4 ms·

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security code

by 13of40 3y ago

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand. If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you only had to try about 24 or 36 cards with one month/year.

8n4vidtmkvmk 3y ago
I think visa or MasterCard would catch on in that situation too, no? There's only a few processors, they should notice the pattern.
- spunker540 3y ago
  They process so many transactions per second. It doesn’t seem too hard to try wrong ccv at a pace slow enough to avoid detection.
  - chefandy 3y ago
    I would need to hear that from someone who actually works in a CC company fraud department because I don't think it's that straightforward. I've had MC transactions declined on a card I use for everyday purchases at two stores in my neighborhood. I don't think reasoning about their transaction monitoring like someone might monitor network traffic is a good analog-- they're specifically looking for patterns in small-scale, localized events without many data points. They don't have to connect the events to stymie the fraudster's efforts.
skibbityboop 3y ago
> If you have a whole database of them, the trick is to try one code with a thousand cards That still sounds like a crapshoot... Of those 1,000 cards, there might be 14 that have 982 as CSV, 9 that have 307, and none with 118. In other words, there's no guarantee whatsoever that any given CSV will be used in a batch of 1,000 or even 10,000 cards.
- jjav 3y ago
  Of course there is no guarantee, but statistically if you have 1/1000 probability of success and you try a 1000 times, that's not bad.
chefandy 3y ago
Their fraud detection algorithms are specifically looking for small, localized, per-transaction events with few data points as well as overall patterns-- I doubt it would be that straightforward. It might not mean you'd be targeted, but on a per-transaction basis, I there's a good chance you'd get blocked for any individual attempt even if you got a match.

by 13of40 3y ago

8n4vidtmkvmk 3y ago

I think visa or MasterCard would catch on in that situation too, no? There's only a few processors, they should notice the pattern.

spunker540 3y ago
They process so many transactions per second. It doesn’t seem too hard to try wrong ccv at a pace slow enough to avoid detection.
- chefandy 3y ago
  I would need to hear that from someone who actually works in a CC company fraud department because I don't think it's that straightforward. I've had MC transactions declined on a card I use for everyday purchases at two stores in my neighborhood. I don't think reasoning about their transaction monitoring like someone might monitor network traffic is a good analog-- they're specifically looking for patterns in small-scale, localized events without many data points. They don't have to connect the events to stymie the fraudster's efforts.

skibbityboop 3y ago

> If you have a whole database of them, the trick is to try one code with a thousand cards That still sounds like a crapshoot... Of those 1,000 cards, there might be 14 that have 982 as CSV, 9 that have 307, and none with 118. In other words, there's no guarantee whatsoever that any given CSV will be used in a batch of 1,000 or even 10,000 cards.

jjav 3y ago
Of course there is no guarantee, but statistically if you have 1/1000 probability of success and you try a 1000 times, that's not bad.

chefandy 3y ago

Their fraud detection algorithms are specifically looking for small, localized, per-transaction events with few data points as well as overall patterns-- I doubt it would be that straightforward. It might not mean you'd be targeted, but on a per-transaction basis, I there's a good chance you'd get blocked for any individual attempt even if you got a match.