Hacker News Reader

Comment by nodesocket | Hacker News Reader

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal?

Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/

Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps, and proactively blacklisted cards before the issuing banks notice and decline.

View on HN

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge.

Now, these charges are clearly fraudulent. Without going into details, we can 100% detect the fraudulent transactions from real ones. I've suggested to Stripe that this could be a honey-pot setup to identify stolen cards but they've told me that there card processing doesn't have that type of infrastructure. Even if I know a credit card number has been compromised, there is no way to alert the card holder.

It's a shame really. It's not the fault of Stripe that we can't alert the card holder but it's important to know that there is no mechanism to protect card holders, even if you know their card has been compromised.

Could you do a frontend validation? At the point of accepting a card, before it is tokenized?

What do you mean with 'tokenized'?

Stripe turns a card number into a token, which you can store without needing to worry about PCI compliance. That token can be used with Stripe to use the card from their secure store.

Yes, I just need time to write the code. It's quicker to refund the money right now. I should have some time to write the code in the next few months.

There is a path where you can report fraudulent activity to your 'merchant financial institution', which will typically be either your IPSP or your bank.

I don't get why stripe can't do this because my IPSP definitely can and we use this daily.

If you can "100% detect the fraudulent transactions from real ones" why don't you refuse to send the details to Stripe.

That's not how Stripe works.

Time. I can eye ball the charges and know 100%. I need to add code that'll do the same and I don't have the time right now. For the few charges we get, it's easier to quickly refund than to write the code. It's something I will eventually write code to automate.

As a hosting provider, we also see our fair share of fraud. It's truly amazing at to me how many fraudulent CCs are attempted. I can't detect 100% -- but pretty close. I've also made suggestions to stripe with a similar response.

Stripe provides a fingerprint, and it would be nice if stripe provided a service to rate/track various card fingerprints and receive a score when adding/authorizing a card -- or develop some community based feedback scoring system with feedback from companies like ours!

> Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards.

Wouldn't purchasing them create just one more incentive?

Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).

> If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers.

Source: http://geer.tinho.net/geer.blackhat.6viii14.txt

Video: https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s

I think that the intelligence agencies would rather have the vulnerabilities for their own use and roll the dice on being on the receiving end rather than buy up everything and close it, making it so they can't use it either.

Well the FAQ on the homepage says "Do NOT contact us about Bitcoin transfer that has status of Unconfirmed Transaction on Blockchain.info" so I'm guessing they don't use PayPal.

Why do they use ICQ?

You mean, while the rest of the world have moved on to something else? It is popular in Russia.

For some reason, it became popular way back then and that's what nearly everyone uses ever since. Why did the rest of the world switch?

Probably because the other services let you have a handle easier to remember than "5767576".

Although the fact I still remember mine, more than a decade after I've last used it, discredits my claim somewhat.

Reply on news.ycombinator.com