4 ms·

I'm really surprised this hasn't happened sooner. Parking along the seawall in galveston used to be free. Now you pay with a smart meter. I saw it coming a mile

I'm really surprised this hasn't happened sooner. Parking along the seawall in galveston used to be free. Now you pay with a smart meter. I saw it coming a mile away because all the smart meters had QR codes to download the app. Only takes a smart person to build a web app that looks similar, with a paypal link, ask what meter you're at, send an email that you're good for X minutes, etc.

cortesoft 5y ago
> with a paypal link Getting the money would be hard, and you would be easy to track. They would probably be better off just collecting the credit card info and selling it.
- post_break 5y ago
  Someone found their stripe api key. All they would have to do is buy gift cards using the funds to wash it.
  - Nextgrid 5y ago
    I'd be very surprised if a Stripe API key can be used to easily extract funds. I don't think you can directly buy gift cards/vouchers, and adding a new bank account is probably possible but would require manual verification which would blow up the attempt before it succeeds.
    - post_break 5y ago
      Sorry I should have been more clear. They are using stripe to process these payments, someone found their api key and reported them as fraud just now. They were using stripe with a bank account.
- dhosek 5y ago
  If I were doing this, I would make a clone of the legitimate site, collect their info and pay for the parking on the real site, but save the credit card number for sale on the black market. I'd imagine one could find any number of sites where this could be hosted anonymously (or slip it into a hacked site's service). If you slap QR code stickers over legitimate ones it could be months before anyone noticed.
  - Nextgrid 5y ago
    It can still trivially be tracked by the card networks as people start reporting large fraudulent charges and card details aren't worth the hassle unless you're literally getting thousands of them (via PoS malware or similar automated means). The other commenters' idea of raising the price a little bit and pocketing the difference is more likely to last and net more money in the long run as less people would question and bother disputing a slight surcharge.
    - munk-a 5y ago
      I think the idea is you silently harvest the numbers for a while and build up a stockpile before cashing them in. If you wanted to flee the country before getting your payday you might be pretty safe. I endorse absolutely none of this, just to be clear.
- lordnacho 5y ago
  Send the legit information and payment through to the city via the API of the mobile app. Raise the price and keep the difference. The best scam is the one that isn't detected. There's a story about a guy who collected £3 from every visitor to the Bristol Zoo car park here in the UK. Supposedly he did it for nearly two decades. Car park was free. No idea if it's real.
  - mtmail 5y ago
    The story about the Bristol zoo is an urban legend. https://www.snopes.com/fact-check/fake-parking-attendant/ https://www.snopes.com/fact-check/fake-parking-attendant/
    - somerandomqaguy 5y ago
      How about this one then? Charging €17 for a highway sticker in the Czech Republic where by law they can only be sold for €12.2. https://www.youtube.com/watch?v=FsWcc-9KMEc https://www.youtube.com/watch?v=FsWcc-9KMEc This one's actually rather clever.
      - lordnacho 5y ago
        One that's totally out in the open is US entry visas. If you're from outside the US, you have to fill in a government form that looks pretty old school. There are "services" that look better and turn up in searches, and will simply forward your info. I ended up using one by accident and luckily they simply paid it back immediately when I emailed them, but my hunch is most people don't detect it or don't bother to try to claw back the money.
  - SturgeonsLaw 5y ago
    Even publicly traded household names do it https://www.courthousenews.com/hertz-settles-flap-over-golden-gate-bridge-fees/ https://www.courthousenews.com/hertz-settles-flap-over-golde...
- Nextgrid 5y ago
  If you have valid card info and a cardholder attempting to buy something in real-time, why not just proxy their card details and any verification (3D-Secure, etc) directly to a gift card/cryptocurrency exchange/etc? I'm sure it'll net way more than selling the card details as it effectively bypasses the 3D-Secure step which typically protects against card-not-present fraud.
allenu 5y ago
I agree. I can't believe I had never thought that a public QR code may be untrustable until now. This is going to make me a bit more paranoid now when scanning them for parking purposes.
- post_break 5y ago
  NFC is another one. Slap a metal stick over the real one and put your bad NFC on top of it.
- hotpotamus 5y ago
  Remember when we told people not to click on random links in email?
  - dvtrn 5y ago
    I remember it vividly. Because I had to tell someone not to do it this morning. And twice last week. Few times the month before that. Even configured Exchange to give people a “report suspected phishing” button in their outlook clients. They keep on clickin’. (Each time was a different person btw)
    - deltarholamda 5y ago
      According to the Codified Laws of System Administrators, you are now authorized to start lopping off fingers.
      - spockz 5y ago
        I think they will still be clicking with their noses in that case. It never ceases to amaze me how many people think. “Oh hey that interesting/cool <click>”. Or “hey how did they know I needed this?”
        kingcharles 5y ago
        Headstick is the way to go once your sysadmin has taken all your digits. Gotta click 'em all! https://www.youtube.com/watch?v=Rz2HpGC9vbw https://www.youtube.com/watch?v=Rz2HpGC9vbw
amelius 5y ago
> Only takes a smart person to build a web app that looks similar (...) Smart person? Sounds more like a person looking for trouble.
- rossdavidh 5y ago
  Smart enough to do it, dumb enough to do it also. It's more common than it seems like it ought to be.
  - bellyfullofbac 5y ago
    Of course there's the "follow the money" issue, I wonder if it's doable using a payment provider in a dubious country, or if Visa/Mastercard would just chargeback, leaving the payment provider to be mad at you (but hopefully they did poor KYC so they'd have no power to send their henchmen to you). Maybe the fake app can say "Now you need to go to walmart.com to buy a gift card and enter that gift card code's to pay for parking", but that would filter out a lot of people who was looking for convenience in the first place. If I were consulting for this criminal, I'd say "You need to get to their greed by offering them a big prize, e.g. 1 year free parking in $CITY...".
    - Nextgrid 5y ago
      The truth is that even though it's technically possible to follow the money and all the paper trail is there, in some countries law enforcement doesn't seem to be bothered to investigate things at all (even when reported by a bank for fraud/money laundering suspicions) from my experience. These scammers are either smart and done everything anonymously, or too stupid to understand how this can all be tracked, but unfortunately this stupidity does often end up paying off.
      - amelius 5y ago
        It might also be indirect: dumb criminal pays smart hacker to build website, in cash.
weej 5y ago
>> saw it coming a mile away You're telling me. (not so humble brag) I developed a software solution and 3 patents granted over 10 years ago to stop these kind of shenanigans. Ahead of our time. *Unfortunately, matrix barcodes may sometimes reference malicious websites, which may be used to steal confidential information (e.g., user credentials or credit card numbers) as part of a phishing attack or exploit vulnerabilities in mobile web browser software that may allow malware to be downloaded to a user's mobile computing device. Furthermore, some legitimate Internet resources (through the use of spam, comment posts, etc.) may be used to redirect users to malicious websites. Accordingly, the instant disclosure identifies a need for systems and methods for providing security information about quick response codes.* https://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch-bool.html&r=9&f=G&l=50&co1=AND&d=PTXT&s1=%22Barker,+Clifton%22&OS=%22Barker,+Clifton%22&RS=%22Barker,+Clifton%22 https://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=...

cortesoft 5y ago

> with a paypal link Getting the money would be hard, and you would be easy to track. They would probably be better off just collecting the credit card info and selling it.

post_break 5y ago
Someone found their stripe api key. All they would have to do is buy gift cards using the funds to wash it.
- Nextgrid 5y ago
  I'd be very surprised if a Stripe API key can be used to easily extract funds. I don't think you can directly buy gift cards/vouchers, and adding a new bank account is probably possible but would require manual verification which would blow up the attempt before it succeeds.
  - post_break 5y ago
    Sorry I should have been more clear. They are using stripe to process these payments, someone found their api key and reported them as fraud just now. They were using stripe with a bank account.
dhosek 5y ago
If I were doing this, I would make a clone of the legitimate site, collect their info and pay for the parking on the real site, but save the credit card number for sale on the black market. I'd imagine one could find any number of sites where this could be hosted anonymously (or slip it into a hacked site's service). If you slap QR code stickers over legitimate ones it could be months before anyone noticed.
- Nextgrid 5y ago
  It can still trivially be tracked by the card networks as people start reporting large fraudulent charges and card details aren't worth the hassle unless you're literally getting thousands of them (via PoS malware or similar automated means). The other commenters' idea of raising the price a little bit and pocketing the difference is more likely to last and net more money in the long run as less people would question and bother disputing a slight surcharge.
  - munk-a 5y ago
    I think the idea is you silently harvest the numbers for a while and build up a stockpile before cashing them in. If you wanted to flee the country before getting your payday you might be pretty safe. I endorse absolutely none of this, just to be clear.
lordnacho 5y ago
Send the legit information and payment through to the city via the API of the mobile app. Raise the price and keep the difference. The best scam is the one that isn't detected. There's a story about a guy who collected £3 from every visitor to the Bristol Zoo car park here in the UK. Supposedly he did it for nearly two decades. Car park was free. No idea if it's real.
- mtmail 5y ago
  The story about the Bristol zoo is an urban legend. https://www.snopes.com/fact-check/fake-parking-attendant/ https://www.snopes.com/fact-check/fake-parking-attendant/
  - somerandomqaguy 5y ago
    How about this one then? Charging €17 for a highway sticker in the Czech Republic where by law they can only be sold for €12.2. https://www.youtube.com/watch?v=FsWcc-9KMEc https://www.youtube.com/watch?v=FsWcc-9KMEc This one's actually rather clever.
    - lordnacho 5y ago
      One that's totally out in the open is US entry visas. If you're from outside the US, you have to fill in a government form that looks pretty old school. There are "services" that look better and turn up in searches, and will simply forward your info. I ended up using one by accident and luckily they simply paid it back immediately when I emailed them, but my hunch is most people don't detect it or don't bother to try to claw back the money.
- SturgeonsLaw 5y ago
  Even publicly traded household names do it https://www.courthousenews.com/hertz-settles-flap-over-golden-gate-bridge-fees/ https://www.courthousenews.com/hertz-settles-flap-over-golde...
Nextgrid 5y ago
If you have valid card info and a cardholder attempting to buy something in real-time, why not just proxy their card details and any verification (3D-Secure, etc) directly to a gift card/cryptocurrency exchange/etc? I'm sure it'll net way more than selling the card details as it effectively bypasses the 3D-Secure step which typically protects against card-not-present fraud.

allenu 5y ago

I agree. I can't believe I had never thought that a public QR code may be untrustable until now. This is going to make me a bit more paranoid now when scanning them for parking purposes.

post_break 5y ago
NFC is another one. Slap a metal stick over the real one and put your bad NFC on top of it.
hotpotamus 5y ago
Remember when we told people not to click on random links in email?
- dvtrn 5y ago
  I remember it vividly. Because I had to tell someone not to do it this morning. And twice last week. Few times the month before that. Even configured Exchange to give people a “report suspected phishing” button in their outlook clients. They keep on clickin’. (Each time was a different person btw)
  - deltarholamda 5y ago
    According to the Codified Laws of System Administrators, you are now authorized to start lopping off fingers.
    - spockz 5y ago
      I think they will still be clicking with their noses in that case. It never ceases to amaze me how many people think. “Oh hey that interesting/cool <click>”. Or “hey how did they know I needed this?”
      - kingcharles 5y ago
        Headstick is the way to go once your sysadmin has taken all your digits. Gotta click 'em all! https://www.youtube.com/watch?v=Rz2HpGC9vbw https://www.youtube.com/watch?v=Rz2HpGC9vbw

amelius 5y ago

> Only takes a smart person to build a web app that looks similar (...) Smart person? Sounds more like a person looking for trouble.

rossdavidh 5y ago
Smart enough to do it, dumb enough to do it also. It's more common than it seems like it ought to be.
- bellyfullofbac 5y ago
  Of course there's the "follow the money" issue, I wonder if it's doable using a payment provider in a dubious country, or if Visa/Mastercard would just chargeback, leaving the payment provider to be mad at you (but hopefully they did poor KYC so they'd have no power to send their henchmen to you). Maybe the fake app can say "Now you need to go to walmart.com to buy a gift card and enter that gift card code's to pay for parking", but that would filter out a lot of people who was looking for convenience in the first place. If I were consulting for this criminal, I'd say "You need to get to their greed by offering them a big prize, e.g. 1 year free parking in $CITY...".
  - Nextgrid 5y ago
    The truth is that even though it's technically possible to follow the money and all the paper trail is there, in some countries law enforcement doesn't seem to be bothered to investigate things at all (even when reported by a bank for fraud/money laundering suspicions) from my experience. These scammers are either smart and done everything anonymously, or too stupid to understand how this can all be tracked, but unfortunately this stupidity does often end up paying off.
    - amelius 5y ago
      It might also be indirect: dumb criminal pays smart hacker to build website, in cash.

weej 5y ago

>> saw it coming a mile away You're telling me. (not so humble brag) I developed a software solution and 3 patents granted over 10 years ago to stop these kind of shenanigans. Ahead of our time. *Unfortunately, matrix barcodes may sometimes reference malicious websites, which may be used to steal confidential information (e.g., user credentials or credit card numbers) as part of a phishing attack or exploit vulnerabilities in mobile web browser software that may allow malware to be downloaded to a user's mobile computing device. Furthermore, some legitimate Internet resources (through the use of spam, comment posts, etc.) may be used to redirect users to malicious websites. Accordingly, the instant disclosure identifies a need for systems and methods for providing security information about quick response codes.* https://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch-bool.html&r=9&f=G&l=50&co1=AND&d=PTXT&s1=%22Barker,+Clifton%22&OS=%22Barker,+Clifton%22&RS=%22Barker,+Clifton%22 https://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=...