5 ms·

Sure, you can get this data, but you also have to test what credit cards work and what don't. You can't just go to an ATM and start working through 50 credit c

Sure, you can get this data, but you also have to test what credit cards work and what don't. You can't just go to an ATM and start working through 50 credit cards you stole until one worked without something noticing. I'm assuming a lot of the cost is sunk to just testing if the credit cards even work and how well their fraud detector/max purchase limit is set up, which is very costly, so labor cost might be very high compared to the raw $25-per-number. Some time ago I accidentally stumbled upon how some organized crime ring determined which credit cards worked. Someone in my party asked the Uber driver one night what other gigs they do for money. He said he uses this one card to get 40% cash back. Of course I asked more questions being the only one in security at this party: He starts talking saying he goes around to different, small, local businesses - but never visiting the same place twice - and uses this card to pay for his friends' food, splitting the bill, but keeping the cash back rewards. Sometimes the card is rejected and he has to keep trying until it works finally. The actual credit card has to frequently connect to his phone by pushing a button on the card to sync with his phone to make purchases. Of course what his phone is doing is downloading a backlog of CCN's which then is sent to the credit card to change the magnetic strip dynamically - completely unknown to him he's testing if credit card numbers are working and getting paid for it. Genius scam, but that's what this one specific crime ring has to pay in order to check the availability of stolen credit card numbers.

inetknght 6y ago
Does he get a bill and have to pay off the card? I assume that would _also_ go to stolen bank accounts.
- skim_milk 6y ago
  I couldn't tell 100% if he was "in" on the scam or not - has he really never thought of why they tell him to go to distant restaurants, never returning, and why the card is always declined multiple times, and why the cash back is THAT HIGH? He did give me a referral as if he was trying to sell this idea but I didn't get very far in their signup (first question: my full name. pulled the plug there) and he introduced this topic as if he was "working" on this "technology" that I had to ask a dozen questions to pry open before he even got us introduced to his "credit card" (either he was really working on it and wanted to keep it secret from us actual techies, or knew something was sketchy and didn't want people to know he was doing shady stuff, or he genuinely thinks he is beta testing some legit technology and getting rewarded for it but didn't want to immediately go into detail) But if he isn't in on the scam and does pay off his card, funny enough, that must mean all of his money is going directly to the crime ring. Two birds with one stone!
- Taek 6y ago
  The bill to pay off the card goes to the original cardholder. Then the mob bills him for his purchase (this is where the mob makes money), and then the mob gives him 40% cash back.
ryanlol 6y ago
> You can't just go to an ATM and start working through 50 credit cards you stole until one worked without something noticing. Why not? ATMs work at 3AM. > but you also have to test what credit cards work and what don't Not really, if it’s data you skimmed yourself odds are they’ll work more than half the time.
- michaelt 6y ago
  > Why not? ATMs work at 3AM. If I was in fraud detection there would be fraud flag contagion: If 25% of them started out as blocked and you tested them all, afterwards 100% would be blocked.
  - pc86 6y ago
    How do you know who the "you" is? It's not like somebody's sitting there watching the CCTV footage. I can think of ways around it myself but I don't think they're realistic for the number of times this would actually happen.
    - michaelt 6y ago
      I'm no expert in these things, but I'd imagine there would be a soft flag for possible fraud, that triggers something like text messages to customers confirming their purchases. If within X minutes you see Y cards and Z of them are known to be stolen, you set the soft fraud flag on all of them. Values of X, Y and Z would be set based on historical data. You could still test your stolen cards, of course - but 5 at a time, not 50 at a time.
      - ryanlol 6y ago
        This would require significant collaboration between banks, seems unlikely.
  - blaser-waffle 6y ago
    Wear a hood/mask/glasses. Hit ATM at 3am. Park behind the building or a block away. Test 25% of the cards. Then repeat for each block of 25%.
strogonoff 6y ago
An episode of Reply All[0] hints at another potential way of automated stolen credit card testing workflow. In short, Domino’s across the US regularly receive strange orders for $2 Coke (and nothing else), which then no one ever picks up. The theory is, if a card doesn’t work, an automated script detects that as online order form switches to cash—and if it works, given the popularity of Domino’s this transaction might just slip by the cardholder’s attention. [0] https://gimletmedia.com/shows/reply-all/z3hgd2 https://gimletmedia.com/shows/reply-all/z3hgd2
iamwil 6y ago
Fraudsters also test credit cards by donating a little bit to various charities. They tend to have far less stringent fraud detection.
- skim_milk 6y ago
  My mother had her credit card info stolen online somewhere - the first two fraudulent hits were exactly $5k with payment memo saying it was going to some county's bail system (yeah, sure it was Visa, whatever you say). The third fraudulent payment was to the Hillary Clinton campaign for $15 which was flagged by the fraud detection. My parents' experience suggests donating to charity probably isn't as effective any more.

inetknght 6y ago

Does he get a bill and have to pay off the card? I assume that would _also_ go to stolen bank accounts.

skim_milk 6y ago
I couldn't tell 100% if he was "in" on the scam or not - has he really never thought of why they tell him to go to distant restaurants, never returning, and why the card is always declined multiple times, and why the cash back is THAT HIGH? He did give me a referral as if he was trying to sell this idea but I didn't get very far in their signup (first question: my full name. pulled the plug there) and he introduced this topic as if he was "working" on this "technology" that I had to ask a dozen questions to pry open before he even got us introduced to his "credit card" (either he was really working on it and wanted to keep it secret from us actual techies, or knew something was sketchy and didn't want people to know he was doing shady stuff, or he genuinely thinks he is beta testing some legit technology and getting rewarded for it but didn't want to immediately go into detail) But if he isn't in on the scam and does pay off his card, funny enough, that must mean all of his money is going directly to the crime ring. Two birds with one stone!
Taek 6y ago
The bill to pay off the card goes to the original cardholder. Then the mob bills him for his purchase (this is where the mob makes money), and then the mob gives him 40% cash back.

ryanlol 6y ago

> You can't just go to an ATM and start working through 50 credit cards you stole until one worked without something noticing. Why not? ATMs work at 3AM. > but you also have to test what credit cards work and what don't Not really, if it’s data you skimmed yourself odds are they’ll work more than half the time.

michaelt 6y ago
> Why not? ATMs work at 3AM. If I was in fraud detection there would be fraud flag contagion: If 25% of them started out as blocked and you tested them all, afterwards 100% would be blocked.
- pc86 6y ago
  How do you know who the "you" is? It's not like somebody's sitting there watching the CCTV footage. I can think of ways around it myself but I don't think they're realistic for the number of times this would actually happen.
  - michaelt 6y ago
    I'm no expert in these things, but I'd imagine there would be a soft flag for possible fraud, that triggers something like text messages to customers confirming their purchases. If within X minutes you see Y cards and Z of them are known to be stolen, you set the soft fraud flag on all of them. Values of X, Y and Z would be set based on historical data. You could still test your stolen cards, of course - but 5 at a time, not 50 at a time.
    - ryanlol 6y ago
      This would require significant collaboration between banks, seems unlikely.
- blaser-waffle 6y ago
  Wear a hood/mask/glasses. Hit ATM at 3am. Park behind the building or a block away. Test 25% of the cards. Then repeat for each block of 25%.

strogonoff 6y ago

An episode of Reply All[0] hints at another potential way of automated stolen credit card testing workflow. In short, Domino’s across the US regularly receive strange orders for $2 Coke (and nothing else), which then no one ever picks up. The theory is, if a card doesn’t work, an automated script detects that as online order form switches to cash—and if it works, given the popularity of Domino’s this transaction might just slip by the cardholder’s attention. [0] https://gimletmedia.com/shows/reply-all/z3hgd2 https://gimletmedia.com/shows/reply-all/z3hgd2

iamwil 6y ago

Fraudsters also test credit cards by donating a little bit to various charities. They tend to have far less stringent fraud detection.

skim_milk 6y ago
My mother had her credit card info stolen online somewhere - the first two fraudulent hits were exactly $5k with payment memo saying it was going to some county's bail system (yeah, sure it was Visa, whatever you say). The third fraudulent payment was to the Hillary Clinton campaign for $15 which was flagged by the fraud detection. My parents' experience suggests donating to charity probably isn't as effective any more.