5 ms·
MasterCard Serbia asked ladies to share FB photos of their credit card
- Corristowolf 9y agoAbsolutely laughable.
- k-mcgrady 9y agoObviously this is idiotic - however, is the information usable without the CVC number ('security' number on the back of the card)? I'm sure it's still useful information to have but probably not immediately useable.
- Asooka 9y agoIn my case it's not, and you also need my billing address to use my card, which isn't printed on it. Still, if you manage to collect 5000 credit card numbers, the CVV is 3 digits, which gives you 1000 possibilities and 1 - 0.999 * * 5000 = 0.99, so statistically you should hit one in 5000 cards if you guess CVV randomly.
- fnl 9y agoWell, as you point out, the probability of not hitting a valid CVV this way is non-zero, or 0.672% - if using R: choose(5000,0)*0.999^(5000-0)*0.001^0 But that means, by brute forcing, while you should crack at least one card, there is still a non-zero chance that this will be your unlucky day... (Cracking all cards with this methods, is - essentially - a zero-chance game, but even for that an infinitesimally small chance is left, that my computer cannot reproduce.)
- goldenkey 9y agoNothing is certain when combining uncertain independent events. Didnt need a calculator for basic measure theory..
- flipp3r 9y agoThere are some payment solutions where you don't even need to fill in the CVC. (I've ordered on Amazon a few years ago without needing to fill it in) Besides that, there were a couple people last year(s) who showed that you can obtain the CVC in an instant by submitting CVC's from 0 to 999, with the same credit card info, to many websites. (This was tested for Visa I believe) Edit: See http://www.independent.co.uk/news/uk/crime/criminals-guess-visa-card-details-fraud-six-seconds-a7450776.html http://www.independent.co.uk/news/uk/crime/criminals-guess-v... / https://news.ycombinator.com/item?id=13099949 https://news.ycombinator.com/item?id=13099949
- ewanm89 9y agoAmazon aren't allowed to store the CVV so transactions via their one click ordering has to be CVV less. The store gets lower fees on CVV transactions, but it has never been required.
- inopinatus 9y agoAbsolutely yes, a great many payment platforms will accept the details sans security code, as a card-not-present transaction.
- abricot 9y agoAs far as I understand, the CVC is only used for initial verification, and is not included in the data to the credit card processer.
- deleted 9y ago[deleted]
- hdra 9y agoThe CVC number is just one security measure in a credit card. One of the legitimacy signals, so to speak, and its absence is not an immediate fraud flag. While a bad security practise, a transaction can still go through if the other verification signals like expiry, name, billing address, etc (most of which are accessible through social media, btw) provide sufficient confidence in the legitimacy of the transaction.
- userbinator 9y agoI wonder if having the name and perhaps CVC on the front, and the card number on the back (and not in the way that they're currently produced, which leaves a mirror-image depression of the digits on the other side), would at least somewhat solve this problem of people wanting to show off their cards yet keep the critical information hidden.
- nailer 9y agoThe major clear web credit card scam site in the Philippines trades lists of websites which don't verify CVCs.
- runj__ 9y agoAmerican Express prints a four digit CVC on the front of the card, not a 100% sure about the reasoning there.
- stordoff 9y agoLast I checked, Amazon don't require the CVC nor an exact billing address match. You could probably order downloadable goods (e.g. PSN/XBL cards) to resell unless Amazon/the CC company's fraud checks flag the order.
- poizan42 9y agoIs it actually possible to check the billing address? Because most places won't even accept my name as it is written on my card. So usually I just put something fake since they won't let me put the real information anyways. I have probably bought for several thousand usd as "Your Mamma" without ever being rejected. Edit: Also as far as I know there's no specific address attached to my card or account except for the purpose of contacting me via snail mail.
- hughtopping 9y agoAddress validation just allows the retailer to check that the house number in the first line of the address and the numbers in the postcode match those of the card billing address.
- twhb 9y agoYes, it's immediately usable. CVC verifies you, not the transaction - websites ask for it not because they need it, but to see if you get it right. So, lacking the CVC may cause some cautious companies to refuse to take the card, but that's just their decision. You can still use it with less-cautious companies, or your own merchant account.
- rakoo 9y agoSome study some time ago showed that you can use the existing hundreds of websites that have some credit card form to brute force your way into getting all the fields: https://news.ycombinator.com/item?id=13161948 https://news.ycombinator.com/item?id=13161948
- deleted 9y ago[deleted]
- parandroid 9y agoI'm amazed by the fact this had actually gone through several levels of approval, and yet nobody noticed anything wrong with a request to snap a photo of your CC and post it online.
- deleted 9y ago[deleted]
- geff82 9y agoEpic :)
- edent 9y agoPeople do this on Twitter all the time. See https://twitter.com/needadebitcard https://twitter.com/needadebitcard for a collection. Getting a credit /debit card has always been a rite of passage for young people. Before online social networks, showing off your card to your friends was a low-risk activity. Now broadcasting the same information to all your peers places you in danger.
- userbinator 9y agoGiven that 10 tweets ago for that account is already in 2015, it (fortunately) doesn't seem like this is all that common. As of this post, the latest guy who tweeted his card (Mar 9) has a... rather ironic username.
- babuskov 9y agoI'm a native speaker, and no, the text shown on that picture does not ask you to take a photo of the credit card. The text reads: "If you own a Mastercard or Maestro, take a photo of the stuff you have in your purse". The problem here seems to be that people don't read what's written, but instead do what they think was written (Edit: apparently because it was shown in the example picture). I also read the official rules linked there. The rules state that only the winners need to prove they own the card by contacting MasterCard directly with a slip from any transaction made with that card. So, even if you win, you don't have to show the card, only to prove you have used it.
- andai 9y agoThe photo mastercard Serbia posted has a credit card in it...
- babuskov 9y agoLooks like that's what made all the confusion. They gave a bad example and people probably didn't read the text carefully and just followed the picture. You're right, that is misleading.
- HenryBemis 9y agoProblem is that people don't take the 30 seconds to read something. We are living in the age of "image"; this is why Instagram, Snapchat, 9gag, etc. are thriving, people want to get their "fix" by seeing at one-more-image.. Mastercard on the other hand should have thought about this and avoid putting the card on their photo, as "normal people" will tend to mimic without spending those 30 seconds thinking about "I ain't giving you my real name/surname/card details"! But hey.. it worked :) Now let's sit back and soon we'll learn how many hits would their cards have, from websites that don't require the card verification value (CVV) :)
- 1337biz 9y agowebsites that don't require the card verification value (CVV) Are these still out there?