Re:Visa card vulnerability can bypass contactless limits
by rasz on Thursday August 01, 2019 @01:00PM
(#20585835)
How would you credit your account with fraudulent transactions?
Re:Visa card vulnerability can bypass contactless limits
by jaclaz on Thursday August 01, 2019 @02:53PM
(#20587074)
There is no fraudulent transaction, or - probably saying it better - any transaction is not fraudulent until it is detected as such or reported as such.
The whole point of the (rightful) "objection" I mentioned is that there are mechanisms of alarm that would be triggered by - say - a new (delinquent) account receiving one hundred 25 US$ (or Euros) transactions (and no other transaction) in a small amount of time and then, a few hours or days later the sum is transferred to another account and cashed or spent.
But if it is a couple transactions of 1,500 US$ each (or whatever sum that - while being substantial - is below a given triggering alert level) would the alarm be triggered?
Or will it be triggered only after - say - 2/3 of the credit is spent?
Re:Visa card vulnerability can bypass contactless limits
by rasz on Thursday August 01, 2019 @06:41PM
(#20589048)
You have to be a merchant to receive any transactions.
Re:Visa card vulnerability can bypass contactless limits
by jaclaz on Friday August 02, 2019 @06:34AM
(#20591894)
Sure, as if fake merchant accounts are not possible:
https://www.finextra.com/blogposting/14769/three-types-of-me...
Re:Visa card vulnerability can bypass contactless limits
by rasz on Saturday August 03, 2019 @04:47PM
(#20602572)
If you manage to get a merchant account (mule, homeless credentials) you dont need additional technologically advanced/complicated exploits involving getting physically close to people. You just open internet shop, list highend multimedia equipment(TV, consoles, laptops, phones) at 30% off prices and spam FB/coupon/deal sites.
After all I wasn't that much off, my theory was that anyone in a crowded environment (bus, train, etc.) could get a "payment" by simply being "near" the card (be it in a wallet , in your pocket or in a bag).
The objection was that there were much more sophisticated controls by Visa on the "other side" (reputability of the account where the money would go, etc. ) and that the sheer number of micro-payments needed to make the theft profitable (and thus the number of complains) would have easily triggered off the various automated alarms.
But if someone can obtain a Visa/bank account and credit it with a small number of (delinquent) transactions each of relatively high amount, get the money and close the account in a short time it can probably become viable.