Detect breaches with Canary credit cards

(Transfer)wise offers virtuals too, though not prepaid

How is that absurd? There is approximately zero consumer demand for stuff like this. Remember when chip cards were deployed 10 years ago and everyone was annoyed at how chip readers forced them to have the card out longer? Or how Amazon often doesn't check CVV numbers because doing do would increase attrition?

Of course a few of the largest banks find it worthwhile to add a page to their website where you can generate virtual card numbers, but it's not a huge win for them by any means even when they're liable for stolen cards.

Capital One offers it on their certain credit cards. Somehow Google Chrome, when you save Capital One card in it, offers to generate virtual directly from Chrome.

Issuers effectively do need to offer 3D secure, since they are liable for all fraud that happens on 3DS-enabled transactions. It's just their choice on whether they choose to require authentication at all, some, or no transactions.

The US has more of a free market approach here, and experience has shown that the conversion rate hit is often much more severe than the reduction in fraud. Consumers will just use the most convenient card, and that turns out to be the one that just lets them buy (almost) everything without additional challenges.

The EU is taking the approach of forcing all issuers to challenge cardholders for most (higher value/risk) transactions. Given that the rules are the same for everyone, cardholders have nowhere to "escape" to – and issuers finally were forced to invest into making their implementations more usable.

I know my french bank offers a service like this, it is an extra though.

My Indian Bank, HDFC offers this since 2008, virtual cards with custom amount, one time use. On creation, the amount equal to limit gets set aside. If merchant charges less than max limit, the excess comes back.

Thier at-time debit cards were good only for domestic transactions, but this virtual was good for international, & used to come up as Visa Prepaid. I used it for registering domains & amazon international shopping.

My Swedish bank (Swedbank) had this service from some time in the 00's up until 2017 when they discontinued it. So they were way ahead of the game but for some reason dropped it.

I wouldn't say that banking is particularly competitive in the US when it comes to technological/product features such as this. Out of several of my cards, only one issuer offers virtual/one-time use card numbers themselves.

Why would it be up to Visa/MC to offer the service, and not for the bank, which issues the cards, to implement?

The system works because it's mostly reversible. If my card gets leaked and someone tries to use it. I just disable my card in the app, contact the bank, they refund the money and issue a new card. Perhaps sometimes the bank has to eat the loss but it works out perfect for the consumer.

Quite the opposite: It should, in an ideal world, be perfectly safe to share your credit card number with everyone, because all it should be is arguably an account number.

Payment initiation or confirmation can be an entirely separate layer (such as chip + PIN or 3D Secure).

This is actually the goal of European regulators right now (with some carve-outs for low value and low-risk transactions).

That‘s really no longer true for most debit cards these days. Issuers can process disputes for debit and credit cards in the exact same way (at least for transactions on Visa and Mastercard, i.e. practically for all online payments).

Higher tier credit cards often have additional insurance that goes beyond what the chargeback mechanism is designed for, though, but for fraud, you shouldn’t need these.

Capital One lets you manage them on their website as well. They just really seem to be pushing their extension and Chrome integration, which I both don't care too much about, but the functionality is there (albeit well-hidden).

Bounty hunters are not really a thing in the way you’re thinking - they can’t just go to Japan, investigate someone, arrest them and bring back someone from there for instance. They’re for returning someone already arrested who jumped bail somewhere. And they typically don’t work internationally, as their legality is dubious even within a specific jurisdiction.

For something major, it’s generally already possible to investigate and get someone extradited already, for instance, when the cultural gaps aren’t too large and the cultures have a common agreement on what a ‘major crime’ is and looks like. Murder, for instance.

The issue is the bar for ‘major enough’ gets higher and higher the more jurisdictions/cultures you cross, and it is super easy now to scam across a large enough gap there that no one is going to arrest or participate in investigating all but the largest and most blatant scams.

Good luck getting someone arrested in Russia, Nigeria, China, etc. for wire fraud, for example.

The US has the power to really cause damage to India (and well any other country). They can cause a stink on the UN front and if that does not work, escalate financially like they do to countries like Iran. Its just not that important for the extremely old and corrupt leadership at the top to care about though. I suspect once someone from the internet generation takes the presidency, there will be some chance of something changing.

> if they convinced (paid) some (more-)legitimate companies to have their outgoing calls show up as the same number as the scammers use

In the US the STIR/SHAKEN[1] protocol adds source-verification. If/when this finally gets fully rolled out, spoofing caller ID without it being blocked is going to get much harder.

But, I'm sure the next step for them is to just go after the millions of small-medium business IP telephony systems that are either poorly configured with default/guessable passwords, or have wide-open security holes.

[1] https://en.wikipedia.org/wiki/STIR/SHAKEN

Oh, thanks for the info!

There's a tradeoff. Card numbers in your db are a lot easier to move between payment platforms than tokenized card numbers. So many merchants get screwed by payment platforms that lock them out right in the middle of a large sale because the sudden increase in transactions looks like fraud. You gotta look out for number one.

> All the payment platforms provide ways to persist cardholder information, in a way that allows it to be reused but never read.

This is usually called tokenization, if you want to search for it.

> Interested in exactly when it becomes impractical.

Having multiple payment service providers, for example (or the plan to do so in the near future).

Another example would be complex legacy systems (especially in the travel segment, constellations between various service providers get complex quickly).

> I'm prepared to go to quite an extraordinary amount of effort to make sure PANs and cardholder data never comes near any system I am responsible for.

No objections there :)

> you can't actually handle payments without storing CC numbers.

Now you're putting up a straw man. It's definitely not impossible, but in some circumstances, it can be very hard.

Also, somebody will have to store the PANs in a database in the end, even if it's just the payment service providers themselves. There are much less payment service providers than merchants out there, but by the same logic, that makes them a much more valuable goal for attackers.

> Interested in exactly when it becomes impractical

A couple examples where the Stripe model and scale of tokenization breaks down today:

- You're an airline and you need to have a digital wallet that stores payment details so you can buy your ticket on web, upgrade your seat on mobile, and buy a drink in-flight using the flight attendant's POS device

- You sell a product at high-risk of chargebacks that is not permitted by the major tokenization providers' terms-of-service (there are some surprises here that rule out several Fortune 100 use cases!)

- You're a $10B+ retailer where the difference between a 2.9% payment processing cost and a 1.6% payment processing cost pays for an entire team of people to focus on minimize processing costs by routing different payments to different gateways depending on fees (eg American Express goes one place, Visa goes another)

Now: if you are a mom-and-pop scale DTC shop selling only via web, you should probably be taking advantage of tokenization instead of storing credit card data yourself!

The PCI-DSS council does give guidance on how you handle credit card information securely when you cannot use a tokenization approach, and a lot of it boils down to what we'd consider foundational software engineering practices. (Don't let engineers have access to production data! Rotate your credentials periodically! Log events and maintain those logs so they can be audited!) It does increase your costs, complexity, and talent needs but it's also not an antipattern and there is relatively straightforward guidance on how to do so securely.

people normally imagine that finance and specially banks, are just COBOL, mainframe and legacy, and even though it is part of their BAU, there are lot of innovation there, specially in the infosec/antifraud segments.

So either you generate some fake but valid credit card numbers (i.e with credit card number generator) and set some monitoring on them or even better, you generate a credit card number with something like revolut, and as soon you get some transaction on that number, you know your database was leaked.. not hard actually to setup something like that.

I'd say this is still putting the burden on the wrong party, though. For this to serve as a useful deterrent in general, canaries need to be quite common. Rather than hoping that thousands of customers will choose to use a canary and monitor individually, any company that stores credit cards should instead contract with an outside auditor, whereby any time a user stores a real credit card in the system, the auditor generates a canary and stores that in the database as well. This way it happens transparently in the backend, without having to ask users to do it, and immediately turns any credential leak into a minefield where you have a 50% chance of getting only one card before a canary goes off.

> If someone steals my credit card, I’ll likely lose nothing other than some mild inconvenience updating numbers

You might not lose money when someone steals your credit card, but someone does: either your bank or the merchant will suffer a fraud loss.

Consumer fraud protections with regards to credit cards are necessary because credit cards are fundamentally insecure technology and would be unusable if issuers didn't take on so much of the fraud risk themselves.

> and I don’t even need to do that with the modern systems like Apple Pay which use unique per-merchant identifiers.

Apple Pay is a big improvement over standard credit card technology. It's also closed and proprietary, and requires special equipment to use, on both the merchant side and the consumer side.

> spend your time unbreaking the system instead of marketing it.

Are you criticizing me for writing this comment on HN because I am not at this very moment writing code? In your mind, people can't even talk about a project they may be interested in or working on until the project is finished?

> If you want people to buy your random hashes

Are you sure you are not confusing stablecoins and cryptocurrencies? These are very different things. Stablecoins are transferrable sovereign currency obligations the balances of which are recorded on a blockchain. Stablecoin tech can be used to allow consumers and merchants to interact with any type of monetary account as might otherwise be embodied by a debit or credit card, with similar business terms.

> That makes quite the contrast with the large sums routinely and irrecoverably stolen from blockchain users.

No doubt blockchain security needs to be substantially improved. It will happen, though!

Well, that was a rabbithole. I learned that (BME - Bolsa y Mercados Espanoles - Spanish stock market) is owned by a Swiss company. It blows my mind that countries sell off such important infrastructure, even if in this case to a friendly country.