Solomon-carding by fanzhongqing

VIEWS: 3 PAGES: 41

									Dr Alan Solomon
Credit Card fraud
 on the Internet




               Dr Alan Solomon
“But we already solved this”
 •   The engineer, the physicist and the
     computer security guru




                              Dr Alan Solomon
           CC Fraud
•   The myth
•   The reality
•   Who gets hurt?




                      Dr Alan Solomon
            The myth
•   Wily hackers stalk cyberspace,
    sniffing packets and assembling
    them to get your credit card
    number so they can steal from
    your account
•   The customer loses money


                            Dr Alan Solomon
          The reality
•   Inadequate narrative
•   Kids making up numbers
•   Repudiation
•   The merchant loses money



                          Dr Alan Solomon
       The CC system
•   Designed for retail
•   Adapted for Mail Order
•   Adapted for Phone Order
•   Adapted for Net Order
•   A bridge too far


                              Dr Alan Solomon
        Inadequate narrative
•   I bought some stuff from Starship
•   I got a CC bill (no invoice)
•   Two months later, I got another bill
•   From American Computer Products
•   Who are they???


                                 Dr Alan Solomon
     Adequate narrative
•   Merchants should be given 120
    characters for narrative
•   Carried through to the statement
•   So the customer knows what it’s for




                            Dr Alan Solomon
         Kids making
         up numbers
•   To buy software
•   To buy access
•   To buy music CD Roms
    (www.MP3.com)
•   To buy other virtual goods/services


                             Dr Alan Solomon
    Making up numbers
•   Six digit bin number
•   Any nine digits
•   Luhn check (mod 10)
•   Why is it so easy?
•   Because the banks don’t see the cc
    number as a password, they see it as a
    username (account number)
                             Dr Alan Solomon
         Creditmaster
•   4000 13 AT&T Universal
•   4013 … Baltimore Bank
•   5100 … Southwestern States
•   5172 … First Bank Card Center
•   5419 87
•   etc
                           Dr Alan Solomon
          Creditmaster
•   I phoned up the 4013 bank
•   Told them about it
•   Gave them a dozen examples
•   They don’t seem to see it as their
    problem
•   They don’t care

                              Dr Alan Solomon
         Chargebacks
•   Merchants have no defence
•   Imagine you sold a newspaper for £1
•   Two weeks later, the customer comes
    back
•   Takes £1 out of your till
•   You watch, and wonder why this is
    allowed
                           Dr Alan Solomon
            Chargebacks
•   Or nine months later ...




                               Dr Alan Solomon
         Chargebacks
•   Merchants need non-repudiable
    transactions
•   Technically easy
•   Whoever does it first, will become the
    currency of the internet


                             Dr Alan Solomon
      Non-repudiability
       - the NR-card
•   Limit liability up to £50
•   If you lose your money, tough luck
•   Just like losing £50 in your wallet
•   Merchants will offer deals that
    persuade customers to use the NR-
    card

                             Dr Alan Solomon
      Non-repudiability
       - the NR-card
•   Merchants will prefer them - no
    chargebacks!
•   “NR-price, 25% off!”
•   “Free gift if you buy with NR”
•   So customers will prefer them too


                            Dr Alan Solomon
      Non-repudiability
       - the NR-card
•   NR-card comes with a CD Rom.
•   CD Rom has dual key cryptosystem
    and your two keys
•   The CD Rom becomes your digital
    signature for that card
•   I don’t need to tell you folks what’s
    on that CD Rom!
                              Dr Alan Solomon
      But that’s the future
•   What about now?
•   We’re stuck with a CC system
    designed for retail.
•   We have to do the best we can with
    what we have


                              Dr Alan Solomon
      Risk management
•   Get a lot of detail from the customer
•   Name, address, post code, etc
•   Name of issuing bank
•   Customer support number



                              Dr Alan Solomon
      Risk management
•   Check the country he’s from, against
    the IP address
•   Check the Zip code against the state
•   Check the phone number against the
    location
•   Check for creditmaster numbers

                             Dr Alan Solomon
      Risk management
•   Check the bank name
•   Check the bank support number
•   Buy the $5000 list of bank names/bin
    numbers
•   Or make your own


                            Dr Alan Solomon
      Risk management
•   Offer a high-price option that no-one
    should ever want …
•    … except someone who doesn’t care
    how much he’s spending




                             Dr Alan Solomon
      Risk management
•   When you get a fraud, don’t give a
    refusal to the customer
•   Say “Hello, Mr Customer, here’s
    what you ordered …” …
•   “… there might be a slight delay …”
•   “ … please be patient …”
•   “ … you’ll get it within 48 hours …”
                            Dr Alan Solomon
        Risk management
•   “ … we’re doing the best we can …”
•   “ … due to a computer crash, there will
    be a slight delay …”
•   “… the recent problems in New Orleans
    has meant …”
•   “ … we value your custom and
    thankyou for being patient …”
•   “ … your business is important to us”
                               Dr Alan Solomon
      Risk management
•   I call this the “inefficient bumbler”
•   The grammatical mistakes are to
    make it look more authentic
•   Many companies do this anyway,
    so he won’t realise he’s getting a
    run-around

                               Dr Alan Solomon
      Risk management
•   Why?
•   Well, if you say “That card was no
    good, please try again …”
•   What do you suppose he’ll do?




                             Dr Alan Solomon
      Risk management
•   If you can, give him something a bit
    like what he ordered
•   But which doesn’t work very well
    (slow, or less functionality)
•   Since you won’t be billing his card,
    you aren’t defrauding him
•   He’ll stop trying to defraud you
                             Dr Alan Solomon
         Authorisation
•   What most people think is “It doesn’t
    guarantee payment, it only checks
    that there sufficient funds in the
    account”
•   This isn’t quite correct



                             Dr Alan Solomon
         Authorisation
•   In fact, if it’s outside the UK, auths
    go through Visa-net
•   If the amount is small, Visa-net can
    just check the first six digits (bin
    number) and the modulo
•   Whoopee.

                               Dr Alan Solomon
         Authorisation
•   So, authing doesn’t give the
    merchant the risk reduction he
    thought it did
•   But it can lead to higher costs, via
    referrals
•   Here’s how

                               Dr Alan Solomon
         Authorisation
•   Authorisation eq “Go ahead, bill”
•   Decline eq “No way, Jose”
•   Referral eq “Maybe. Phone us up
    and we’ll talk about it.”
•   This takes 5 to 10 minutes, and
    requires two people
•   This is the “Modern Electronic
    Credit Card System”
                             Dr Alan Solomon
            Referrals
•   One-in-N; banks choose one in three
    or one in 20 and do a referral
•   If you have a lot of customers, then
    you’ll get a lot of referrals
•   Each referral is 5-10 minutes, two
    people


                             Dr Alan Solomon
               Referrals
•   Why wasn’t this a problem before?
•   Because merchants had floor limits
•   Below the floor limit, no need to auth
•   With the “Modern Electronic Credit
    Card System” all billings must be
    authed. Even $1.00
•   Even though authing doesn’t ensure that
    the card even exists!
                               Dr Alan Solomon
             Referrals
•   When the amount is $10, the bank
    gets $0.40. Can they hire people for
    £1.50 per hour?
•   The current system for internet
    commerce in the UK is about to
    break down



                              Dr Alan Solomon
          Chargebacks
•   Visa is about to introduce penalties
    for chargebacks
•   If you exceed 5%, you pay $100 per
    chargeback
•   The current system for internet
    commerce in the UK is about to
    break down

                             Dr Alan Solomon
    So where will it go?
•   To wherever the business
    requirements are met.
•   Probably the US.
•   Bye bye, Tony




                               Dr Alan Solomon
Credit Card fraud
 on the Internet




              Dr Alan Solomon
Questions




            Dr Alan Solomon
Dr Alan Solomon

								
To top