News for hackers. Stuff that matters.

A comment on Namecheap live chat social engineering leads to loss of 2 VPS. Parent comment

Re:Namecheap live chat social engineering leads to loss of 2... by toomuchtodo on Tuesday April 12, 2016 @11:31AM (#11480425)
Too bad you can't ask for the CVV code, and run a dummy $1 transaction. Anyone could have the last four of the card number, but the person is much more likely to have the card itself with the CVV.

Disclaimer: I use AWS extensively. Please do this.

[ Parent | on HN ]
Re:Namecheap live chat social engineering leads to loss of 2... by Declanomous on Tuesday April 12, 2016 @02:09PM (#11482027)
Call 1: "Hey, we just got a new credit card, can you put it on our account?"

Call 2: "I just locked myself out of the account, can you reset it for me."

[ Parent | on HN ]
Re:Namecheap live chat social engineering leads to loss of 2... by toomuchtodo on Tuesday April 12, 2016 @02:22PM (#11482162)
If you're using the payment method as auth, you should be locking it out as an auth method for X days after a change has been made, and emailing/SMSing the contact regarding the change.
[ Parent | on HN ]