4 ms·

Every time this comes up, people claim that this lack of security doesn't matter because it's easy to reverse these payments. But if that's true, then why is th

by mcv 3y ago

Every time this comes up, people claim that this lack of security doesn't matter because it's easy to reverse these payments. But if that's true, then why is the woman so upset and why is Barker handled so aggressively? It should be easy to revert both payments.

rootusrootus 3y ago
This case is probably not a great example to use, because the woman's card wasn't stolen. Her account at Walmart was hacked, and the purchase was made there with the shipment sent to a different address.
- mcv 3y ago
  Why would that not make it a good example? It's still a case of fraud, enabled by the lack of security on credit card payments. The payment hadn't been authorised by the woman.
- JaggedJax 3y ago
  This looks like an easy thing for Walmart to prevent if they bothered. On Amazon if you add a new shipping address, you can't ship to it until you re-verify your credit card CVV. With just that simple check this attack would be blocked (unless they steal the entire CC info of course).
  - deleted 3y ago
    [deleted]
everybodyknows 3y ago
That's a question for Amazon, which makes the whole thing possible by: 1. Lulling naive or hurried customers who like to think they're buying "from Amazon" into buying from fraudsters, and 2. Paying the fraudsters so quickly that the seller's account is closed before action is taken the fraud, and 3. Vetting sellers so promiscuously that the individual fraudster's cycle can continue. In this light, Krebs diagram is deficient, because it omits Amazon from the loop. It's not "triangulation", the more accurate word would be quadrilateralization -- but spell-check says that's not a word.
zerbinxx 3y ago
The woman was presumably upset because she thought she was scammed and had caught the scammer red-handed, and probably didn’t fully understand how credit disputes happen, or had some extenuating circumstances (poor credit, no credit) that she was actively trying to fix by having a CC only to get defrauded (although I don’t think credit fixes actually affect your credit score). It’s safe to assume the average person doesn’t really understand credit.

by mcv 3y ago

rootusrootus 3y ago

This case is probably not a great example to use, because the woman's card wasn't stolen. Her account at Walmart was hacked, and the purchase was made there with the shipment sent to a different address.

mcv 3y ago
Why would that not make it a good example? It's still a case of fraud, enabled by the lack of security on credit card payments. The payment hadn't been authorised by the woman.
JaggedJax 3y ago
This looks like an easy thing for Walmart to prevent if they bothered. On Amazon if you add a new shipping address, you can't ship to it until you re-verify your credit card CVV. With just that simple check this attack would be blocked (unless they steal the entire CC info of course).
- deleted 3y ago
  [deleted]

everybodyknows 3y ago

That's a question for Amazon, which makes the whole thing possible by: 1. Lulling naive or hurried customers who like to think they're buying "from Amazon" into buying from fraudsters, and 2. Paying the fraudsters so quickly that the seller's account is closed before action is taken the fraud, and 3. Vetting sellers so promiscuously that the individual fraudster's cycle can continue. In this light, Krebs diagram is deficient, because it omits Amazon from the loop. It's not "triangulation", the more accurate word would be quadrilateralization -- but spell-check says that's not a word.

zerbinxx 3y ago

The woman was presumably upset because she thought she was scammed and had caught the scammer red-handed, and probably didn’t fully understand how credit disputes happen, or had some extenuating circumstances (poor credit, no credit) that she was actively trying to fix by having a CC only to get defrauded (although I don’t think credit fixes actually affect your credit score). It’s safe to assume the average person doesn’t really understand credit.