5 ms·

Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it

Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen". Or maybe I'm just way too optimistic about how this all works.

tyingq 10y ago
Sadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller. It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.
- baldeagle 10y ago
  I'm sure the IRS and a number of other groups would love access to this data.
  - tyingq 10y ago
    For the most part, the data is already centralized. It just isn't used for anti fraud measures that would help online merchants. The cc companies and banks do leverage aggregated data when they are the ones that hold the bag....like card present transactions.
    - seanp2k2 10y ago
      Yep, it would cost them to implement and maintain, and they have no financial incentive to do so. It's not like they have a brand to ruin either; everyone already hates them, but Visa and MasterCard run the US market (and much of the global market), so they can do whatever they want to consumers without fear of backlash / loss of business.
- user5994461 10y ago
  > Any fraud is paid for by the merchant seller. Not if the transaction uses 3D secure.
  - tyingq 10y ago
    In the US, if you accept only 3D secure, you would go out of business. If made optional, it is a tiny percentage of sales.
caseysoftware 10y ago
That was one of the points in the article. Since the merchant implements the limit and not the bank itself, you work across N merchants and you get plenty of attempts. And if the merchant is trying to be "consumer friendly" and accepts a relatively high number of failures before blocking the transaction, the allowed number of attempts is probably staggering.
- deleted 10y ago
  [deleted]
erikpukinskis 10y ago
They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.
- StephanTLavavej 10y ago
  Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100 4-digit numbers is (9,900/10,000)^100 = 0.366 = 36.6%. That's substantial! Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.
  - caf 10y ago
    Guessing 100 numbers, there's a chance to produce 2 or more hits, of course. ..to the point that the expected value should converge to the same amount, right?
    - kctess5 10y ago
      The expected value of both strategies is to have 1 success, but they have different variance. The first strategy has variance of 0.99, and the second strategy has variance 0. The chance of n out of 100 hits with the first strategy is: binomial(100,n) x 0.01^n x 0.99^(100-n) edit: asterisks as multiplication signs => italics
      - erikpukinskis 10y ago
        Right, but variance doesn't matter if you just repeat the scam tomorrow.
- aquadrop 10y ago
  But that means you have pretty low conversion rate. You have 1000 numbers of stolen cards, and you only going to get 10 of them? It reduces profitability substantially. And even 100 attempts is enough to mark card as stolen if bank is watching it.

tyingq 10y ago

Sadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller. It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.

baldeagle 10y ago
I'm sure the IRS and a number of other groups would love access to this data.
- tyingq 10y ago
  For the most part, the data is already centralized. It just isn't used for anti fraud measures that would help online merchants. The cc companies and banks do leverage aggregated data when they are the ones that hold the bag....like card present transactions.
  - seanp2k2 10y ago
    Yep, it would cost them to implement and maintain, and they have no financial incentive to do so. It's not like they have a brand to ruin either; everyone already hates them, but Visa and MasterCard run the US market (and much of the global market), so they can do whatever they want to consumers without fear of backlash / loss of business.
user5994461 10y ago
> Any fraud is paid for by the merchant seller. Not if the transaction uses 3D secure.
- tyingq 10y ago
  In the US, if you accept only 3D secure, you would go out of business. If made optional, it is a tiny percentage of sales.

caseysoftware 10y ago

That was one of the points in the article. Since the merchant implements the limit and not the bank itself, you work across N merchants and you get plenty of attempts. And if the merchant is trying to be "consumer friendly" and accepts a relatively high number of failures before blocking the transaction, the allowed number of attempts is probably staggering.

deleted 10y ago
[deleted]

erikpukinskis 10y ago

They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.

StephanTLavavej 10y ago
Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100 4-digit numbers is (9,900/10,000)^100 = 0.366 = 36.6%. That's substantial! Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.
- caf 10y ago
  Guessing 100 numbers, there's a chance to produce 2 or more hits, of course. ..to the point that the expected value should converge to the same amount, right?
  - kctess5 10y ago
    The expected value of both strategies is to have 1 success, but they have different variance. The first strategy has variance of 0.99, and the second strategy has variance 0. The chance of n out of 100 hits with the first strategy is: binomial(100,n) x 0.01^n x 0.99^(100-n) edit: asterisks as multiplication signs => italics
    - erikpukinskis 10y ago
      Right, but variance doesn't matter if you just repeat the scam tomorrow.
aquadrop 10y ago
But that means you have pretty low conversion rate. You have 1000 numbers of stolen cards, and you only going to get 10 of them? It reduces profitability substantially. And even 100 attempts is enough to mark card as stolen if bank is watching it.