4 ms·

It would be interesting to know how well X detects signups with stolen credit cards. If scammers have millions of credit cards from data dumps and make a $8 cha

It would be interesting to know how well X detects signups with stolen credit cards. If scammers have millions of credit cards from data dumps and make a $8 charge on X, what portion of the victims would even notice? Even if X receives a fraud report and acts decisively to shut down the offending account, it might just be an inconvenience to scammers who have signed up for many more. At scale, fraudsters could be moving a substantial amount of stolen money into X membership fees.

derefr 3y ago
You don’t need literal stolen credit cards to dodge CCN bans any more. There are so many services today that allow you — without KYC! — to create an online wallet that is assigned a real CCN, and which also don’t present as a “gift card” on systems like Stripe. You just steal or scam people out of liquid assets of any kind (e.g. crypto), and you can then turn those into as many virtual credit cards as you want — all under different names, with different addresses, etc. Many of these services also allow spending limits to be set on these cards on a per-card basis — which in practice allows the defrauding of any postpaid service, by limiting each card to spend just enough for the initial card verification, and then denying the actual postpaid charges when they come. (Then you close the acct, and open a new one with a new name + card.) To combat this, we’ve resorted to using grey-market(!) “BIN lists” to determine what CCN prefixes (BINs) are used by the banks backing these non-KYCed online wallets, and just blacklisting all of them. Somehow, I doubt bigcorps are doing the same.
- refulgentis 3y ago
  Man this is gold. Thanks for sharing. Would be curious for any naming you can do re: where to look for said BIN lists, as well as, a company or two that does this CCN thing.

4 ms·

It would be interesting to know how well X detects signups with stolen credit cards. If scammers have millions of credit cards from data dumps and make a $8 cha

by fshbbdssbbgdd 3y ago

derefr 3y ago
You don’t need literal stolen credit cards to dodge CCN bans any more. There are so many services today that allow you — without KYC! — to create an online wallet that is assigned a real CCN, and which also don’t present as a “gift card” on systems like Stripe. You just steal or scam people out of liquid assets of any kind (e.g. crypto), and you can then turn those into as many virtual credit cards as you want — all under different names, with different addresses, etc. Many of these services also allow spending limits to be set on these cards on a per-card basis — which in practice allows the defrauding of any postpaid service, by limiting each card to spend just enough for the initial card verification, and then denying the actual postpaid charges when they come. (Then you close the acct, and open a new one with a new name + card.) To combat this, we’ve resorted to using grey-market(!) “BIN lists” to determine what CCN prefixes (BINs) are used by the banks backing these non-KYCed online wallets, and just blacklisting all of them. Somehow, I doubt bigcorps are doing the same.
- refulgentis 3y ago
  Man this is gold. Thanks for sharing. Would be curious for any naming you can do re: where to look for said BIN lists, as well as, a company or two that does this CCN thing.