3 ms·
> [...] found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost o
by isoprophlex 4y ago
> [...] found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen.
> This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number.
Criminally hilarious.
- amluto 4y ago> Criminally hilarious. ISTM it’s only criminally hilarious if you catch Amex doing something fraudulent or illegal themselves. But it sure would be entertaining to have a big civil lawsuit on the basis of incompetent security practices.
- Scoundreller 4y agoI suspect this has already been exploited in South America with at least one North American banks' Amex cards. Can't get into too much detail, but the pieces fit.
- atyppo 4y agoThey wouldn’t have fixed this since 2015? Seems highly dubious to me.
- iancarroll 4y agoAmex is already legally responsible for fraudulent charges on your card, so if they want to make the numbers predictable, why not?
- jjeaff 4y agoActually, the merchants are fully responsible for fraudulent charges. So Amex has little incentive to be secure.
- iancarroll 4y agoIt’s not really that simple, and it’s likely that these attacks would fail CVV/3DS/etc, so it’d be hard for a reasonable merchant to be tricked regardless.
- tyingq 4y ago"I also determined that the CSC (essentially behaves like a CID or CVV2 on the magstripe) for a lost or stolen card continues to work for a newer, predicted card. An attacker would be able to use a stolen card's CSC with the predicted card number and expiration to make actual purchases." Also...ask any merchant if they've ever NOT been left holding the bag for a fraudulent purchase. The only time that happened for me was when I could prove it was fraud by the actual cardholder, and even then, the banks would often deny the counterclaim anyway.
- jeffbee 4y agoI don't see how this is specific to AMEX. When my USAA Visa got cancelled because of yet another merchant system leak, they sent me another card that was just sequential with the cancelled one up to the 15th digit (the 16th is a check digit).