Disposable Credit Card Numbers 126
nihilvt sent us news that disposable credit card numbers are actually being deployed by several credit card issuers. The technology sounds like it involves a silly Windows plug-in of some sort, but I'd think there's a lot of potential for growth here. Has anyone actually used these systems? Do they work well? (We ran a story on this a few months ago.)
Great stuff (Score:3)
So is the next generation of credit cards going to have a built in mini screen displaying the current disposable number?
But wait.. (Score:2)
This could be avoided with the way the system is supposedly set up. In order to use this permanent one use card, the thief would still need to have access to your password from the credit card company - not Amazon.com.
"If hackers broke in, they couldn't use the virtual number without your password -- which the merchant doesn't have -- and it couldn't be circulated to other sites."
Re:I use 'em (Score:1)
I designed something like this... (Score:3)
Okay, not
The general idea is that a user is issued a transaction generator (for lack of a better word). This is a small device (with a keypad and LED screen) which maintains a counter with the number of times it's been used, and contains unique public and private numbers. When the user wishes to perform a transaction, he/she enters the amount of the transaction and his/her PIN number. The public number and amount (perhaps obfuscated) are output as cleartext; the private number, amount (again), PIN and counter are sent through a one-way hash. This hash is appended to the card's output.
The verifying agency keeps track of not only the private number but also recently used counter values. When a transaction comes in for verification, it attempts the hash with the last [INSERT CONSTANT HERE] unused counter values (up to a limit of [INSERT CONSTANT HERE]), as well as the next [INSERT CONSTANT HERE] counter values. If one matches, the transaction is approved and the database of used counter values is updated.
The end result is that: a PIN is required for each transaction. Each transaction value may not be reused. The most data which can be had from reverse-engineering a card is the private number, which is still useless without the PIN; hence, stealing the generator does no good. Stealing the in-transit data will get you the public number, but (thanks to the one-way hash) no private number or PIN. Even watching someone perform data entry and stealing their stream (taking both the PIN and public number) does no good, as the private number is still unrecoverable.
The bad news is that the number has to be fairly long to include an acceptable amount of hash data -- I determined 26 alphanumerics to be more than sufficient, but providing this means replacing a lot of equipment. This much data is needed in part because the multiple hashes done in verification increase the chances of collisions significantly. Furthermore, it means that software and equipment that performs a Luhn check (as with CC#s) will need to be replaced.
I still consider it a nifty idea.
Re:Is nice but still on an exploitable computer (Score:1)
What's the backend? (Score:4)
These tokens can use any existing billing system as a backend. It can be billed to a real credit card like the systems described in the article. It can also be debited directly from your bank account. It can even be billed through a prepayed card you can buy at the store just like a phone card. I would really like to see a system with a Paypal account as its backend (anyone at paypal listening?)
-
Really dumb question..... (Score:1)
--Garion
I have an even better idea.. (Score:1)
Signing up for free email accounts every time you need something is annoyng at best. Mabey it could be valid for 24 hours or something. It may even cut down on spam, if the spambots knew that #1 the email would never get read and #2 there is a 90% chance that an email would get returned undeliverable. *grin*
"Everything that can be invented has been invented."
Discover disposable numbers aren't great. (Score:3)
To use it, you have to download a Windows app (NOT a browser plugin) called Deskshop. This program activates itself automatically when I boot up and puts an orange dot on my taskbar. It has a setting to disable automatic startup but it doesn't work. Everyone once in a while, ZoneAlarm will catch it trying to access the internet secretly. I'm sure it is spyware and was trying to upload my browsing/shopping/etc. habits. I would prefer not to use this app but rather just go to Discover's web page to get a disposable number. But I can't do that.
The number is the usual 16 digits and the first 4 digits are the same as for regular Discover numbers. Apparently merchants are not able to tell whether it is a disposable number or not. When I request a number (via Deskshop), I specify whether it is recurring or one-time. As the names indicate, one-time numbers can be used for one charge only, while recurring numbers can be used again and again (for example, to pay a monthly subscription). I can cancel the recurring number but I have to call Discover customer service. I wish I could use their web page instead. I also wish I could specify a maximum dollar amount for each number I generate. But I can't do that either.
As for Amazon one-click, I don't see why a recurring number would not work, but I haven't tried it.
Re:I use 'em (Score:2)
My experience with the system (Score:1)
Um... no (Score:2)
The way the numbers are generated, you would need the person's password to have a number generated, which means that if you broke into someone's email, pc, etc., to gather information on em, chances are you could figure out their password and then generate the number.
Its a bad idea for credit card companies to go the route of having a user generate a random number based on a password, as history shows us people are simple, and will often rely on choosing simple passwords.
Again, a simple fix for this would be to have the credit card company pre-determine a block of numbers via mail or fax to the person, then afterwards have the person verify them when they intend to use them by phone if possible where caller ID can be used to ensure its the correct person.
Upon verifying the information, the credit card co., can then activate the numbers for use.
Just my two cents.
Where in the world is my wife [speedygrl.com]
Couldn't this be done an easier way? (Score:1)
Wouldn't it be simpler if you could just confirm every transaction with a secret only the cardholder knows? What I mean is, If I find a card, or preferably someones whole wallet, lying on the street, I can use it on the net, no problem.
Unless I had to put in a PIN that wasn't written on the card. I'm amazed that all the information you need to use a card is contained ON the card.
The way I see it, you would have some kind of instant messaging account set up beforehand, and the CC company would have it on file. So every time you entered your card info to make a sale, the merchant would send the request to the CC co. for approval. Before giving that approval, the CC co. would IM you and ask for your PIN. Hopefully the PIN request would be by some out-of-band method (i.e. not via the merchant) pre-agreed on by you and the CC co.
That way, the merchant would never get your secret (PIN, mother's maiden name, whatever) and couldn't record it in a database. And a criminal wouldn't KNOW the secret, and couldn't use your card.
How this would work in a physical STORE, away from home, would take someone smarter than me to figure out. :)
Just a thought.
Short term solution (Score:2)
The real solution is to ditch this insane credit card system. It plain makes no sense. Instead of giving the money to the merchant, you are giving him a key to your safe and telling him to "take only what you need." Sure, we have banks to protect overcharging, etc. The consumer actually does have a lot of protection when using a credit card. But think about the hassle that the credit card companies must go through because of this deranged system. What we need is a system that allows the consumer to authorize a payment. Perhaps when you go to the store, there would be a "vendor ID" at the counter and you would just whip out your cellphone and authorize a transaction.
It's funny, because all of us can talk all day about security and huge bit keys and networking, yet we give our login and password to the waitress every time we eat out.
-Justin
Re:I have an even better idea.. (Score:2)
Why do you need an actual email address? Just use some random crap so long as it has an @ and . in it.
If you do need an actual address, make one on hotmail and use it for everything. But never go there to pick up your mail.
Or most isps will let you have multiple accounts. Make one for junk, pick up the mail and send it directly to trash via filters.
No need for temp accounts.
MOVE 'ZIG'.
Re:Algorithms (Score:1)
Anal probe (Score:1)
> access-list 102 deny tcp any any established
you don't need the "established"...
Si
Re:Not All 16-Digit Combinations Valid (Score:1)
Credit cards like Phone cards? (Score:1)
I'd sure welcome this (Score:2)
Re:Isn't this a lot of overhead? (Score:2)
Credit card numbers can have 19 digits, not just 16. This is going to burn lots of people who assume that the cards are only 16.
There is nothing keeping letters out of the credit card numbers. The mod 10 checksum even allows for it.
Large amounts of the number space have been taken by some of the visa 12 digit cards.
Re:An Alternative (Score:1)
I now two women who can't wear electronic watches because they end up zapped. They just seem to have strange static field that tends to wipe out stuff. One used to wipe out computers constantly until she went with full anti-static precautions (floor mat, wrist strap, even anti-static chair). Will these people ever be able to use smart cards?
Re:Isn't this a lot of overhead? (Score:2)
The 1st 6 digits are assigned in blocks.
Actually, the first digit indicates the card type (Amex is 3, Visa is 4, MC is 5). The remaining three to five digits are assigned to issuing institutions (banks). No big deal here in Canada where there might be 100 issuing banks in total (since independent banks are virtually unheard of), but in the USA (where every podunk town has an independent bank) that pool would be exhausted pretty quickly.
Credit card numbers can have 19 digits, not just 16. This is going to burn lots of people who assume that the cards are only 16.
Can you name one card type in use today with more than 16 digit card numbers? I sure don't know of any... Where did you get that figure from?
There is nothing keeping letters out of the credit card numbers. The mod 10 checksum even allows for it.
The ISO 7810 standard which governs almost all magstripe cards in use today contains provisions for three different types of information recording, referenced as Track 1, Track 2, and Track 3. Track 1 can contain up to 79 alphanumeric characters. Track 2 can contain up to 40 characters of numeric information. Track 3 can contain up to 107 characters.
Track 2 is where the card number is stored. Thus, card numbers could theoretically be up to 38 digits in length (40 minus the start and stop "sentinel" characters), but cannot contain non-numeric characters. Ergo, letters are out. I have no clue where you got the idea they were possible.
Even if that weren't the case, I would imagine a VERY good number (>95%) of POS (point-of-sale, not piece-of-shit) cardswipe terminals would freak out if they read a card number off a stripe as "4512A8F7B7A2C88F". Also, how the fsck do you enter that on the terminal's keypad if the stripe gets demagnetized? You don't.
Large amounts of the number space have been taken by some of the visa 12 digit cards.
The old Visa cards were 13-digit. All Visa cards now issued have 16 digits. (Amex cards are 15-digit.)
Speak not from whence you know not.
--
What about the merchant? (Score:1)
So, in short, there's not much of anything we online merchants can do when a chargeback comes our way. I would love to see a nice solution to this problem.
Re:Isn't this a lot of overhead? (Score:3)
Ahh, but we're talking about entering these things into a computer form, eh? Since they don't have to worry about swiping a non-existant one-time-use card, then no worries as to if the number can be entered into a keypad.
Also, since [presumably] the verification and deactivation are real-time, the numbers are instantly recyclable, since, as they're used they can become immediately available again.
---
Re:AmEx has offered this for a few months now (Score:1)
Re:An Alternative (Score:1)
Re:You beat me to it... (Score:1)
My friend seemed convinced there would be other versions. My information, however, is older than yours...probably around July. Plus it's less offical. Overall, in my opinion, I'd say your line is more likely.
8)
Re:Number Ranges... (Score:2)
So, the only danger is actually using up all the numbers. No problem there either . . . if we say there are 6 billion people in the world, the current 16-digit system still gives each of them somewhere on the order of 2 million numbers to use.
Throw away credit card (Score:2)
Re:How about some security for my Debit Card??? (Score:1)
An Alternative (Score:3)
You can also access your account online in this way and do other things, like download coupons to the card to be used at retail stores. For example, you can go to http://www.fakecoffeestore.com, download a discount to the card, then go to the mall to FakeCoffeeStore and use your card there for a discount. Pretty neat...
Of course the problem with this setup is people have to support it.
Info on the card I have, the FusionCard, is at http://www.fusioncard.com [fusioncard.com]. I haven't gotten my reader yet, should be a neat toy though.
Re:AmEx has offered this for a few months now (Score:1)
Re:Isn't this a lot of overhead? (Score:1)
I didn't know about the Aussie cards. Neat!
As far as entering CC numbers, I was talking about point-of-sale terminals, not mobile phones. They simply can't handle non-numeric card numbers, period. Thus, letters are out of the question.
--
Nothing new. (Score:5)
--
Re:Automatic payment (Score:1)
How long that will be depends, of course. If it means enough to someone, I'm sure they'll fix it.
Re:Isn't this a lot of overhead? (Score:5)
Nah, it's not that much of a difference. Think of it in database terms: if they currently identify your account by your CC#, they will just have to change that to some other general ID. They'll have to keep a relationship table going between the real ID and the disposable CC#'s, along with valid vendor and timeframe information, but it won't really change the way they do business that much. The conversion to the new system will cost a pretty penny, but believe me, they can afford it.
Same concept with the one-use cards, it seems like they'd exhaust the card # space a lot quicker if each person can use 500 card numbers in a year as opposed to 1 every 5 years...
The system has room for each of 6 billion people to have almost 2 million numbers. Not a problem.
You can be sure the credit card companies have considered all of these issues. They don't screw around. Due diligence is a way of life for these people; their line of business leaves no room for error.
Re:perfect complement (Score:1)
...and then you print your e-mail address right along with it, without so much as a "REMOVEME" to stand in the way of spammers. Brilliant move, Einstein.
Re:Direct Authorization and other ideas (Score:1)
Exceptions... (Score:1)
I have avoided places like Amazon because I like people like Joe at the small bookstore down the street.
There are exceptions, however. I have yet to find a good way to buy airline tickets except online. I also tend to buy computer equipment online (http://www.smalldog.com/ - a small Mac online Mac store).
Before buying, however, I make sure of several security concerns - do they save my credit card number? Do they have well-written Privacy policies? Do they send unsolicited Spam?
Still, I would use one-time credit card numbers if they were made available to me.
Re:Isn't this a lot of overhead? (Score:2)
And no, email isn't secure, but when you think about how most people get CC#'s, they usualy don't have access to personal email accounts. So how would they know what address to enter when it asks for one? And to take that even further, perhaps require a PIN number to be entered in the reply mail somewhere. The more the criminal needs to know, the harder it will be for them to succede. And the bigger trail they will leave too.
"Everything that can be invented has been invented."
Re:Working around a problem (Score:2)
NO loss on credit card fraud! (Score:2)
If the person sees the charge, then the credit card company will reverse the charge back to the merchant -- unless the merchant can show a valid signature and card swipe.
The only times when the credit card company loses money, is:
Yes, and this is exactly why this shouldnt be here (Score:1)
I hope you nerds enjoy reading about stuff that's already happened... its this kind of nonsense that's killing this site.
Re:An Alternative (Score:1)
FP.
--
You beat me to it... (Score:1)
For those of you interested, it actually works pretty well. I installed the software a while ago because there was at least one website I sent my credit card details to that never got back to me(and that makes me worried even though it's over a year ago and the card expires in three weeks 8).
What I wanted to question was who told you there wouldn't be a Linux version? Was it some minor bank offical, because as far as I could gather, the plans are to press ahead with both Mac and Linux versions. But you know how Irish banks are with truth. (You put down Dublin as place of residence and nationality as Irish on your account application...so do you want a resident or non-resident account?)
Not intended as a slur against AIB who has only ever practiced good, lawful business practices...as far as I know.
8)
Non-winblowz format with Discover (Score:1)
Re:What about disposable numbers? (Score:3)
Well, there goes Visa. You can still use your MasterCard until someone uses 5 . . . aw crap.
Re:Short term solution (Score:1)
So far the system works quite well but until now it is only available with some cabs and online stores, you can't use it to pay in offline shops yet.
AMEX (Score:2)
No, but its a stupid method (Score:1)
Give your customers a way to authorize credit card payments. Instead of using their normal 16 digit cc number for buying a single-month-membership at www.sexyteens.com (and not knowing shit about both the trustworthiness of the webmaster and of their security/antihacking measures), enable them to go to your website (https://www.mastercard.com/) and create a temporary one.
The users can then e.g. select that he wants this temporary number to carry $30. Some script (hopefully not visual basic...) can then encrypt the data and Base64 it, giving the user the number "KBVjSOEgraG3bp7WIkbMWKPRB" to pass on to the shady website owner.
This protects him from excessive fraud (having the website charge him $500 instead of $30) as well as from cc theft (the stolen number will be completely worthless as soon as it has been billed for its allowed charge) and identity theft (since a number like that would not be legally allowed as proof of identity)
But since we're going to have to wait for banks to implement this scheme, I don't believe we'll see a possibility like that before 2050
--------------------------------------
Short term solution to whose problems? (Score:1)
So how many people have lost all their money due to this lack of "huge bit keys"? Of course the figures usually are impressive if a credit card company announces losses by credit card fraud had been so-and-so many billions last year. But think a minute, or better an hour, about who is losing how much, i.e., how risks are distributed among the customer, the merchant, and the credit card company.
This is mostly a non-technical problem, and "huge bit keys" can actually make your situation, as a customer, worse. There have been reported cases of European banks accusing their customers of fraud when they complained about phantom withdrawals via ATMs. After all, the bank had strong encryption, so the customer must have done it herself or at least have helped by giving away her secret PIN. So "huge bit keys" did not save the customer's money, but the public prosecutor's job.
Besides, I haven't seen in years a "more secure" payment system which is as convenient and easy to use (by the honest owner of the money who would like to spend it online or offline) as an old-style credit card. It's universal, it's small, it's something I never leave in the office when I go home, and it does not force me to pay in advance before even knowing what I might want to buy some day. I'm not going to bury my money on smartcards or on my harddisk, and I'm not going to do anything less convenient than fetching my card and typing in what is printed on it, just to buy something on the net. Put a chip onto my credit card and give me two card readers (for home and office use) for free, if that helps to increase security, but don't try to add complexity to my everyday life. If I need something really complex, I'll install IBM DB2. :-)
Recommended reading:
Ross J Anderson: Liability and Computer Security: Nine Principles [esecurityonline.com]. (PDF)
How about some security for my Debit Card??? (Score:2)
Smartcards (JavaCard) (Score:2)
Keep in midn that vanilla credit cards have a 20% fraud rate. Thats a ALOT of money to pay for infrastructure if you can significantly reduce that percentage.
Re:Isn't this a lot of overhead? (Score:1)
I think the extra three digits in question is a security code frequently found on the back of the card in the signature area; I don't know if they really qualify as part of the card number. (MBNA's ShopSafe system, one of the systems this whole article is about (and the one with which I have personal experience), generates these codes...)
Re:Isn't this a lot of overhead? (Score:1)
--
Re:How about some security for my Debit Card??? (Score:1)
I know that at my bank, my debit works just like my capitolone Visa card. Capitolone is much better at handling fraud than my puny little local bank is. So, I'm not sure about you, but I'm just the opposite. I'd rather get a bill in the mail from my credit card company and dispute with them the charges than have my some merchant take the funds directly out of my bank account and during the whole time I'm disputting the charges, I'm out of that money.
--
Todd
What about disposable numbers? (Score:1)
Algorithms (Score:1)
Isn't this a lot of overhead? (Score:4)
Doesn't this seem like a lot of overhead for the card companies? Now, not only do they have to keep track of millions of cards and billions of dollars spent through them, but they also have to ensure that the right cards are being used by the right retailers. Yes it's convienent, but how much is it going to cost?
This also doesn't exactly solve the problem... if I have a one-retailer use card set up for Amazon.com, someone can still steal that and buy stuff in my name from Amazon...
Same concept with the one-use cards, it seems like they'd exhaust the card # space a lot quicker if each person can use 500 card numbers in a year as opposed to 1 every 5 years...
Sorry if that was incoherent
Re:I use 'em (Score:1)
Working around a problem (Score:3)
For example. When I first went to university, I was slightly overweight. I know I don't have the willpower for working out regularly, I've tried too many times and failed. So instead, I found an apartment five miles away from the university, with a nice bike path that went almost all the where I lived. There was no way I would pay for a monthly bus pass (money better spent on games) so for the next three years I was biking at least 10 miles a day, five days a week. Sure it's a little extra work, but it's worth it. Problem solved.
This solution reminds me of that. Instead of trying to make encryption better and better, a process everyon knows will always have problems and flaws, either in security or convenience, they worked their way around it by making the numbers a one-shot deal. Sure it's a little extra work, but the rewards are worth it. Problem solved.
Re:Stealing regular card numbers (Score:1)
One-click shopping sites (Score:3)
Seems to me you could enter the credit card number when making a purchase, click "Buy", and still come in at one click..
The sad thing is that the way it's written, it's like the author really thinks that Amazon _must_ keep credit card numbers on file...
I use 'em (Score:2)
16 Digit Limit Artificial (Score:2)
The 16-digit limit is indeed artificial. But it's going to be hard to overcome. Sure, 17, 18, and 19 digit cards are going to work just fine at POS terminals that have been implemented carefully with the specification in mind. But it's likely many of them will fail in other places due to artificial limitations added by people who didn't quite understand the big picture.
Many online ordering forms have a text box for the credit card number that's capped at 16 digits. Worse still, some won't even accept older style 15 digit and shorter AMEX and VISA cards. People who have been cardmembers for a long time (and thus have these lower numbers) have been experiencing this problem for some time and many have requested new cards be issued with 16 digit numbers. New cardmembers that get 17, 18, and 19 digit cards are going to be unable to use them at similarly ill-designed sites and will probably try to gripe at the card issuer for a shorter number.
Is nice but still on an exploitable computer (Score:2)
A better solution would be a system similair to what my local bank gave me: a device that looks like a calculator protected by a pincode that allows you to digitaly sign things. A few modifications and a device like this could generate your one time credit card numbers. Now that would be a secure solution!
With some thought this device could do away with passwords etc as well. Now we only have to hope they'll opensource the technology...
Re:Isn't this a lot of overhead? (Score:2)
That's not for the card companies to manage - it's for YOU to manage. For example, I leave my credit card number on file at Netflix.com, and they charge me every month. If I wanted to, I could use a disposable number for that, and I'd know if it got used anywhere else that Netflix's database had been compromised. Then, I'd only have to cancel one disposable card, instead of reentering my card number at all of the places I do business with.
This is actually a Good Thing, no offense to Martha Stewart. I had my wallet stolen in Mexico a while back, and ever since, I've had a separate credit card that I use just for online transactions. It helps me prevent fraud (that account should never show anything but the same four or five retailers) and makes it a lot easier if I get my pocket picked again - my services keep coming, regardless of whether I have to stop my other cards.
We need disposable card numbers! (Score:2)
Let's say that I go to a store on the 'Net that I don't know or trust too well. I see a t-shirt or mug or something I want to buy for $12 but don't really want THEM to have access to all my credit on one of my cards.
So... I generate a credit card number with a fixed limit of $17 and give that number to them, and I don't have to worry about my number being stolen: it's only good for 17 bucks!
So you see? This allows you to have more control over your credit cards and relieves the worry that your card will be charged more than you wanted it to be.
Another application are those damn Time-Life CD's they sell on TV. Ever bought one? Of course not! Cause you're not gonna just buy one! They keep sending you CD after CD - the whole set, as long as it will fit on the card you gave them!
So, just give them a disposable card number for the amount they need, and be done. When they run the card again next month, it'll deny and they won't send you any more crap.
Re:Throw away credit card (Score:2)
They're way ahead of you, pal. Go to cobaltcard.com, something AmEx has had out for more than a year.
Not All 16-Digit Combinations Valid (Score:4)
Don't forget that not all 16 digit numbers are valid for use as credit card numbers. In order to be valid, a number must first pass a rudimentary checksum test called LUHN-10. This checksum is intended to prevent unnecessary online verification of numbers that were entered in error. In short, the sum of odd numbered digits (numbering starts at the right, not the left) must be evenly divisible by 10, and the totals of the other digits each individually multiplied by two must also be evenly divisible by 10. As a result, there's far fewer than 10000000000000000 sixteen digit credit card numbers available.
perfect complement (Score:2)
Don't forget, sneakemail.com [sneakemail.com] is the perfect complement to disposible cc numbers. If you dont trust a e-commerce company with your cc number, why would you trust them with your email address?
This is only a quickfix (Score:2)
Re:Isn't this a lot of overhead? (Score:2)
Not all 16-digit numbers are valid -- actually, far from it. The LUHN-10 [poly.edu] algorithm [cmu.edu] makes sure a CC number supplied by the client is valid before submitting it for authorization. All credit (and debit/ATM) card numbers must fit that algorithm.
Therefore, there aren't nearly as many numbers available as you might think.
--
Amex's Blue (Score:2)
I have the blue card from amex [americanexpress.com] (the one with the microchip) and use this payment numbers. I insert my card in its reader, enter my pin to authenticate and generate a card number. I have now used it for quite a few online purchases without problems. Personally I think it is one of the best things they have done.
Of course, I can also generate the random numbers by login into their site using my username and pw but hopefully they will add a restriction so i can limit login to my smart card.
Also, I just took a survey they sent out to gather feedback. In it they asked what of the additional features listed you found most interesting. They included several listed in the article, including generating a long term number you could put on file with someone like Amazon but if was stolen could not be used by someone else (only accepted charges from Amazon) and putting limits on generated numbers (ie. you can know a site cannot overcharge you, you can give the number to a child without worrying etc.) once they have these I will be using Amex for all my online purchases.
Now I am just waiting for them to get rid of the number on the card itself so I can use it in a store without worrying. There is no reason at all to have a fixed number.
This, in turn, will save them billions in fraud that they do not recover (so long as the merchant follow the authorization procedure today they are not responsible for fraud charges). We can only hope that they will pass this saving on to us.
Re:One-click shopping sites (Score:2)
Honest question: When a user makes a purchase, how long does the site have to store the credit card number. Obviously it has to be stored long enough to send off the credit card company for authorization, and perhaps during the rest of the transaction (e.g. to show on the screen as "charged to your Mastercard xxxx-xxxx-xxxx-1234"). But what if there's a dispute or other problem with the transaction. (For example, if the customer returns the item and asks for a refund.) Are there legitimate cases where the credit card number should be stored for at least a while?
Yes, i use these constantly through Amex's website (Score:2)
American Express [americanexpress.com] offfers disposable card numbers to all card holders (as far as i can tell).
By simply signing in and selecting a card (for those of you with more than one :-) a normal looking card number will be generated along with an expiration date in a small window that pops up.
It's very cool, plus since it relies on Java/Javascript, so nearly all of us can use it (no doofy Window plugin req'd!)
What's stupid is the Discover Card [discovercard.com] method. They have a "disposable card number" feature, but it requires a really heinous install procedure, plus it does annoying things like create a bookmark for their site in every browser user's bookmarks file (thanks guys!). But wait, theres more! If you want to use this feature, you have to shop within a small number of stores (and i mean small, like ~50 the last time i checked).
Bottom line, disposable credit card technology is great - i've used these disposable numbers for over 6 months, and i'm totally sold on the idea. Now when i purchase something on the web, my Amex number can only be used that one time, after which it is completely invalid for charges. I'll be glad to see all Visa and MC companies follow this someday.
Seen the amihotornot All Your Base [amiallyourbaseornot.com] site yet?
How secure are Paypal and Billpoint? (Score:2)
Why can't the credit/debit card companies do this on their own for non-auction site purchases? If I want something from www.everythingforcomputers.com (or whoever), and they already are set up to take Discover or VISA or Diner's Club or whoever, instead of giving them my credit card number (or a stolen one if I were trying to defraud them), why can't I tell them to bill my name at the card company, go to the card company's site and authorize the payment, and they transfer payment to the merchant? With all the money the credit card companies can save by preventing fraudulent use they should be able to more than afford the people and equipment for this and plenty of incentive for security because they'll be the ones who have to suffer the losses.
Are the credit card companies avoiding shouldering this burden on purpose? If one of them went ahead with it, would the rest have to follow suit for competitive reasons?
Re:The Big Breach (Score:2)
A minor issue? The author must be on some super drugs. The reasoning for these new advances in credit card protection schemes is for these minor issues else they wouldn't worry about it altogether.
A nitpick, but I believe the author's point is that consumers don't need to worry about the cost of someone stealing their card. Banks, on the other hand, are worried about it since they pick up the tab. They push for any technology that can cut down on fraud, thereby saving them money.
Re:Another option w/caveat (Score:2)
...pick up the phone or visit the store.. (Score:2)
I'd buy software online or a book that I knew I wanted, or cdroms, but even cdroms I can go to tower and hear some of them to see if I want the cd in the first place.
I think that this will satisfy some people, but not everyone, and not for everything. I like to buy my groceries in the store, so I know that my bnananas are fresh.
I don't want a lot, I just want it all!
Flame away, I have a hose!
Similar systems are around (Score:2)
I know merchants weren't overly fond of it either. One of the most effective ways of keeping out customers they didn't want was to block by number. With anonymous number systems like this they have to block by name/address which is much less of a hassle to get around because the automated filtering isn't as good. This also affects all of those discounts for "first time" customers which are usually tracked by CC#.
Number Ranges... (Score:2)
I know that as it stands, the range of numbers available is so ridiculously wide that you can't realistically guess a credit card number, but will that stay the same if the average person maybe chews through 40-50 CCN's a year?
Re:Algorithms (Score:2)
The algorithm for credit card numbers is not a secret. You can determine if a card number is potentially correct yourself, but you need to contact the credit card company to ensure that a number is correct (and that they have enough money to cover their charge).
Re:One-click shopping sites (Score:2)
<img src="http://www.amazon.com/cgi/oneclick.cgi?book=d ianetics&confirm=no&details=usecookie">
Re:An Alternative (Score:2)
Some smart-card proponents says that doing the encryption in software (rather than on the card) would leave the system open to viruses and trojans, which could draw money from your account/reveal personal details. However, if you think about it, this argument doesn't stand. Even if you have a card reader, with a card that does encryption in hardware, you are still vulnerable to Virii/Trojans, the only difference would be that the Virus/Trojan would attack the clear stream from the keyboard to the card reader instead. And unless you do everything using a small keypad directly attached to the card reader, this vulnerability will stay.
Automatic payment (Score:3)
I think this is a good thing. I've given up on automatic payments because my cell phone provider (name not mentioned to protect the guilty) double-charged me last January, and it took nearly 2 months and about 10 support calls to get the darned thing fixed.
I now believe that any "automatic" payment makes it too easy for a company to screw you over, either intentionally or through a glitch (which my case apparently was). No thanks - send me the invoice and I'll pay it manually from now on. Having the credit card number being one-time only would enforce that much better, because now they can't even have a working number for me on file.
I couldn't believe that they had the gall to ask me several times if I wanted to re-enable the automated payments again.
The Big Breach (Score:3)
A minor issue? The author must be on some super drugs. The reasoning for these new advances in credit card protection schemes is for these minor issues else they wouldn't worry about it altogether.
Regardless if they have to pay any fees at all, someone has still gotten ahold of their information, and depending on the criminal intelligence behind the person who has gotten ahold of the credit card number, they can escalate to identity theft, which has a big market. Even with thieves stealing information from insecure websites, its an unheard of issue of credit card companies going after the website which was breached. Little is done to sites who don't secure their systems from the possibility of a breach, and they should be held somewhat responsible for the integrity of their data.
This is still a problem as if a "cracker" has somehow gotten ahold of any kind of information on a person, they can leverage this to enter their own username and password to get a "one time" number". What would be nice, is if some of the credit card companies would pre-issue about 20 numbers per month with a 30 day period before their deleted. This was nothing is transferred over the wire and even a temp number can't be generated.
Well what about the crackers who go the full route to get all of a person's information including the password? I guess all these concepts go right down the drain.
Anyways...
The Big Breach [antioffline.com] -- Richard Tomlinson (ex MI6 agent)
Security through obscurity . . . (Score:3)
Of course, the back-end (credit card companies) are still responsible for the true security implementation, but they're very very good at that. An example of how paranoid they are: when consultants for my company go on-site at our credit-card vendor customers, they literally have to stand behind the certified operator and tell them what keys to press. No one touches their machines without passing internal security certification procedures.
Direct Authorization and other ideas (Score:2)
Another idea, would be to have a hardware device that reads your card (prevents your kids from one-clicking) and then handles the encryption algorithm in hardware. The idea here being that there is no trace of your credit-card info on your computer. Maybe we should call it 1-swipe shopping. Oh, this thing would connect via the USB port.
Here's how mine works (Score:2)
You download a strange little Flash program, which sits in the task bar. This program lets you create new credit card accounts. You determine how much the limit on those accounts is, and how long they will last (expiration date). The Flash applet then keeps track of those numbers.
This solves a number of problems talked about here - it keeps track of the numbers for you, and they will last as long as you want (for recurring billing). And, if someone grabs the number, there is a very low limit on how much they can charge from it. You can even drag and drop the number from the applet.
The number is a standard CC#, 16 digits, with check digits. My experience so far has been that the numbers do not authorize very well (that is, I created a number, tried to charge something on it, and it came back as a bad number).
Anyhow, it would be nice if it worked right, because it doesn't need any special new card or other junk, just a computer.
Why, yes I have; details follow... (Score:5)
A heavy package arrived on my doorstep, containing a suspicious item wrapped in lead. After peeling back the lead, I realized it was the new Blue Amex card! I figured that I may as well test out theses enhanced security features, so I went to a porn site to sign up for a trial memberhip using a disposable card number.
You may be wondering how you get the card number, and I wondered this myself, until I ran my thumb over the smart chip, and magicly it sprung to life! It scaned my thumbprint, and then out came a holographic image of a terminal, displaying the creation of the random credit card number! Apparently, it checks the position of the moon in it's orbit to form a 32-bit variable. After determining the variable, it checks the temperature of the room, distance above sea level, and speed of sound in the current atmosphere, and calculates a string that is multiplied by the old variable. The resulting number is then plotted according to y=sin(x), and numbers are chosen from 16 points on the graph. The sines are then inverted and strung together to finally form the elusive random credit card number!
Or something like that.
--
Re:Isn't this a lot of overhead? (Score:2)
Or how much will they save? Credit fraud costs CC co's millions (billions?) yearly, well worth the price of some servers.
This also doesn't exactly solve the problem... if I have a one-retailer use card set up for Amazon.com, someone can still steal that and buy stuff in my name from Amazon...
I suppose they could, unless you set up your Amazon account to only allow shipping to your address. And to take that one step further to change your address you would have to log in, have them send you a mail to an address they have on file, and reply to it. Then the thief would not only need your CC# but your email password as well.
I suppose we could go back and forth with this all day; for every action there is an opposite reaction. Criminals will always try to stay one step ahead.
"Everything that can be invented has been invented."
Re:I use 'em (Score:2)
Re:One-click shopping sites (Score:2)
They are required to keep original sales drafts in order to process chargebacks. A number of other consumer protection laws also require the retaining of customer information, including cc numbers.
Another option w/caveat (Score:2)
When a credit card number is stolen, the cardholder is only responsible for the first $50.00 of fraudulent charges.
When a debit card number is stolen, the thief can drain the account (whatever the balance is) and you have little hope of getting any of it back.
Sounds like a credit card is the way to go, right? Well, generally I would say yes, but how about those whose credit is poor or don't want to pay interest charges and fees?
Here's how I work it. I know that my checking account tied to the debit card is vulnerable so I don't keep very much in it - only what I can afford to lose if I am defrauded. When I need to make a purchase online, I first go to my online banking site and transfer the amount I need for the online purchase and then use the debit card for the purchase. Money goes in, money goes out, the balance stays low.
If someone compromises the database containing my debit card number they will only get $100.00 or less and I can close that checking account and start a new one tied to a new debit card number. No fighting with the bank or a vendor about unauthorized charges, I take my licks and get out. Sure, I might lose a little more than the $50.00, but to avoid the hassles it's worth it. I can only lose what's in that account so I keep it low and keep my exposure low.
The two accounts are completely separate. I have no checks to use with the debit card account and no debit card tied to the account I use to write checks. This doesn't fully protect me from identity theft, but makes it tougher on the thief.
Re:AmEx has offered this for a few months now (Score:2)
So, since I used a one-time number from AMEX, I logged into their web site and canceled that number. This means if that site decided to try again or use it, they couldn't and it would be denied for real this time.
Re:Number Ranges... (Score:2)
AmEx has offered this for a few months now (Score:5)
Re:Number Ranges... (Score:2)
Hard to tell, considering that AMEX uses 15 digits, not 16.