Hacker News Reader

Comment by k-mcgrady | Hacker News Reader

Obviously this is idiotic - however, is the information usable without the CVC number ('security' number on the back of the card)? I'm sure it's still useful information to have but probably not immediately useable.

View on HN

There are some payment solutions where you don't even need to fill in the CVC. (I've ordered on Amazon a few years ago without needing to fill it in) Besides that, there were a couple people last year(s) who showed that you can obtain the CVC in an instant by submitting CVC's from 0 to 999, with the same credit card info, to many websites. (This was tested for Visa I believe)

Edit: See http://www.independent.co.uk/news/uk/crime/criminals-guess-v... / https://news.ycombinator.com/item?id=13099949

Amazon aren't allowed to store the CVV so transactions via their one click ordering has to be CVV less. The store gets lower fees on CVV transactions, but it has never been required.

Absolutely yes, a great many payment platforms will accept the details sans security code, as a card-not-present transaction.

In my case it's not, and you also need my billing address to use my card, which isn't printed on it. Still, if you manage to collect 5000 credit card numbers, the CVV is 3 digits, which gives you 1000 possibilities and 1 - 0.999 * * 5000 = 0.99, so statistically you should hit one in 5000 cards if you guess CVV randomly.

Well, as you point out, the probability of not hitting a valid CVV this way is non-zero, or 0.672% - if using R:

    choose(5000,0)*0.999^(5000-0)*0.001^0

But that means, by brute forcing, while you should crack at least one card, there is still a non-zero chance that this will be your unlucky day... (Cracking all cards with this methods, is - essentially - a zero-chance game, but even for that an infinitesimally small chance is left, that my computer cannot reproduce.)

Nothing is certain when combining uncertain independent events. Didnt need a calculator for basic measure theory..

I wonder if having the name and perhaps CVC on the front, and the card number on the back (and not in the way that they're currently produced, which leaves a mirror-image depression of the digits on the other side), would at least somewhat solve this problem of people wanting to show off their cards yet keep the critical information hidden.

Yes, it's immediately usable. CVC verifies you, not the transaction - websites ask for it not because they need it, but to see if you get it right.

So, lacking the CVC may cause some cautious companies to refuse to take the card, but that's just their decision. You can still use it with less-cautious companies, or your own merchant account.

Some study some time ago showed that you can use the existing hundreds of websites that have some credit card form to brute force your way into getting all the fields:

https://news.ycombinator.com/item?id=13161948

American Express prints a four digit CVC on the front of the card, not a 100% sure about the reasoning there.

Last I checked, Amazon don't require the CVC nor an exact billing address match. You could probably order downloadable goods (e.g. PSN/XBL cards) to resell unless Amazon/the CC company's fraud checks flag the order.

Is it actually possible to check the billing address? Because most places won't even accept my name as it is written on my card. So usually I just put something fake since they won't let me put the real information anyways. I have probably bought for several thousand usd as "Your Mamma" without ever being rejected.

Edit: Also as far as I know there's no specific address attached to my card or account except for the purpose of contacting me via snail mail.

Address validation just allows the retailer to check that the house number in the first line of the address and the numbers in the postcode match those of the card billing address.

As far as I understand, the CVC is only used for initial verification, and is not included in the data to the credit card processer.

The major clear web credit card scam site in the Philippines trades lists of websites which don't verify CVCs.

The CVC number is just one security measure in a credit card. One of the legitimacy signals, so to speak, and its absence is not an immediate fraud flag.

While a bad security practise, a transaction can still go through if the other verification signals like expiry, name, billing address, etc (most of which are accessible through social media, btw) provide sufficient confidence in the legitimacy of the transaction.

Reply on news.ycombinator.com