Hacker News Reader

Comment by rcthompson | Hacker News Reader

Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen".

Or maybe I'm just way too optimistic about how this all works.

View on HN

They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.

Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100 4-digit numbers is (9,900/10,000)^100 = 0.366 = 36.6%. That's substantial!

Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.

Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.

..to the point that the expected value should converge to the same amount, right?

The expected value of both strategies is to have 1 success, but they have different variance. The first strategy has variance of 0.99, and the second strategy has variance 0. The chance of n out of 100 hits with the first strategy is: binomial(100,n) x 0.01^n x 0.99^(100-n)

edit: asterisks as multiplication signs => italics

Right, but variance doesn't matter if you just repeat the scam tomorrow.

But that means you have pretty low conversion rate. You have 1000 numbers of stolen cards, and you only going to get 10 of them? It reduces profitability substantially. And even 100 attempts is enough to mark card as stolen if bank is watching it.

They don't need to steal a card at all to do this. They're just guessing random numbers — everything after the issuer/cardtype numbers (first 5 or 6). So there's nothing to convert, and they only try a particular card number a few times.

Sadly, the banks don't do much about it, because for US card-not-present transactions...they have no risk. Any fraud is paid for by the merchant seller.

It's too bad, because if there was an anti-fraud system that had access to ALL transactions + ALL data, it would obviously work better than any other solution.

I'm sure the IRS and a number of other groups would love access to this data.

For the most part, the data is already centralized. It just isn't used for anti fraud measures that would help online merchants.

The cc companies and banks do leverage aggregated data when they are the ones that hold the bag....like card present transactions.

Yep, it would cost them to implement and maintain, and they have no financial incentive to do so. It's not like they have a brand to ruin either; everyone already hates them, but Visa and MasterCard run the US market (and much of the global market), so they can do whatever they want to consumers without fear of backlash / loss of business.

> Any fraud is paid for by the merchant seller.

Not if the transaction uses 3D secure.

In the US, if you accept only 3D secure, you would go out of business. If made optional, it is a tiny percentage of sales.

That was one of the points in the article. Since the merchant implements the limit and not the bank itself, you work across N merchants and you get plenty of attempts.

And if the merchant is trying to be "consumer friendly" and accepts a relatively high number of failures before blocking the transaction, the allowed number of attempts is probably staggering.

Reply on news.ycombinator.com