Hacker News Reader

Comment by 13of40 | Hacker News Reader

> I'd be pretty astonished if a credit card company didn't cancel someone's credit card if someone was tried a handful of transactions with random security codes, let alone enough to guess one number in a thousand.

If you have a whole database of them, the trick is to try one code with a thousand cards. Even so, that was a major improvement over the status quo before, which was to use the expiration date, meaning you only had to try about 24 or 36 cards with one month/year.

View on HN

Their fraud detection algorithms are specifically looking for small, localized, per-transaction events with few data points as well as overall patterns-- I doubt it would be that straightforward. It might not mean you'd be targeted, but on a per-transaction basis, I there's a good chance you'd get blocked for any individual attempt even if you got a match.

I think visa or MasterCard would catch on in that situation too, no? There's only a few processors, they should notice the pattern.

They process so many transactions per second. It doesn’t seem too hard to try wrong ccv at a pace slow enough to avoid detection.

I would need to hear that from someone who actually works in a CC company fraud department because I don't think it's that straightforward. I've had MC transactions declined on a card I use for everyday purchases at two stores in my neighborhood. I don't think reasoning about their transaction monitoring like someone might monitor network traffic is a good analog-- they're specifically looking for patterns in small-scale, localized events without many data points. They don't have to connect the events to stymie the fraudster's efforts.

> If you have a whole database of them, the trick is to try one code with a thousand cards

That still sounds like a crapshoot... Of those 1,000 cards, there might be 14 that have 982 as CSV, 9 that have 307, and none with 118. In other words, there's no guarantee whatsoever that any given CSV will be used in a batch of 1,000 or even 10,000 cards.

Of course there is no guarantee, but statistically if you have 1/1000 probability of success and you try a 1000 times, that's not bad.

Reply on news.ycombinator.com