5 ms·

To use a credit card you need not just the name but also the credit card number and possibly the csv and your zip code.

lotsofpulp 9y ago
Many hotel systems (at least Marriott/Hilton/IHG/Choice) have system’s that allow transactions with only the 15 or 16 digit card number and expiration. No need for name/billing address/zip/PIN or CVV code. I assume it’s due to old systems and hotel chains not having enough incentive to modernize systems because the vast majority of hotels are franchised, so if there is a chargeback, it’s the franchisee that pays, while the hotel chain still gets their royalty %. Edit: to avoid cancelation or no show fees, you can even make reservations with a fake card # (4111 1111 1111 1111) and unless the hotel has a deposit policy where they test the card to see if it has the funds it takes a payment to make sure the card has at least $x amount of money, then you can pretty much get away with not showing up at no expense.
- jsjohnst 9y ago
  > No need for name Technically there is never a need for a name for a CNP transaction. Merchants have no way of verifying it.
  - baldfat 9y ago
    Technically no way of verifying your identity so "Good Enough" wins the day.
  - pbhjpbhj 9y ago
    There's address hash matching on our CNP transactions (in UK). One could cross-check address with electoral roll/DVLA/(other commercial data sources) and verify a lot of transactions (name given was known at the address that matches the card data).
    - jsjohnst 9y ago
      Literally no intelligent company would do that as it’s extremely unreliable. As you mentioned though, we have AVS checks. I can’t understand why we don’t have the ability to also verify the card holder name and/or bank/issuer name via a merchant gateway for CNP transactions.
- nikcub 9y ago
  The address part is AVS[0] - where the digits from the address are verified against the card. Merchants can opt out of AVS in exchange for higher merchant fees. They can get a merchant deal where they don't require the CVV - Amazon does this[1] Hotels do this because of international travelers and because most credit card transactions end up becoming card present transactions since you show up to the hotel and tap/swipe your card [0] https://en.wikipedia.org/wiki/Address_Verification_System https://en.wikipedia.org/wiki/Address_Verification_System [1] https://security.stackexchange.com/questions/21168/how-does-amazon-bill-me-without-the-cvc-cvv-cvv2 https://security.stackexchange.com/questions/21168/how-does-...

Many hotel systems (at least Marriott/Hilton/IHG/Choice) have system’s that allow transactions with only the 15 or 16 digit card number and expiration. No need for name/billing address/zip/PIN or CVV code. I assume it’s due to old systems and hotel chains not having enough incentive to modernize systems because the vast majority of hotels are franchised, so if there is a chargeback, it’s the franchisee that pays, while the hotel chain still gets their royalty %. Edit: to avoid cancelation or no show fees, you can even make reservations with a fake card # (4111 1111 1111 1111) and unless the hotel has a deposit policy where they test the card to see if it has the funds it takes a payment to make sure the card has at least $x amount of money, then you can pretty much get away with not showing up at no expense.

jsjohnst 9y ago
> No need for name Technically there is never a need for a name for a CNP transaction. Merchants have no way of verifying it.
- baldfat 9y ago
  Technically no way of verifying your identity so "Good Enough" wins the day.
- pbhjpbhj 9y ago
  There's address hash matching on our CNP transactions (in UK). One could cross-check address with electoral roll/DVLA/(other commercial data sources) and verify a lot of transactions (name given was known at the address that matches the card data).
  - jsjohnst 9y ago
    Literally no intelligent company would do that as it’s extremely unreliable. As you mentioned though, we have AVS checks. I can’t understand why we don’t have the ability to also verify the card holder name and/or bank/issuer name via a merchant gateway for CNP transactions.
nikcub 9y ago
The address part is AVS[0] - where the digits from the address are verified against the card. Merchants can opt out of AVS in exchange for higher merchant fees. They can get a merchant deal where they don't require the CVV - Amazon does this[1] Hotels do this because of international travelers and because most credit card transactions end up becoming card present transactions since you show up to the hotel and tap/swipe your card [0] https://en.wikipedia.org/wiki/Address_Verification_System https://en.wikipedia.org/wiki/Address_Verification_System [1] https://security.stackexchange.com/questions/21168/how-does-amazon-bill-me-without-the-cvc-cvv-cvv2 https://security.stackexchange.com/questions/21168/how-does-...