4 ms·
The only important innovation here on the part of the carders is the use of automated ordering programs. In the same way that cartels use hundreds of drug mule
by ianhawes 11y ago
The only important innovation here on the part of the carders is the use of automated ordering programs.
In the same way that cartels use hundreds of drug mules to smuggle drugs across the border knowing that a certain percentage will be caught and a certain percentage will succeed, carders are now using this same pattern. Instead of placing a small number of orders for a high value, place a large number of orders for a medium-to-high value under the assumption that some will go through.
Looking at the e-commerce store mentioned in Brian's article, it seems they're simply new to the scene and haven't understood that credit card fraud using physical items follows 3 patterns:
1. Billing and shipping address are different.
2. IP address is geographically far from the billing address OR its a server/EC2/VPN.
Note: Yes, carders sometimes use proxies near the billing address BUT ask yourself, if they're shipping it to a separate address with (presumably not to attract suspicion) the same "ship to" name as the "bill to" name, why would they ship it elsewhere? I have seen carders that will use the same last name but with a different name, making it appear that its a relative or family member, but those are usually few and far between and still flagged for other reasons.
3. Credit card number was pasted instead of typed.
- ShaneOG 11y agoI store all my card details in 1Password and thus my card number is always pasted and not typed. Is this really a signal? I've never had issues with this.
- agopaul 11y ago> 3. Credit card number was pasted instead of typed. This wouldn't probably work. You have to consider that some browsers (eg. Chrome) save the CC data, so you don't have to type them. This validation step would block legit customers from buying what they want. Also, bots can run on real browsers simulating real humans using infected PCs as proxy so that their IP addresses result on the same country/state of the real customer.
- ianhawes 11y agoThe jQuery event "pasted" seems to work well. And it was used in our fraud scores, so it didn't necessarily block the tx, just score it.
- ellius 11y agoThose are still reliable for lazy fraud but miss tons of it too. Anti-Detect was designed exactly to get through fraud departments looking for these sorts of obvious signs.