Hacker Chronicles 1/HACKER1.ISO/miscpub1/hu3.txt

Text File | 1992-09-26 | 17KB | 293 lines

===============================================================================
                   Basic Information About Credit Cards
===============================================================================

     There are at least three types of security devices on credit cards that
you aren't supposed to know about.  They are the account number, the signature
panel, and the magnetic strip.


  The Account Number
  ------------------
     A Social Security card has nine digits.  So do two-part Zip codes.
A domestic phone number, including area code, has ten digits.  Yet a
complete MasterCard number has twenty digits.  Why so many?
     It is not mathematically necessary for any credit-card account number
to have more than eight digits.  Each cardholder must, of course, have a
unique number.  Visa and MasterCard are estimated to have about sixty-five
million cardholders each.  Thus their numbering systems must have at least
sixty-five million available numbers.
     There are one hundred million possible conbinations of eight digits--
00000000, 00000001, 00000002, 00000003, all the way up to 99999999. So
eight digits would be enough.  To allow for future growth, an issuer the
size of Visa of MaserCard could opt for nine digits---enough for a billion
differnt numbers.
      In fact, a Visa card has thirteen digits and sometimes more.  An
American Express card has fifteen digits.  Diners Club cards have fourteen.
Carte Blanche has ten.  Obviously, the card issuers are not projecting
that they will have billions and billions of cardholders and need those
digits to ensure a different number for each.  The extra digits are actually
a security device.
     Say your Visa number is 4211 503 417 268.  Each purchase must be
entered into a computer from a sales slip.  The account number tags the
purchase to your account.  The persons who enter account numbers into
computers get bored and sometimes make mistakes.  They might enter
4211 503 471 268 or 4211 703 417 268 instead.
     The advantage of the thirteen-digit numbering system is that it is
unlikely any Visa cardholder has 4211 503 471 268 or 4211 703 417 268
for an account number.  There are 10 trillion possible thirteen-digit
Visa numbers (0000 000 000 000;0000 000 000 0001;... 9999 999 999 999).
Only about sixty-five million of those numbers are numbers of actual
active accounts.  The odds that an incorrectly entered number would
correspond to a real number are something like sixty-five million in
ten trillion, or about one in one hundred and fifty thousand.
     Those are slim odds.  You could fill up a book the size of this one
{note, book is 228 pgs long} with random thirteen-digit numbers such as
these:

                     3901 160 943 791
                     1090 734 231 410
                     1783 205 995 561
                     9542 425 195 969
                     2358 862 307 845
                     9940 880 814 778
                     8421 456 150 662
                     9910 441 036 483
                     3167 186 869 267
                     6081 132 670 781
                     1228 190 300 350
                     4563 351 105 207

Still you would not duplicate a Visa account number.  Whenever an account
number is entered incorrectly, iw will almose certainly fail to match up
with any of the other account nubmers in the computer's memory.  The
computer can then request that the number be entered again.
     Other card-numbering systems are even more secure.  Of the quadrillion
possible fifteen-digit American Express card numbers, only about 11 million
are assigned.  The chance of a random number happening to correspond to an
existing account number is about one in ninety million.  Taking into account
all twenty digits on a MasterCard, there are one hundred quintillion
(100,000,000,000,000,000,000) possible numvers for sixy-five million card-
holders.  The chance of a random string of digits matching a real MasterCard
number is about one in one and a half trillion.
     Among other things, this makes possible those television ads inviting
holders of credit cards to phone in to order merchandise.  The operators
who take the calls never see the callers' cards nor their signatures.
How can they be sure the callers even have credit cards?
    They base their confidence on the security of the credit-card numbering
systems.  If someone calls in and makes up a creditcard number--even being
careful to get the right number of digits--the number surely will not be
an existing real credit-card number.  The deception can be spotted instantly
by plugging into the credit-card company's computers.  For all practical
purposes, the only way to come up with a genuine credit-card number is to
read it off a credit card.  The number, not the piece of plastic, is
enough.


  Neiman-Marcus' Garbage Can
  --------------------------
The converse of this is the fact that anyone who knows someone else's card
number can charge to that person's account.  Police sources say this is a
major problem, but card issuers, by and large, do their best to keep these
crimes a secret.  The fear is that publicizing the crimes may tempt more
people to commit them.  Worse yet, there is alomost nothing the average
person can do to prevent being victimized {muhaha} -- short of giving up
credit cards entirely.
     Lots of strangers know your credit-card numbers.  Everyone you hand
a card to--waiters, sales clerks, ticket agents, hairdressers, gas station
attendants, hotel cashiers--sees the account number.  Every time a card is
put in an imprinter, three copies are made, and two are left with the clerk.
If you charge anything by phone or mail order, someone somewhere sees the
number.
     Crooks don't have to be in a job with normal access to creditcard numbers.
Occasional operations have discovered that the garbage cans outside prestige
department or specialty stores are sources of high-credit-limit account
numbers.  The crooks look for the discarded carbon paper from sales slips.
The account number is usually legible--as are the expiration date, name,
and signature.  (A 1981 operation used carbons from Koontz Hardware, a
West Hollywood, California, store frequented by many celebrities.)
     Converting a number into cash is less risky than using a stolen
credit card.  The crook need only call an airline, posing as the cardholder,
and make a reservation on a heavily traveled flight.  He usually requests
that tickets be issued in someone else's name for pickup at the airport
(airlines don't always ask for ID on ticket pickups, but the crook has it
if needed) and is set.  The tickets can be sold at a discount on the hot-
ticket market operating in every major airport.
     There are other methods as well.  Anyone with a Visa or MasterCard
merchant account can fill out invoices for nonexistent sales and submit
them to the bank.  As long as the account numbers and names are genuine,
the bank will pay the merchant immediately.
     For an investment of about a thousand dollars, an organized criminal
operation can get the pressing machines needed to make counterfeit credit
cards.  Counterfeiting credit cards in relatively simple.  There are no
fancy scrolls and filigree work, just blocky logos in primary colors.
From the criminal's standpoint, the main advantage of a counterfeit card
is that it allows him to get cash advances.  For maximum plundering of a
line of credit, the crook must know the credit limit as well as the account
number.  To learn both, he often calls an intended victim, posing as the
victim's bank:

      CROOK:  This is Bank of America.  We're calling to tell you that the
              credit limit on your Visa card has been raised to twelve
              hundred dollars.
      VICTIM: But my limit has always been ten thousand dollars.
      CROOK:  There must be some problem with the computers. Do you have
              your card handy?  Could you read off the embossed number?


     On a smaller scale, many struggling rock groups have discovered the
knack of using someone else's telephone company credit card.  When a
cardholder wants to make a long-distance call from a hotel or pay phone,
he or she reads the card number to the operator.  The call is then billed
to the cardholder's home phone.  Musicians on tour sometimes wait by the
special credit-card-and-collect-calls-only booths at airports and jot
down a few credit card numbers.  In this way, unsuspecting businesspeople
finance a touring act's calls to friends at home.  If the musicians call
from public phones, use a given card number only once, and don't stay
in one city long, the phone company seems helpless to stop them.
     What makes all of these scams so hard to combat is the lead
time afforded the criminal.  Theft of a credit card--a crime that
card issuers will talk about--is generally reported immediately.
Within twenty-four hours, a stolen card's number is on the issuer's
"hot list" and can no longer be used.  But when only a card number is
being used illicitly, the crime is not discovered until the
cardholder recieves his first inflated bill.  That's at least two
weeks later; it could be as much as six weeks later.  As long as the
illicit user isn't too greedy, he has at least two weeks to tap into
a credit line with little risk.


  The Signature Panel
  -------------------
     You're now supposed to erase the signature panel, of course.  Card
issuers fear that crooks might erase the signature on a stolen credit
card and replace it with their own.  To make alteration more difficult,
many card signature panels have a background design that rubs off if
anyone tries to erase.  There's the "fingerprint" design on the American
Express panel, repeated Visa or MasterCard logos on some bank cards, and the
"Safesig" desgn on others.  The principle is the same as with the security
paper used for checks.  If you try to earse a check on security paper, the
wavy-line pattern erases, leaving a white area-- and it is obvious that the
check has been altered.
     Rumors hint of a more elaborate gimmick in credit-card panels.
It is said that if you erase the panel, a secret word--VOID--appears
to prevent use of the card.  To test this rumor, fifteen common credit
cards were sacrificed.
     An ordinary pen eraser will erase credit-card signature panels, if
slowly.  The panels are more easily removed with a cloth and a dry-cleaning
fluid such as Energine.  This method dissolves the panels cleanly.  Of the
fifteen cards tested, six had nothing under the panel(other than a
continuation of the card back design, where there was one).  Nine cards
tested had the word "VOID" under the panel.  In all cases, the VOIDs
were printeed small and repeated many times under the panel. The breakdown:

                 Void Device           Nothing
             --------------------------------------
               Bloomingdale's         American Express Gold Card
               Bonwit Teller          Broadway
               Bullock's              MasterCard(Citibank)
               Chase Convenience B.C. Neiman-Marcus
               I. Magnin              Robinson's
               Joseph Magnin          Saks Fifth Avenue
               First Interstate B.C.
               Montgomery Ward
               Visa (Chase Manhattan)


When held to a strond light, the VOIDs were visible through the Blooming-
dales's card even without removing the panel.
     The VOID device isn't foolproof.  Any crimianl who learns the secret
will simply refrain from trying to earse the signature.  Most salesclerks
don't bother to check signatures anyway.
    Moreover, it is possible to paint the signature panel back in, over
the VOIDs--at least on those cards that do not have a design on the
panel. (Saks' panel is a greenish-tan khaki coler that would be difficult
to match with paint.)  The panel is first removed with dry-cleaning fluid.
The back of the card is covered with masking tape, leaving a window where
the replacement panel is to go.  A thin coat of flat white spray paint
simulates the original panel.


  The Magnetic Strip
  ------------------

     The other security device on the back of the card, the brown magnetic
strip, is more difficult to analyze.  Some people think there are sundry
personal details about the cardholder stored in the strip.  But the
strip has no more information capacitythan a similar snippet of recording tape.
For the most part banks are reticent about the strip.

     The strip need not contain any information other than the account
number or similar indentification.  Any futher information needed to
complete an automatic-teller transaction-- such as current account
balances--can be called up from bank computers and need not be encoded
in the strip.
     Evidently, the card expiration date is in the strip.  Expired cards
are "eaten" by automatic-teller machines even when the expired card has
the same account number and name as its valid replacement card.  Credit
limit, address, phone number, employer, etc, must not be indicated in
this strip, for banks do not issue new cards just because this info changes.
     It is not clear if the personal identification number is in the strip
or called up from the bank computer.  Many automatic-teller machines have
a secret limit of three attempts for provideing the correct personal
identification nubmer.  After three wround attempts, the "customer" is
assumed to be a crook with a stolen card, going through all possible
permutations--and the card is eaten.
     It is possible to scramble the information in the strip by rubbing
a pocket magnet over it.  Workers in hspitals or research facilites with
large electromagnets sometimes find that their cards no longer work in
automatic-teller machines. (If you try to use a magnetically doctored
card, you usually get a message to the effect, "Your card may be inserted
incorrectly. Please remove and insert according to the diagram.")


  The Bloomingdale's Color Code
  -----------------------------
     Only in a few cases does the color of a credit card mean anything.
There are, of course, the American Express, Visa, and MasterCard gold
cards for preferred customers.  The Air Travel Card comes in red and green, of
which green is better. (With red, you can charge tickets for travel within
North America only.)  The most elaborate color scheme, and a source of some
confusion to status-conscious queues, is that of Bloomingdale's credit
department, here is how it works: Low color in the pecking order is blue,
issued to Bloomingdale employees as a perk in their compensation packages.  The
basic Bloomingdale card is yellow.  Like most department store cards, it can be
used to spread payments over several months with the payment of a finance
charge.  The red card gives holders three months' free interest and is issued
to customers who regularly make large purchases.  The silver card is good for
unlimited spending, but as with a travel and entertainment card, all charges
must be paid in thirty days.  The gold card offers the same payment options as
the yellow card but is reserved for the store's biggest spenders.


                           The   End
 ---------------------------------------------------------------------------
Comments and Acknowledgements-

  The above has been copied from "Big Secrets" WITHOUT permission.
   Big Secrets is written by Willian Poundstone. This is a great
   book that tells you hundreds of things you weren't suppose to
   find out about.  The above artical, was only 5 pages out of
   a book 288 pages long!  He also has a new book out called
   "Bigger Secrets", which is also good. You can find both at
   almost anybook store, they should be able to special order it.

      Well it's now midnight, and i'm getting tried... so I hope
   you have enjoyed this artical, if you wanna talk to me I'm
   on many boards all over the country. Well later, i'm gonna go
   watch Star Trek the Next Generation...

          The above was written by
             The
                /\/\idnight
                     Caller

       a.k.a.
      Pizzia Man





Downloaded From P-80 International Information Systems 304-744-2253 12yrs+