4 ms·

> with a paypal link Getting the money would be hard, and you would be easy to track. They would probably be better off just collecting the credit card info a

> with a paypal link Getting the money would be hard, and you would be easy to track. They would probably be better off just collecting the credit card info and selling it.

post_break 5y ago
Someone found their stripe api key. All they would have to do is buy gift cards using the funds to wash it.
- Nextgrid 5y ago
  I'd be very surprised if a Stripe API key can be used to easily extract funds. I don't think you can directly buy gift cards/vouchers, and adding a new bank account is probably possible but would require manual verification which would blow up the attempt before it succeeds.
  - post_break 5y ago
    Sorry I should have been more clear. They are using stripe to process these payments, someone found their api key and reported them as fraud just now. They were using stripe with a bank account.
dhosek 5y ago
If I were doing this, I would make a clone of the legitimate site, collect their info and pay for the parking on the real site, but save the credit card number for sale on the black market. I'd imagine one could find any number of sites where this could be hosted anonymously (or slip it into a hacked site's service). If you slap QR code stickers over legitimate ones it could be months before anyone noticed.
- Nextgrid 5y ago
  It can still trivially be tracked by the card networks as people start reporting large fraudulent charges and card details aren't worth the hassle unless you're literally getting thousands of them (via PoS malware or similar automated means). The other commenters' idea of raising the price a little bit and pocketing the difference is more likely to last and net more money in the long run as less people would question and bother disputing a slight surcharge.
  - munk-a 5y ago
    I think the idea is you silently harvest the numbers for a while and build up a stockpile before cashing them in. If you wanted to flee the country before getting your payday you might be pretty safe. I endorse absolutely none of this, just to be clear.
lordnacho 5y ago
Send the legit information and payment through to the city via the API of the mobile app. Raise the price and keep the difference. The best scam is the one that isn't detected. There's a story about a guy who collected £3 from every visitor to the Bristol Zoo car park here in the UK. Supposedly he did it for nearly two decades. Car park was free. No idea if it's real.
- mtmail 5y ago
  The story about the Bristol zoo is an urban legend. https://www.snopes.com/fact-check/fake-parking-attendant/ https://www.snopes.com/fact-check/fake-parking-attendant/
  - somerandomqaguy 5y ago
    How about this one then? Charging €17 for a highway sticker in the Czech Republic where by law they can only be sold for €12.2. https://www.youtube.com/watch?v=FsWcc-9KMEc https://www.youtube.com/watch?v=FsWcc-9KMEc This one's actually rather clever.
    - lordnacho 5y ago
      One that's totally out in the open is US entry visas. If you're from outside the US, you have to fill in a government form that looks pretty old school. There are "services" that look better and turn up in searches, and will simply forward your info. I ended up using one by accident and luckily they simply paid it back immediately when I emailed them, but my hunch is most people don't detect it or don't bother to try to claw back the money.
- SturgeonsLaw 5y ago
  Even publicly traded household names do it https://www.courthousenews.com/hertz-settles-flap-over-golden-gate-bridge-fees/ https://www.courthousenews.com/hertz-settles-flap-over-golde...
Nextgrid 5y ago
If you have valid card info and a cardholder attempting to buy something in real-time, why not just proxy their card details and any verification (3D-Secure, etc) directly to a gift card/cryptocurrency exchange/etc? I'm sure it'll net way more than selling the card details as it effectively bypasses the 3D-Secure step which typically protects against card-not-present fraud.

> with a paypal link Getting the money would be hard, and you would be easy to track. They would probably be better off just collecting the credit card info and selling it.

post_break 5y ago

Someone found their stripe api key. All they would have to do is buy gift cards using the funds to wash it.

Nextgrid 5y ago
I'd be very surprised if a Stripe API key can be used to easily extract funds. I don't think you can directly buy gift cards/vouchers, and adding a new bank account is probably possible but would require manual verification which would blow up the attempt before it succeeds.
- post_break 5y ago
  Sorry I should have been more clear. They are using stripe to process these payments, someone found their api key and reported them as fraud just now. They were using stripe with a bank account.

dhosek 5y ago

If I were doing this, I would make a clone of the legitimate site, collect their info and pay for the parking on the real site, but save the credit card number for sale on the black market. I'd imagine one could find any number of sites where this could be hosted anonymously (or slip it into a hacked site's service). If you slap QR code stickers over legitimate ones it could be months before anyone noticed.

Nextgrid 5y ago
It can still trivially be tracked by the card networks as people start reporting large fraudulent charges and card details aren't worth the hassle unless you're literally getting thousands of them (via PoS malware or similar automated means). The other commenters' idea of raising the price a little bit and pocketing the difference is more likely to last and net more money in the long run as less people would question and bother disputing a slight surcharge.
- munk-a 5y ago
  I think the idea is you silently harvest the numbers for a while and build up a stockpile before cashing them in. If you wanted to flee the country before getting your payday you might be pretty safe. I endorse absolutely none of this, just to be clear.

lordnacho 5y ago

Send the legit information and payment through to the city via the API of the mobile app. Raise the price and keep the difference. The best scam is the one that isn't detected. There's a story about a guy who collected £3 from every visitor to the Bristol Zoo car park here in the UK. Supposedly he did it for nearly two decades. Car park was free. No idea if it's real.

mtmail 5y ago
The story about the Bristol zoo is an urban legend. https://www.snopes.com/fact-check/fake-parking-attendant/ https://www.snopes.com/fact-check/fake-parking-attendant/
- somerandomqaguy 5y ago
  How about this one then? Charging €17 for a highway sticker in the Czech Republic where by law they can only be sold for €12.2. https://www.youtube.com/watch?v=FsWcc-9KMEc https://www.youtube.com/watch?v=FsWcc-9KMEc This one's actually rather clever.
  - lordnacho 5y ago
    One that's totally out in the open is US entry visas. If you're from outside the US, you have to fill in a government form that looks pretty old school. There are "services" that look better and turn up in searches, and will simply forward your info. I ended up using one by accident and luckily they simply paid it back immediately when I emailed them, but my hunch is most people don't detect it or don't bother to try to claw back the money.
SturgeonsLaw 5y ago
Even publicly traded household names do it https://www.courthousenews.com/hertz-settles-flap-over-golden-gate-bridge-fees/ https://www.courthousenews.com/hertz-settles-flap-over-golde...

Nextgrid 5y ago

If you have valid card info and a cardholder attempting to buy something in real-time, why not just proxy their card details and any verification (3D-Secure, etc) directly to a gift card/cryptocurrency exchange/etc? I'm sure it'll net way more than selling the card details as it effectively bypasses the 3D-Secure step which typically protects against card-not-present fraud.