y ago
It's harder to steal paypal account than to trick small merchant with stolen CC

djb_hackernews 11y ago

This seems pretty easy to mitigate If the merchant enforces a rule like if this is your first N orders, require the shipping and billing to match, or more loosely, an alternative address you've registered with your CC Nowadays it is very easy to register an alternative address with your CC that the merchant can verify so besides that bit of friction I don't see the merchant losing much business.

michaelt 11y ago
My bank doesn't support alternative addresses, so merchants who enforce that policy have lost my business for the past 12 years - firstly because I've been moving about annually, so I've kept my cards registered at my family's home; and secondly because I want parcels sent to my workplace, where there will be someone to receive them, not to the place I'm living. Given that Amazon and Ebay accept my card, if another retailer rejects it they'd need a pretty compelling offer for me to take a day off work to receive their delivery.

Fradow 11y ago

That begs the question: isn't fraud important enough that we should have more security on credit card? 2-factor authentication is now a well known process. How come you can still order things with a card number and nothing else whatsoever? Well, here are my 2 guess, not exclusive: - fraud prevention is actually a lucrative business, and having better security would destroy a cash cow - the added security is deemed too hard for a large part of the population, and would raise support cost too much

5h 11y ago
I think it's more due to the volume of ancient systems out there that do not & will not support added security measures. Visa 3d secure is popular now though.
- chkuendig 11y ago
  The crazy thing is that both visa 3d secure and the same thing from mastercard dont require 2FA either at my bank. All they need is a password. in comparison, all online banking transactions go through a challenge-response process with an separated card reader and my debit card.
- scoates 11y ago
  Verified By Visa is (almost?) always embedded into a merchant's page (on their domain) as an iframe. At least in Canada. It's nearly impossible for normal users to verify that they're sending their password to their bank, and not to the merchant. Training users to send merchants sensitive bank passwords is a step backwards.
  - 5h 11y ago
    True, it shows a prompt specified by the user at registration ... presumably that might be to establish trust? (it's been a long time since i registered mine & can't remember off hand) ... if so that's probably security theatre I think the reset process requires postcode & DOB (in the UK anyway) which would high a good probability of being available in the data-dump type scenario.

gcb0 11y ago

this is apaypal issue, not ebay or credit card. ebay do not let you sell or buy without a paypal account. which only allows credit card from a single country. so why can't the police link the two things easily? seems to me people are either hacking paypal to somehow get the money out or paypal is going out of the way to make it disappear. either that or using stolen credit cards for online purchase is completely safe.

rosege 11y ago
You can have your paypal account linked to only one country but you can have multiple countries credit cards in that account - I know because I do.
- gcb0 11y ago
  weird. i am pretty sure that was denied for me. but either way, the criminal is receiving the money via paypal, famous for withholding funds for the most banal of reasons. why in those cases it allow money to be drawn with no records that law enforcement can use?

ianhawes 11y ago

The only important innovation here on the part of the carders is the use of automated ordering programs. In the same way that cartels use hundreds of drug mules to smuggle drugs across the border knowing that a certain percentage will be caught and a certain percentage will succeed, carders are now using this same pattern. Instead of placing a small number of orders for a high value, place a large number of orders for a medium-to-high value under the assumption that some will go through. Looking at the e-commerce store mentioned in Brian's article, it seems they're simply new to the scene and haven't understood that credit card fraud using physical items follows 3 patterns: 1. Billing and shipping address are different. 2. IP address is geographically far from the billing address OR its a server/EC2/VPN. Note: Yes, carders sometimes use proxies near the billing address BUT ask yourself, if they're shipping it to a separate address with (presumably not to attract suspicion) the same "ship to" name as the "bill to" name, why would they ship it elsewhere? I have seen carders that will use the same last name but with a different name, making it appear that its a relative or family member, but those are usually few and far between and still flagged for other reasons. 3. Credit card number was pasted instead of typed.

ShaneOG 11y ago
I store all my card details in 1Password and thus my card number is always pasted and not typed. Is this really a signal? I've never had issues with this.
agopaul 11y ago
> 3. Credit card number was pasted instead of typed. This wouldn't probably work. You have to consider that some browsers (eg. Chrome) save the CC data, so you don't have to type them. This validation step would block legit customers from buying what they want. Also, bots can run on real browsers simulating real humans using infected PCs as proxy so that their IP addresses result on the same country/state of the real customer.
- ianhawes 11y ago
  The jQuery event "pasted" seems to work well. And it was used in our fraud scores, so it didn't necessarily block the tx, just score it.

gesman 11y ago

Off all of this - the act of placing an ecommerce order from EC2 (or from any hosting VPS/server for that matter) should trigger manual review. This could cut fraud drastically - that is if merchant has any clues about security.

gesman 11y ago
And besides why credit card companies are not implementing super cheap and working security method - two factor auth-ORIZATION? Send me SMS or email saying: "Your card just been used to buy X for $N at Y. Click here if you think it's not authorized". Or more proactive: "... click here to confirm" - this way IP of email click could be used additionally to detect possible phishing victim. This could cut the fraud drastically and allows to catch a few fraudsters while still "warm". Way cheaper, simpler and more efficient then struggling with EMV.
- iak8god 11y ago
  For every transaction? I'd end up ignoring them and then miss the fraudulent ones anyway.
- tw04 11y ago
  They do. I get an email anytime a purchase is made on my AMEX without the card being present (no swipe). I could have it for ANY transaction but I don't feel the need.

devy 11y ago

The bottom of this blog post, Brain Krebs mentioned the name a company who specialized in fraud prevent. That sounds like a product placement advertising to me (he does do CPM based ad placement on his blog[0], so I am more suspicious about product placement). Additionally, I lost the respect for him when he questioned the validity of Ashley Madison site data breach, disregarding confirmation of many other sources but solely based on the interview he had with Raja Bhatia, ex-CTO of ‎Avid Life Media, who was proven to be clueless about security in retrospect. Brian Krebs later did retract his original reporting with an update shortly after overwhelming evidences proved he was wrong.[1] Basically, he's neither a security research nor a good investigative journalist IMMO. [0]: http://krebsonsecurity.com/cpm/ http://krebsonsecurity.com/cpm/ [1]: http://krebsonsecurity.com/2015/08/was-the-ashley-madison-database-leaked/ http://krebsonsecurity.com/2015/08/was-the-ashley-madison-da...

snowwrestler 11y ago
Krebs has broken a number of significant cybercrime stories both at the Post and running his own blog. Temporarily expressing skepticism about one breach (or running ads) is not enough to counter his substantial history of good reporting.