3 ms·

The price of a single ticket is probably relatively small and so they may be protecting themselves from chargebacks. It is extremely common for those with stole

by ktsmith 16y ago

The price of a single ticket is probably relatively small and so they may be protecting themselves from chargebacks. It is extremely common for those with stolen credit cards to test them using small value purchases. If you can find a site that doesn't rate limit your purchases in any way you can test a lot of cards at once, determine which cards are valid/active, and saddle the merchant account holder with tons of chargebacks and their associated fees.

edanm 16y ago
I'd be very surprised to learn it was this complicated, but this is a very interesting take on it. Do people tend to have such a bulk of credit cards/credit card numbers that they'd test them in such a fashion? And also, wouldn't it be very risky (detection/police wise)?
- ktsmith 16y ago
  I can't speak to anything but my own experience. Having helped on a few ecommerce sites for very small merchants, the amount of fraudulent purchases that came through was staggering. One of those companies has been open for about six months now and is only breaking even in large part due to the expense of dealing with chargebacks. What they have observed is that a significant number of cards were tested through what appears to have been a rented botnet. Those went away with the addition of a captcha. The remaining fraud that looks like card testing (only purchases of low value items, with IP's far away from the billing address and similar peculiarities) are often done from Tor exit nodes. Small merchants have very little support in this area. Local authorities often don't care or have the man power to deal with these types of issues. The banks and visa/mastercard also don't care since they just force the merchant to eat the costs and still collect all their fees. It would be very difficult to tie these transactions back to any one person in most cases as the tester is going to be using a valid card, valid billing/shipping address. Once they know the card works they can just have a mule go get a cash advance from an ATM or start having big ticket items shipped to various places for pickup. Or they just resell the card info as verified which increases the value significantly.

by ktsmith 16y ago

edanm 16y ago

I'd be very surprised to learn it was this complicated, but this is a very interesting take on it. Do people tend to have such a bulk of credit cards/credit card numbers that they'd test them in such a fashion? And also, wouldn't it be very risky (detection/police wise)?

ktsmith 16y ago
I can't speak to anything but my own experience. Having helped on a few ecommerce sites for very small merchants, the amount of fraudulent purchases that came through was staggering. One of those companies has been open for about six months now and is only breaking even in large part due to the expense of dealing with chargebacks. What they have observed is that a significant number of cards were tested through what appears to have been a rented botnet. Those went away with the addition of a captcha. The remaining fraud that looks like card testing (only purchases of low value items, with IP's far away from the billing address and similar peculiarities) are often done from Tor exit nodes. Small merchants have very little support in this area. Local authorities often don't care or have the man power to deal with these types of issues. The banks and visa/mastercard also don't care since they just force the merchant to eat the costs and still collect all their fees. It would be very difficult to tie these transactions back to any one person in most cases as the tester is going to be using a valid card, valid billing/shipping address. Once they know the card works they can just have a mule go get a cash advance from an ATM or start having big ticket items shipped to various places for pickup. Or they just resell the card info as verified which increases the value significantly.