20,000 stolen-card guesses a minute, invisible to every merchant

transcript

A bot is guessing card numbers. 20,000 tries a minute. And not one merchant notices.

Tiny 1 dollar online payments. Guessing numbers, expiry dates, security codes. About 20,000 a minute. Spread across thousands of online merchants. Each merchant sees a trickle. And every attempt uses a different IP. The cards that pass? Used for real fraud later.

Rate-limit per IP? Useless. Every attempt has a new one. Per-card velocity limits, then? Here's the catch. Each guessed number is tried only once or twice. So no single card ever looks busy.

Each merchant sees a trickle. But the network sees every merchant and every issuer. Count per BIN range, per merchant, per device fingerprint. Wrong-expiry and wrong-code declines spike. There's the bot.

Step up to 3-D Secure on those BIN ranges. Online only. Flag the merchants getting the burst. Tell issuers which cards passed. Those numbers now work. Shoppers paying in person never notice a thing.

Velocity needs a key the attacker reuses. Not the card. The BIN range, the merchants, the devices.

Full breakdown in the lecture.