4 ms·

They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.

StephanTLavavej 10y ago
Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100 4-digit numbers is (9,900/10,000)^100 = 0.366 = 36.6%. That's substantial! Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.
- caf 10y ago
  Guessing 100 numbers, there's a chance to produce 2 or more hits, of course. ..to the point that the expected value should converge to the same amount, right?
  - kctess5 10y ago
    The expected value of both strategies is to have 1 success, but they have different variance. The first strategy has variance of 0.99, and the second strategy has variance 0. The chance of n out of 100 hits with the first strategy is: binomial(100,n) x 0.01^n x 0.99^(100-n) edit: asterisks as multiplication signs => italics
    - erikpukinskis 10y ago
      Right, but variance doesn't matter if you just repeat the scam tomorrow.
aquadrop 10y ago
But that means you have pretty low conversion rate. You have 1000 numbers of stolen cards, and you only going to get 10 of them? It reduces profitability substantially. And even 100 attempts is enough to mark card as stolen if bank is watching it.
- belovedeagle 10y ago
  They don't need to steal a card at all to do this. They're just guessing random numbers — everything after the issuer/cardtype numbers (first 5 or 6). So there's nothing to convert, and they only try a particular card number a few times.

StephanTLavavej 10y ago

Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100 4-digit numbers is (9,900/10,000)^100 = 0.366 = 36.6%. That's substantial! Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.

caf 10y ago
Guessing 100 numbers, there's a chance to produce 2 or more hits, of course. ..to the point that the expected value should converge to the same amount, right?
- kctess5 10y ago
  The expected value of both strategies is to have 1 success, but they have different variance. The first strategy has variance of 0.99, and the second strategy has variance 0. The chance of n out of 100 hits with the first strategy is: binomial(100,n) x 0.01^n x 0.99^(100-n) edit: asterisks as multiplication signs => italics
  - erikpukinskis 10y ago
    Right, but variance doesn't matter if you just repeat the scam tomorrow.

aquadrop 10y ago

But that means you have pretty low conversion rate. You have 1000 numbers of stolen cards, and you only going to get 10 of them? It reduces profitability substantially. And even 100 attempts is enough to mark card as stolen if bank is watching it.

belovedeagle 10y ago
They don't need to steal a card at all to do this. They're just guessing random numbers — everything after the issuer/cardtype numbers (first 5 or 6). So there's nothing to convert, and they only try a particular card number a few times.