Credit cards are vulnerable to brute force kind attacks

Re:Credit cards are vulnerable to brute force kind attacks by janpeuker on Friday May 01, 2026 @05:12PM (#47980408)

Payment processors don't allow just brute forcing all card numbers a.k.a. card enumeration or card testing [1][2] and card schemes penalise merchants and payment processors heavily if they don't take measures against it [3].

1) https://stripe.com/newsroom/news/card-testing-surge

2) https://stripe.com/blog/the-ml-flywheel-how-we-continually-i...

3) https://docs.stripe.com/disputes/monitoring-programs#enumera...

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by kodbraker on Friday May 01, 2026 @05:23PM (#47980538)

The rate they try becomes very non frequent when they use multiple card validation apis. I'm not sure how it can be related when it's different pan numbers, different source ips etc.

Enumerating CVC2 with a single PAN is a different story.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by opengrass on Friday May 01, 2026 @05:50PM (#47980888)

Until 6 years ago Stripe didn't obfuscate card numbers in API logs at all.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by e28eta on Friday May 01, 2026 @11:32PM (#47983058)

That’s untrue. While I would be willing to believe that for a brief period of time there was a bug that could expose it, having been at Stripe between 2017 and 2020, it was my experience that they had a robust system preventing PANs from being disclosed.

That included efforts to mask PANs that were in the wrong place.

We didn’t want them in our internal logging systems, and we certainly didn’t want to leak them back to the merchants.

[ Parent | on HN ]

Re:Credit cards are vulnerable to brute force kind attacks by SkiFire13 on Saturday May 02, 2026 @03:19AM (#47984133)

This is pretty much a PCI DSS requirement for anyone that directly handles PANs.

[ Parent | on HN ]