Hacker News Reader

It’s mitigation, not a perfect prevention, but those are extremely useful for security: if the attacker trips a warning after hundreds of charges are approved that still allows the bank to take action before the number is in the thousands of cards and makes it possible to retroactively revoke the transactions which were just approved. In the common case where someone is making purchases using stolen cards that allows goods never to leave the warehouse, and if the attacker slows their usage rate to avoid that they’re getting much less profit.

Usually they test the set of cards with small charges. This allows them to sell pre-tested cards at higher value.

So if you can find out that one of your canary cards have been tested, you can have some confidence that your whole set has been compromised.

The responsibilities don't end when the breach happens. And while the cat is out of the bag, knowing it has happened is also important to contact customers, fulfil legal disclosure with regulators (eg. GDPR), and for triggering investigations and forensics.