4 ms·

Sure, forgot that name wasn't provided. But name is the only additional information you need to make a legitimate purchase, and that information isn't a secret

by tjoff 8y ago

Sure, forgot that name wasn't provided. But name is the only additional information you need to make a legitimate purchase, and that information isn't a secret (if you, under any circumstance, ask for someones CVV they will tell you to fuck off. Ask for their name is another thing (maybe even present on a name tag or in many cases trivial in a certain context)). It will make it slightly harder to just randomly scan peoples pockets on the subway but still an absolute security nightmare. Just disable NFC altogether, no reason not to.

gruez 8y ago
>But name is the only additional information you need to make a legitimate purchase where did you get the impression that there are merchants (worth stealing from) that only accepts card number + expiry + name? the example I gave was with amazon, and they take name AND address. even if you're able to find a merchant with lax security and is worth stealing from, how long can you keep the scam up for? maybe a week or two before the fraud reports start pouring in? then they'll patch up their systems and you're back to square one. you're better off installing skimmers and using the card numbers at any merchant that accepts credit (at least in the US). >will make it slightly harder to just randomly scan peoples pockets on the subway but still an absolute security nightmare. considering that you have to be pretty close for NFC to work, whoever is doing it is going to look pretty suspicious as he's bumping into everyone walking endlessly through the train. >Just disable NFC altogether, no reason not to. I can think of one: convenience. wave your card in front of the reader vs insert card, wait, type in, wait some more, then taking out your card.
- tjoff 8y ago
  Do amazon really even validate the address to the card owner? I've sent stuff to different locations in different names using the same card. I've heard poker and gaming sites are popular to extract funds (and simultaneously launder them), don't expect them to have much security no. > considering that you have to be pretty close for NFC to work, whoever is doing it is going to look pretty suspicious as he's bumping into everyone walking endlessly through the train. Seriously? Just go during rush hour and you can basically stand still, the victims will practically bump into you for you. I don't expect anyone to attempt sprinting a carriage at a time...
  - ryanlol 8y ago
    >Do amazon really even validate the address to the card owner? I've sent stuff to different locations in different names using the same card. For initial orders, yes. Amazon has a very advanced fraud detection system that builds up trust with your account over a while. Amazon is very difficult to card. >I've heard poker and gaming sites are popular to extract funds (and simultaneously launder them), don't expect them to have much security no. All of those will require you to pass VBV. You will not get the information necessary to pass VBV without phishing.
    - tjoff 8y ago
      Doubt it, maybe for US residents? When I did my first purchase my address didn't match because I was officially living at my parents but sent the package to my own address. You make it sound like this is difficult or rare, yet banks have a very lax attitude about this and consequently funds thieves with billions upon billions every year. Somehow it is worth it, relying on the victims to scan their transaction history for errors (talk about convenient!).

by tjoff 8y ago

gruez 8y ago

>But name is the only additional information you need to make a legitimate purchase where did you get the impression that there are merchants (worth stealing from) that only accepts card number + expiry + name? the example I gave was with amazon, and they take name AND address. even if you're able to find a merchant with lax security and is worth stealing from, how long can you keep the scam up for? maybe a week or two before the fraud reports start pouring in? then they'll patch up their systems and you're back to square one. you're better off installing skimmers and using the card numbers at any merchant that accepts credit (at least in the US). >will make it slightly harder to just randomly scan peoples pockets on the subway but still an absolute security nightmare. considering that you have to be pretty close for NFC to work, whoever is doing it is going to look pretty suspicious as he's bumping into everyone walking endlessly through the train. >Just disable NFC altogether, no reason not to. I can think of one: convenience. wave your card in front of the reader vs insert card, wait, type in, wait some more, then taking out your card.

tjoff 8y ago
Do amazon really even validate the address to the card owner? I've sent stuff to different locations in different names using the same card. I've heard poker and gaming sites are popular to extract funds (and simultaneously launder them), don't expect them to have much security no. > considering that you have to be pretty close for NFC to work, whoever is doing it is going to look pretty suspicious as he's bumping into everyone walking endlessly through the train. Seriously? Just go during rush hour and you can basically stand still, the victims will practically bump into you for you. I don't expect anyone to attempt sprinting a carriage at a time...
- ryanlol 8y ago
  >Do amazon really even validate the address to the card owner? I've sent stuff to different locations in different names using the same card. For initial orders, yes. Amazon has a very advanced fraud detection system that builds up trust with your account over a while. Amazon is very difficult to card. >I've heard poker and gaming sites are popular to extract funds (and simultaneously launder them), don't expect them to have much security no. All of those will require you to pass VBV. You will not get the information necessary to pass VBV without phishing.
  - tjoff 8y ago
    Doubt it, maybe for US residents? When I did my first purchase my address didn't match because I was officially living at my parents but sent the package to my own address. You make it sound like this is difficult or rare, yet banks have a very lax attitude about this and consequently funds thieves with billions upon billions every year. Somehow it is worth it, relying on the victims to scan their transaction history for errors (talk about convenient!).