4 ms·

Obviously this is idiotic - however, is the information usable without the CVC number ('security' number on the back of the card)? I'm sure it's still useful in

Obviously this is idiotic - however, is the information usable without the CVC number ('security' number on the back of the card)? I'm sure it's still useful information to have but probably not immediately useable.

Asooka 9y ago
In my case it's not, and you also need my billing address to use my card, which isn't printed on it. Still, if you manage to collect 5000 credit card numbers, the CVV is 3 digits, which gives you 1000 possibilities and 1 - 0.999 * * 5000 = 0.99, so statistically you should hit one in 5000 cards if you guess CVV randomly.
- fnl 9y ago
  Well, as you point out, the probability of not hitting a valid CVV this way is non-zero, or 0.672% - if using R: choose(5000,0)*0.999^(5000-0)*0.001^0 But that means, by brute forcing, while you should crack at least one card, there is still a non-zero chance that this will be your unlucky day... (Cracking all cards with this methods, is - essentially - a zero-chance game, but even for that an infinitesimally small chance is left, that my computer cannot reproduce.)
  - goldenkey 9y ago
    Nothing is certain when combining uncertain independent events. Didnt need a calculator for basic measure theory..
flipp3r 9y ago
There are some payment solutions where you don't even need to fill in the CVC. (I've ordered on Amazon a few years ago without needing to fill it in) Besides that, there were a couple people last year(s) who showed that you can obtain the CVC in an instant by submitting CVC's from 0 to 999, with the same credit card info, to many websites. (This was tested for Visa I believe) Edit: See http://www.independent.co.uk/news/uk/crime/criminals-guess-visa-card-details-fraud-six-seconds-a7450776.html http://www.independent.co.uk/news/uk/crime/criminals-guess-v... / https://news.ycombinator.com/item?id=13099949 https://news.ycombinator.com/item?id=13099949
- ewanm89 9y ago
  Amazon aren't allowed to store the CVV so transactions via their one click ordering has to be CVV less. The store gets lower fees on CVV transactions, but it has never been required.
inopinatus 9y ago
Absolutely yes, a great many payment platforms will accept the details sans security code, as a card-not-present transaction.
abricot 9y ago
As far as I understand, the CVC is only used for initial verification, and is not included in the data to the credit card processer.
deleted 9y ago
[deleted]
hdra 9y ago
The CVC number is just one security measure in a credit card. One of the legitimacy signals, so to speak, and its absence is not an immediate fraud flag. While a bad security practise, a transaction can still go through if the other verification signals like expiry, name, billing address, etc (most of which are accessible through social media, btw) provide sufficient confidence in the legitimacy of the transaction.
userbinator 9y ago
I wonder if having the name and perhaps CVC on the front, and the card number on the back (and not in the way that they're currently produced, which leaves a mirror-image depression of the digits on the other side), would at least somewhat solve this problem of people wanting to show off their cards yet keep the critical information hidden.
nailer 9y ago
The major clear web credit card scam site in the Philippines trades lists of websites which don't verify CVCs.
runj__ 9y ago
American Express prints a four digit CVC on the front of the card, not a 100% sure about the reasoning there.
stordoff 9y ago
Last I checked, Amazon don't require the CVC nor an exact billing address match. You could probably order downloadable goods (e.g. PSN/XBL cards) to resell unless Amazon/the CC company's fraud checks flag the order.
- poizan42 9y ago
  Is it actually possible to check the billing address? Because most places won't even accept my name as it is written on my card. So usually I just put something fake since they won't let me put the real information anyways. I have probably bought for several thousand usd as "Your Mamma" without ever being rejected. Edit: Also as far as I know there's no specific address attached to my card or account except for the purpose of contacting me via snail mail.
  - hughtopping 9y ago
    Address validation just allows the retailer to check that the house number in the first line of the address and the numbers in the postcode match those of the card billing address.
twhb 9y ago
Yes, it's immediately usable. CVC verifies you, not the transaction - websites ask for it not because they need it, but to see if you get it right. So, lacking the CVC may cause some cautious companies to refuse to take the card, but that's just their decision. You can still use it with less-cautious companies, or your own merchant account.
rakoo 9y ago
Some study some time ago showed that you can use the existing hundreds of websites that have some credit card form to brute force your way into getting all the fields: https://news.ycombinator.com/item?id=13161948 https://news.ycombinator.com/item?id=13161948

Asooka 9y ago

In my case it's not, and you also need my billing address to use my card, which isn't printed on it. Still, if you manage to collect 5000 credit card numbers, the CVV is 3 digits, which gives you 1000 possibilities and 1 - 0.999 * * 5000 = 0.99, so statistically you should hit one in 5000 cards if you guess CVV randomly.

fnl 9y ago
Well, as you point out, the probability of not hitting a valid CVV this way is non-zero, or 0.672% - if using R: choose(5000,0)*0.999^(5000-0)*0.001^0 But that means, by brute forcing, while you should crack at least one card, there is still a non-zero chance that this will be your unlucky day... (Cracking all cards with this methods, is - essentially - a zero-chance game, but even for that an infinitesimally small chance is left, that my computer cannot reproduce.)
- goldenkey 9y ago
  Nothing is certain when combining uncertain independent events. Didnt need a calculator for basic measure theory..

flipp3r 9y ago

There are some payment solutions where you don't even need to fill in the CVC. (I've ordered on Amazon a few years ago without needing to fill it in) Besides that, there were a couple people last year(s) who showed that you can obtain the CVC in an instant by submitting CVC's from 0 to 999, with the same credit card info, to many websites. (This was tested for Visa I believe) Edit: See http://www.independent.co.uk/news/uk/crime/criminals-guess-visa-card-details-fraud-six-seconds-a7450776.html http://www.independent.co.uk/news/uk/crime/criminals-guess-v... / https://news.ycombinator.com/item?id=13099949 https://news.ycombinator.com/item?id=13099949

ewanm89 9y ago
Amazon aren't allowed to store the CVV so transactions via their one click ordering has to be CVV less. The store gets lower fees on CVV transactions, but it has never been required.

inopinatus 9y ago

Absolutely yes, a great many payment platforms will accept the details sans security code, as a card-not-present transaction.

abricot 9y ago

As far as I understand, the CVC is only used for initial verification, and is not included in the data to the credit card processer.

deleted 9y ago

[deleted]

hdra 9y ago

The CVC number is just one security measure in a credit card. One of the legitimacy signals, so to speak, and its absence is not an immediate fraud flag. While a bad security practise, a transaction can still go through if the other verification signals like expiry, name, billing address, etc (most of which are accessible through social media, btw) provide sufficient confidence in the legitimacy of the transaction.

userbinator 9y ago

I wonder if having the name and perhaps CVC on the front, and the card number on the back (and not in the way that they're currently produced, which leaves a mirror-image depression of the digits on the other side), would at least somewhat solve this problem of people wanting to show off their cards yet keep the critical information hidden.

nailer 9y ago

The major clear web credit card scam site in the Philippines trades lists of websites which don't verify CVCs.

runj__ 9y ago

American Express prints a four digit CVC on the front of the card, not a 100% sure about the reasoning there.

stordoff 9y ago

Last I checked, Amazon don't require the CVC nor an exact billing address match. You could probably order downloadable goods (e.g. PSN/XBL cards) to resell unless Amazon/the CC company's fraud checks flag the order.

poizan42 9y ago
Is it actually possible to check the billing address? Because most places won't even accept my name as it is written on my card. So usually I just put something fake since they won't let me put the real information anyways. I have probably bought for several thousand usd as "Your Mamma" without ever being rejected. Edit: Also as far as I know there's no specific address attached to my card or account except for the purpose of contacting me via snail mail.
- hughtopping 9y ago
  Address validation just allows the retailer to check that the house number in the first line of the address and the numbers in the postcode match those of the card billing address.

twhb 9y ago

Yes, it's immediately usable. CVC verifies you, not the transaction - websites ask for it not because they need it, but to see if you get it right. So, lacking the CVC may cause some cautious companies to refuse to take the card, but that's just their decision. You can still use it with less-cautious companies, or your own merchant account.

rakoo 9y ago

Some study some time ago showed that you can use the existing hundreds of websites that have some credit card form to brute force your way into getting all the fields: https://news.ycombinator.com/item?id=13161948 https://news.ycombinator.com/item?id=13161948