5 ms·

I was in line and made a short conversation (short so as to not hold up the line) with the cashier at Target. The elderly lady behind me was pretty worried abou

I was in line and made a short conversation (short so as to not hold up the line) with the cashier at Target. The elderly lady behind me was pretty worried about the credit card theft, and the cashier knew about it too. It's cool at least that news about this stuff is reaching more people. In my opinion just get a new card, don't wait for suspicious activity. Check it to see if it was already used. Also given that the 3 letter pins weren't from the back are not included I'm not sure if it's going to be very easy to make use of this card data. Having said, still get a new card if you used it at Target recently.

bri3d 13y ago
The magnetic track data was compromised, which means once the data trickles back through the black market crooks can write the cards back out and use them as card-present. Definitely harder than sitting around ordering things online, but there's no reason to need the CSC to use the data they stole.
liuhenry 13y ago
By 3 letter pin, do you mean the CVC code? Many merchants require the CVC code to protect themselves against fraud/chargebacks and because they can get lower processing fees, but strictly speaking, it's not necessary to make a transaction (IIRC, the only thing you need is the card number and expiration date). Notably, Amazon does this for their 1-click checkout. Saving CVC codes is against PCI compliance, so in order to provide that low-friction experience, they simply post the saved card information without it.
- larrys 13y ago
  "the only thing you need is the card number and expiration date" If the dollar amount charged is low enough you don't even need the expiration date. You just use the current month. We've frequently have to charge expired customer credit cards (expired by years in many cases) and as long as the dollar amount is low enough (off the top +- $40 [1]) and the card number hasn't been changed the charge will go through. Very convenient instead of having to contact the customer to get a new credit card expiration date. Also helps because that way you don't give the customer a chance to rethink what they are paying for and whether they need it or not. [1] May be higher but I'm not certain if it's $60 or $100 so I will go with an amount that I know works.
  - miahi 13y ago
    I saw that on Google Play, I did not update the CC when it expired but I was able to buy apps.
  - jusben1369 13y ago
    Who are you using as a payment processor? Are you sure they're not running the Account updater service against your card on files and automatically updating expired ones for you?
    - larrys 13y ago
      I'm sure. And it's paypal. No cards are on file. These are literally credit cards that are stored in file folders (quite an air gap, huh?) and they are typed in MANUALLY in the paypal interface. Nothing is stored with the processor for repeat transactions. This has been going on since the mid 90's and while using other processors as well as even (in another business) at a credit card processing machine where the cards were keyed into that. CVV is not relevant either.
      - jusben1369 13y ago
        Got it. Thanks for the clarification.

bri3d 13y ago

The magnetic track data was compromised, which means once the data trickles back through the black market crooks can write the cards back out and use them as card-present. Definitely harder than sitting around ordering things online, but there's no reason to need the CSC to use the data they stole.

liuhenry 13y ago

By 3 letter pin, do you mean the CVC code? Many merchants require the CVC code to protect themselves against fraud/chargebacks and because they can get lower processing fees, but strictly speaking, it's not necessary to make a transaction (IIRC, the only thing you need is the card number and expiration date). Notably, Amazon does this for their 1-click checkout. Saving CVC codes is against PCI compliance, so in order to provide that low-friction experience, they simply post the saved card information without it.

larrys 13y ago
"the only thing you need is the card number and expiration date" If the dollar amount charged is low enough you don't even need the expiration date. You just use the current month. We've frequently have to charge expired customer credit cards (expired by years in many cases) and as long as the dollar amount is low enough (off the top +- $40 [1]) and the card number hasn't been changed the charge will go through. Very convenient instead of having to contact the customer to get a new credit card expiration date. Also helps because that way you don't give the customer a chance to rethink what they are paying for and whether they need it or not. [1] May be higher but I'm not certain if it's $60 or $100 so I will go with an amount that I know works.
- miahi 13y ago
  I saw that on Google Play, I did not update the CC when it expired but I was able to buy apps.
- jusben1369 13y ago
  Who are you using as a payment processor? Are you sure they're not running the Account updater service against your card on files and automatically updating expired ones for you?
  - larrys 13y ago
    I'm sure. And it's paypal. No cards are on file. These are literally credit cards that are stored in file folders (quite an air gap, huh?) and they are typed in MANUALLY in the paypal interface. Nothing is stored with the processor for repeat transactions. This has been going on since the mid 90's and while using other processors as well as even (in another business) at a credit card processing machine where the cards were keyed into that. CVV is not relevant either.
    - jusben1369 13y ago
      Got it. Thanks for the clarification.