However, I feel that low-tech and primitive methods such as the one described here are being overlooked. In this attack the criminal doesn’t need a magstripe skimmer. All he/she needs is the merchant receipt and have a look at the 3 digit security code on the victims CC.

Even worse, some websites don’t even ask for the security code when purchasing items. I just bought flowers for my mom on a site of a company from Spain and I only had to enter the CC# and expiry date!

question: does the 100% dispute policy also apply to e-commerce sites, or only physical merchants?

Method you just mention is way too old. Its been happening for years now. I have also seen cases where you can buy pack of 100 credit card numbers along with expiry and credit verification number for $5.

Visa and Master card has 100% dispute policy. In which merchant is held liable for not verifiying the owner and providing the service.

I have also seen cases where camera is fixed on the top of the roof which is recording your pin while you punching it on POS terminal.

Cheers

Shoaib

I’d be very happy if you posted more details on the attacks you’re mentioning such as “VBV bypass via wu”.

@NIX – no, it *doesn’t* make me pay with cash instead, but it DOES make me insert my CC in the POS terminal on my own, as opposed to letting the waiter do it for me ;-D

shining – remember the common “deliver to address different to billing address” option. Think of how many shitty online retailers there are out there where many of the basic security mechanisms (ie.: AVS) do not apply.
If I remember correctly the _minimum_ data required to perform a CC transaction is the CC number and the expiry date. This doesn’t only apply to online transactions, but also to MOTO (mail order telephone order).

The goal of banks etc is not to make it 100% secure as this becomes an unfeasibly expensive pipe dream, the goal is to make it secure enough that the losses are negligble in the banks eyes, the banks do not care how much time or effort it costs you to get your money back.

Regardless of the method used people will find a way round it, money is a great incentive. I often wonder how many blackhats are ‘paid’ for their work as opposed to doing it just because they can, and how many there are versus the number of white(maybe slightly grubby) hats.