12 ms·

If you run an online store that doesn't validate credit cards correctly you will become an API for fraudsters to check the validity of Visa numbers.

deleted 9y ago
[deleted]
_-david-_ 9y ago
What is the proper way to validate credit cards?
- castis 9y ago
  To just validate the numbers themselves, you can use https://en.wikipedia.org/wiki/Luhn_algorithm https://en.wikipedia.org/wiki/Luhn_algorithm Beyond that, I'm not sure what that person is talking about.
  - meesterdude 9y ago
    FYI that's not enough. That may act as a form validation, but does not verify that the card is active and able to be used. Anyone can run the Luhn against a card # - but thieves have known CC numbers and want to verify they can be used. As a merchant you have to be somewhat on top of your orders and cancel any "suspicious" ones to prevent chargebacks.
    - deleted 9y ago
      [deleted]
    - castis 9y ago
      Well aware, thanks. I only ever stated that the Luhn algorithm would validate just the numbers.
- cft 9y ago
  Write risk algorithms that return false negatives to the suspected carders in your logic, before you proxy card data to the processor. If you don't, you will soon hit 1% chargeback threshold and your account will suffer.
- ploxiln 9y ago
  There's no good way. You have to use heuristics. CC companies won't help you. https://www.candyjapan.com/behind-the-scenes/how-i-got-credit-card-fraud-somewhat-under-control https://www.candyjapan.com/behind-the-scenes/how-i-got-credi... This is pretty much why I think credit cards are unfairly one-sided, and is a big advantage to crypto-currencies like bitcoin. CC are as easy as possible for the consumer, but it's up to the business to guess if the consumer is authorized to use it, and there's no good way to be sure. Some people are going to be unfairly shafted. Oh and credit card networks can do things like shut off access to WikiLeaks if the US government asks them to. The system mostly works for most people in western countries - but it is very flawed.
- hibikir 9y ago
  If you have a brick and mortar business, probably nothing. If you are selling on the internet, and, probably put a step between you and an old school credit card processor that will do that checking for you, professionally. There's just way too much money in credit card fraud to have anything that even resembles good online protection as a small business. Some fancy online card processors will do this for you automatically. Otherwise, there's companies that do this logic for you, and work across processors. Ultimately, we should all get out of the business of transferring money by just entering credit card numbers, which are easy t copy. Many parts of the world are already moving to systems that require 2fa, and fraud rates drop like a rock. Good luck convincing US banks and online retailers to change everything to do this though.
  - Styn 9y ago
    Yeah, where I'm from (Belgium) 2fa is the industry standard by now, and fraud cases were reduced immensely when a previous employer of mine made the switch several years ago. But like you mentioned, this is not just up to devs in most cases...
    - angus-prune 9y ago
      How does 2fa work in practice for credit card payments?
      - Symbiote 9y ago
        Both my Danish and British accounts send an SMS for some purchases, usually only larger ones. I have to type it into a box on a form. They used to use a password, but that risks people putting their bank password into some dodgy shopping site. VISA's implementation: https://www.visaeurope.com/making-payments/verified-by-visa/ https://www.visaeurope.com/making-payments/verified-by-visa/
      - Styn 9y ago
        Bit of a late reply but almost all companies use something called a digipass, you insert your card and input a challenge code and your pin. https://i.imgur.com/10OChcv.jpg https://i.imgur.com/10OChcv.jpg
- throw238513 9y ago
  MaxMind's minFraud[0] was the most popular last time I checked. You give them the credit card info, the IP of the user, their email etc[1] and $0.005 (per credit card transaction you want them to check) and they tell you the probability that it's fraud. At my company we use Stripe as our payment processor, which has their own fraud detection called Radar. But still, a bit under .1% of our transactions are fraudulent. Credit card fraud is honestly a great business, even if they know you're doing it, the police wont do anything, and the merchant has to cover the cost and pay $15 for the privilege of being defrauded. [0] https://www.maxmind.com/en/minfraud-services https://www.maxmind.com/en/minfraud-services [1] https://minfraud.readthedocs.io/en/latest/ https://minfraud.readthedocs.io/en/latest/ Sorta related, turns out there are anti-fraud services for fraudsters https://krebsonsecurity.com/2013/11/anti-fraud-service-for-fraudsters/ https://krebsonsecurity.com/2013/11/anti-fraud-service-for-f...
  - column 9y ago
    isn't this the kind of service that will flag a legitimate user behind a VPN as a potential threat because his ip has been used in multiple transactions? Should a user switch off his VPN to do shopping?
    - GuB-42 9y ago
      If that VPN IP range is known to be used by fraudsters then yes, for good reasons. And if your VPN is affordable and "privacy oriented" there is a very good chance that a bunch of crooks are going to use it. Professional VPNs are probably fine.
- fweespeech 9y ago
  > What is the proper way to validate credit cards? A) If you are asking that question, you really should use something like https://stripe.com/radar https://stripe.com/radar But assuming you don't want to: 1) Validate against the standard checksum formulas (this catches legit typos) 1b) https://en.wikipedia.org/wiki/Luhn_algorithm https://en.wikipedia.org/wiki/Luhn_algorithm 1c) Regardless of what happens next, send an order confirmation and play dead. 1d) If it fails any of the following steps, send a politely worded "issue with the order" e-mail and to contact you (after 24 hours). Use a reason that sounds generic rather than credit card specific. 2) Check GeoIP and compare against potentially geographic space. (this catches VPNs, etc. For instance, shipping to a US freight forwarder from a Russian IP is likely highly probably fraud. The customer can call/e-mail you if they get caught in this.) 2b) Services like https://www.maxmind.com/en/minfraud-services https://www.maxmind.com/en/minfraud-services qualify for this. 3) Check address locations against known US freight forwarders / PO boxes / UPS Stores / etc. Force additional customer verification, like for IP addresses. 4) To validate repeat card usage, fingerprint cards that were successfully charged and you didn't receive a chargeback after the window closes: https://security.stackexchange.com/questions/63248/hashing-a-credit-card-number-for-use-as-a-fingerprint https://security.stackexchange.com/questions/63248/hashing-a... You can use Stripe/Braintree tokens or your own implementation. 5) If it fails step 4: 5a) Run whatever business heuristics/signals that might be true for your customer base. Too specific to get into really. 5b) Actually charge the card and see what happens. If its declined by the credit card company, send the generic contact e-mail.
JohnTHaller 9y ago
> you will become an API for fraudsters to check the validity of Visa numbers. Anyone accepting donations via PayPal
- Cthulhu_ 9y ago
  It's PayPal that needs to check that stuff then. And even then fraud can occur to one's service.
  - JohnTHaller 9y ago
    Except they refuse to. So you see a constant stream of $0.01 to $0.03 donations. You have to manually refund every one of them out of your own PayPal balance or you get hit with a $25 chargeback fee.

deleted 9y ago

[deleted]

_-david-_ 9y ago

What is the proper way to validate credit cards?

castis 9y ago
To just validate the numbers themselves, you can use https://en.wikipedia.org/wiki/Luhn_algorithm https://en.wikipedia.org/wiki/Luhn_algorithm Beyond that, I'm not sure what that person is talking about.
- meesterdude 9y ago
  FYI that's not enough. That may act as a form validation, but does not verify that the card is active and able to be used. Anyone can run the Luhn against a card # - but thieves have known CC numbers and want to verify they can be used. As a merchant you have to be somewhat on top of your orders and cancel any "suspicious" ones to prevent chargebacks.
  - deleted 9y ago
    [deleted]
  - castis 9y ago
    Well aware, thanks. I only ever stated that the Luhn algorithm would validate just the numbers.
cft 9y ago
Write risk algorithms that return false negatives to the suspected carders in your logic, before you proxy card data to the processor. If you don't, you will soon hit 1% chargeback threshold and your account will suffer.
ploxiln 9y ago
There's no good way. You have to use heuristics. CC companies won't help you. https://www.candyjapan.com/behind-the-scenes/how-i-got-credit-card-fraud-somewhat-under-control https://www.candyjapan.com/behind-the-scenes/how-i-got-credi... This is pretty much why I think credit cards are unfairly one-sided, and is a big advantage to crypto-currencies like bitcoin. CC are as easy as possible for the consumer, but it's up to the business to guess if the consumer is authorized to use it, and there's no good way to be sure. Some people are going to be unfairly shafted. Oh and credit card networks can do things like shut off access to WikiLeaks if the US government asks them to. The system mostly works for most people in western countries - but it is very flawed.
hibikir 9y ago
If you have a brick and mortar business, probably nothing. If you are selling on the internet, and, probably put a step between you and an old school credit card processor that will do that checking for you, professionally. There's just way too much money in credit card fraud to have anything that even resembles good online protection as a small business. Some fancy online card processors will do this for you automatically. Otherwise, there's companies that do this logic for you, and work across processors. Ultimately, we should all get out of the business of transferring money by just entering credit card numbers, which are easy t copy. Many parts of the world are already moving to systems that require 2fa, and fraud rates drop like a rock. Good luck convincing US banks and online retailers to change everything to do this though.
- Styn 9y ago
  Yeah, where I'm from (Belgium) 2fa is the industry standard by now, and fraud cases were reduced immensely when a previous employer of mine made the switch several years ago. But like you mentioned, this is not just up to devs in most cases...
  - angus-prune 9y ago
    How does 2fa work in practice for credit card payments?
    - Symbiote 9y ago
      Both my Danish and British accounts send an SMS for some purchases, usually only larger ones. I have to type it into a box on a form. They used to use a password, but that risks people putting their bank password into some dodgy shopping site. VISA's implementation: https://www.visaeurope.com/making-payments/verified-by-visa/ https://www.visaeurope.com/making-payments/verified-by-visa/
    - Styn 9y ago
      Bit of a late reply but almost all companies use something called a digipass, you insert your card and input a challenge code and your pin. https://i.imgur.com/10OChcv.jpg https://i.imgur.com/10OChcv.jpg
throw238513 9y ago
MaxMind's minFraud[0] was the most popular last time I checked. You give them the credit card info, the IP of the user, their email etc[1] and $0.005 (per credit card transaction you want them to check) and they tell you the probability that it's fraud. At my company we use Stripe as our payment processor, which has their own fraud detection called Radar. But still, a bit under .1% of our transactions are fraudulent. Credit card fraud is honestly a great business, even if they know you're doing it, the police wont do anything, and the merchant has to cover the cost and pay $15 for the privilege of being defrauded. [0] https://www.maxmind.com/en/minfraud-services https://www.maxmind.com/en/minfraud-services [1] https://minfraud.readthedocs.io/en/latest/ https://minfraud.readthedocs.io/en/latest/ Sorta related, turns out there are anti-fraud services for fraudsters https://krebsonsecurity.com/2013/11/anti-fraud-service-for-fraudsters/ https://krebsonsecurity.com/2013/11/anti-fraud-service-for-f...
- column 9y ago
  isn't this the kind of service that will flag a legitimate user behind a VPN as a potential threat because his ip has been used in multiple transactions? Should a user switch off his VPN to do shopping?
  - GuB-42 9y ago
    If that VPN IP range is known to be used by fraudsters then yes, for good reasons. And if your VPN is affordable and "privacy oriented" there is a very good chance that a bunch of crooks are going to use it. Professional VPNs are probably fine.
fweespeech 9y ago
> What is the proper way to validate credit cards? A) If you are asking that question, you really should use something like https://stripe.com/radar https://stripe.com/radar But assuming you don't want to: 1) Validate against the standard checksum formulas (this catches legit typos) 1b) https://en.wikipedia.org/wiki/Luhn_algorithm https://en.wikipedia.org/wiki/Luhn_algorithm 1c) Regardless of what happens next, send an order confirmation and play dead. 1d) If it fails any of the following steps, send a politely worded "issue with the order" e-mail and to contact you (after 24 hours). Use a reason that sounds generic rather than credit card specific. 2) Check GeoIP and compare against potentially geographic space. (this catches VPNs, etc. For instance, shipping to a US freight forwarder from a Russian IP is likely highly probably fraud. The customer can call/e-mail you if they get caught in this.) 2b) Services like https://www.maxmind.com/en/minfraud-services https://www.maxmind.com/en/minfraud-services qualify for this. 3) Check address locations against known US freight forwarders / PO boxes / UPS Stores / etc. Force additional customer verification, like for IP addresses. 4) To validate repeat card usage, fingerprint cards that were successfully charged and you didn't receive a chargeback after the window closes: https://security.stackexchange.com/questions/63248/hashing-a-credit-card-number-for-use-as-a-fingerprint https://security.stackexchange.com/questions/63248/hashing-a... You can use Stripe/Braintree tokens or your own implementation. 5) If it fails step 4: 5a) Run whatever business heuristics/signals that might be true for your customer base. Too specific to get into really. 5b) Actually charge the card and see what happens. If its declined by the credit card company, send the generic contact e-mail.

JohnTHaller 9y ago

> you will become an API for fraudsters to check the validity of Visa numbers. Anyone accepting donations via PayPal

Cthulhu_ 9y ago
It's PayPal that needs to check that stuff then. And even then fraud can occur to one's service.
- JohnTHaller 9y ago
  Except they refuse to. So you see a constant stream of $0.01 to $0.03 donations. You have to manually refund every one of them out of your own PayPal balance or you get hit with a $25 chargeback fee.