6 ms·
This isn't money laundering (from your initial github ticket its obvious that is what you were looking for, so thats what you found). Before selling stolen cre
by dsl 14y ago
This isn't money laundering (from your initial github ticket its obvious that is what you were looking for, so thats what you found).
Before selling stolen credit cards, bad guys have to verify them. This is often done with small (<$10) donations to charities or small purchases of intangible goods that are considered low risk merchants.
With Gittip they found a way to get the low dollar amounts to come back to them, but since this wasn't really the goal to start with, you'll likely see donations to random leaderboard members that are unaffiliated with the fraud itself in the future.
- jusben1369 14y agoAgreed. When I read this it looks like a verification process for a batch of stolen credit cards to see which are still valid and which aren't. Note that the "successful" transactions may very well be charged back to you at $15 each or more so you want to refund any suspicious payments quickly to avoid going into the negative.
- dangrossman 14y agoYou basically have to catch it before the charge is even settled; either within the same business day before your settlement cutoff, or by authorizing without capturing for a day or two so you have time to review. Once the charge is settled, a refund almost never stops someone from charging back the payment -- for whatever reason, when a card is reported stolen, people and banks simply charge back everything unauthorized even if a quick review of the account would show some of the payments were already refunded. You can dispute these chargebacks by providing proof of the previous refund, but you're still out the chargeback fees, and these chargebacks still count against your account -- so they can end up getting you terminated if your CB rate is pushed too high.
- whit537 14y agoThanks, good info. My plan at this point is to whitelist accounts, because I want to try to keep from charging suspicious accounts in the first place.
- robryan 14y agoWe get these, have seen a case where we refunded but apparently they were going after the currency conversion amount with the chargeback. Do some providers offer longer settlements? Feels like we only get a few hours a lot of the time to void a transaction.
- dangrossman 14y agoYou have 1-3 days to capture an amount you previously authorized. You only have so little time because you're authorizing and capturing at the same time. If you need more time to review, decouple them. Some payment gateways also let you decide the settlement cutoff time, so you can set it after business hours.
- whit537 14y agoInformative, thank you both. On this ticket we discussed why Gittip isn't the best system for extracting value from a card: https://github.com/whit537/www.gittip.com/issues/329 https://github.com/whit537/www.gittip.com/issues/329 The desire to verify stolen cards with the added benefit of recovering that waste seems to explain the motive for using Gittip.
- whit537 14y agoI read up on money laundering, and changed the blog post to talk about "stolen money" instead. Thanks.
- 001sky 14y ago-- Perhaps best to make a conforming edit to the HN title
- whit537 14y ago@heathanderson?
- rm999 14y agoIt's not even about stealing money per se, it's a step in the process of credit card theft. Fraudsters often do the same thing on Amazon and iTunes - they'll make 1 dollar purchases that allow them to 'verify' the cards. In these cases the 1 dollar purchases aren't for any direct material gain.
- whit537 14y agoSure. And yet from Gittip's POV as well as that of the original victim, it's still stolen money, on Gittip. No?
- rm999 14y agoSort of. Theft isn't the primary motive, so I think it's inaccurate. A lot of what the fraudsters are (or will be) doing is transferring money from victims to innocent people. The real-life analogy I would use is going to a store and putting something in someone's bag without them noticing to test the store's security. That is arguably not theft, even though it's illegal. I'd say the proper term is fraud. But I don't really like semantic arguments, so I'd say it's not a huge deal either way :) edit: I should add, the reason I don't think it's stealing is because the money often gets returned; the illicit transfers can be reversed. When the real stealing will be going on the fraudsters will be taking lots of money and running. edit2: I feel bad for even objecting, it's really not a big deal. 'Stealing money' is close enough to what's going on.
- zalew 14y ago> Before selling stolen credit cards, bad guys have to verify them. This is often done with small (<$10) donations to charities or small purchases of intangible goods that are considered low risk merchants. They also verified them on SoundCloud without any purchase. Don't know if it's still possible.
- pudquick 14y agoDid you mean verify that an account is associated with the credit card? Or just verify that the credit card number is potentially a legitimate one? Because if it's the latter, that's just the Luhn algorithm (http://en.wikipedia.org/wiki/Luhn_algorithm http://en.wikipedia.org/wiki/Luhn_algorithm) and no transactions are required to perform the verification. If it's the former, until you make a transaction there's no way to verify in advance whether or not a card has a still valid account attached to the backside of it. I know you're saying "without any purchase", but maybe it was just for a vanishingly small amount.
- duskwuff 14y ago> If it's the former, until you make a transaction there's no way to verify in advance whether or not a card has a still valid account attached to the backside of it. It's possible, with most credit card processors, to perform a $0 authorization to confirm that a credit card number is linked to an active account. It doesn't guarantee that any charges against the card will go through -- the card may be at its limit, for instance -- but it will correctly reject numbers that are structurally valid (e.g, pass Luhn) but which don't correspond to any account.
- zalew 14y agoit's just that they offer a free trial without charging any 0.01, if it passes they cancel the account and the owner never knows the card was tried out. this method can work on any 'free trial cc required' as long as it doesn't charge any test ammount.
- exratione 14y agoThis is exactly correct. I've supported a number of different online credit card donation forms for various charitable and other causes, and you see this behavior of card testing whenever you set the minimum allowed donation too low, and adopt too few of the necessary precautions. I wrote a post on the approach to raising the bar I took - it really doesn't require much to get the credit card testers to go away, and if you don't get rid of them rapidly, you'll be dealing with chargebacks from here until eternity: http://www.exratione.com/2010/10/three-necessary-defenses-for-open-credit-card-submission-forms/ http://www.exratione.com/2010/10/three-necessary-defenses-fo...
- whit537 14y agoThank you, good info. For privacy reasons, we've been hoping to not track IP addresses: https://github.com/whit537/www.gittip.com/issues/345 https://github.com/whit537/www.gittip.com/issues/345 Even then, I'm not sure I would trust this approach. I feel much more comfortable white-listing accounts, and for the time being that's not too onerous.
- rmc 14y agoFor privacy reasons, we've been hoping to not track IP addresses You could hash the IP address, with some suitable salt. Then compare against that. The purpose of storing IP addresses isn't to find out "the IP address of the user submitting the form", but instead to answer "How many other credit card numbers have come from this address?", something that can be done with sha512("salt_mc_salty_$IP")