RE: Catching bogus credit card numbers
Already done 8^). Thanks Tom. -- Mosh Teitelbaum evoch, LLC Tel: (301) 942-5378 Fax: (301) 933-3651 Email: [EMAIL PROTECTED] WWW: http://www.evoch.com/ > -Original Message- > From: Thomas Chiverton [mailto:[EMAIL PROTECTED] > Sent: Wednesday, April 19, 2006 5:39 AM > To: CF-Talk > Subject: Re: Catching bogus credit card numbers > > > On Monday 17 April 2006 21:04, Mosh Teitelbaum wrote: > > To date, the few fake numbers that have gone through have been among the > > commonly-known numbers. Hopefully, this will cut down on a > little bit of > > frustration for the client. > > Why not add a feature so the client can press a button to have the number > blocked from future use, then check that list of numbers when the user > submits an order. > Self-service is good :-) > > -- > > Tom Chiverton > Advanced ColdFusion Programmer > > ~| Message: http://www.houseoffusion.com/lists.cfm/link=i:4:238381 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
Re: Catching bogus credit card numbers
On Monday 17 April 2006 21:04, Mosh Teitelbaum wrote: > To date, the few fake numbers that have gone through have been among the > commonly-known numbers. Hopefully, this will cut down on a little bit of > frustration for the client. Why not add a feature so the client can press a button to have the number blocked from future use, then check that list of numbers when the user submits an order. Self-service is good :-) -- Tom Chiverton Advanced ColdFusion Programmer ~| Message: http://www.houseoffusion.com/lists.cfm/link=i:4:238065 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
Re: Catching bogus credit card numbers
>Al: > >I know this isn't fool-proof. No where near it. This is more to stop >pranksters than actual thieves. The merchandise isn't sent out until the >payment is approved anyway. It's more to save the client the hassle of >having to bother with commonly used (and easily found) fake numbers. > >To date, the few fake numbers that have gone through have been among the >commonly-known numbers. Hopefully, this will cut down on a little bit of >frustration for the client. > >Thanks. Here's a thought: Even though the client doesn't want to actually complete the transaction online, it IS still possible to take the CC info entered and check it for validity (making sure CC number ,address, name, expiration date, etc. are all truly valid) using the client's merchant account. I did some development using Verisign's Payflow Pro a couple of years ago for a client, and I distinctly remember that one of the "actions" available in the API was a validation action that did nothing more than validate the information provided, returning a 'valid' or 'invalid' string. Whatever merchant account is being utilized by the client, perhaps they have a secure web service that could be used in this manner for pre-processing purposes? ~| Message: http://www.houseoffusion.com/lists.cfm/link=i:4:238041 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
RE: Catching bogus credit card numbers
Al: I know this isn't fool-proof. No where near it. This is more to stop pranksters than actual thieves. The merchandise isn't sent out until the payment is approved anyway. It's more to save the client the hassle of having to bother with commonly used (and easily found) fake numbers. To date, the few fake numbers that have gone through have been among the commonly-known numbers. Hopefully, this will cut down on a little bit of frustration for the client. Thanks. -- Mosh Teitelbaum evoch, LLC Tel: (301) 942-5378 Fax: (301) 933-3651 Email: [EMAIL PROTECTED] WWW: http://www.evoch.com/ > -Original Message- > From: Everett, Al (NIH/NIGMS) [C] [mailto:[EMAIL PROTECTED] > Sent: Monday, April 17, 2006 2:00 PM > To: CF-Talk > Subject: RE: Catching bogus credit card numbers > > > I don't really know how you're going to do that. Sure, there's a handful > of test numbers that I know off the top of my head (4111 for > instance) but anyone who has any understanding of the algorithm can make > up any number they like. Heck, a couple years ago I created an Excel > file that would generate as many fake credit card numbers you wanted. > (We needed a bunch of unique invalid numbers that would pass the Luhn > test.) > > > -Original Message- > From: Mosh Teitelbaum [mailto:[EMAIL PROTECTED] > Sent: Monday, April 17, 2006 1:13 PM > To: CF-Talk > Subject: RE: Catching bogus credit card numbers > > Thanks Dave. > > Actually, this client's site is setup to not authorize the orders > online. > They prefer to manually authorize them. Once they ship the number to > the authorizer, it gets rejected (so Authorize.net or whomever are doing > their job). But because they don't want the authorization to happen > online, the credit card number passes the LUHN check and gets passed on > for processing. > They'd like to catch these bogus orders before they get passed on. > > Again, thanks. > > -- > Mosh Teitelbaum > evoch, LLC > Tel: (301) 942-5378 > Fax: (301) 933-3651 > Email: [EMAIL PROTECTED] > WWW: http://www.evoch.com/ > > > > -Original Message- > > From: Dave Carabetta [mailto:[EMAIL PROTECTED] > > Sent: Monday, April 17, 2006 12:44 PM > > To: CF-Talk > > Subject: Re: Catching bogus credit card numbers > > > > > > On 4/17/06, Mosh Teitelbaum <[EMAIL PROTECTED]> wrote: > > > All: > > > > > > Does anyone have or know of a list of bogus credit card numbers > > that pass > > > the LUHN test? Specifically, I'm looking for a list of "test" > > credit card > > > numbers that are never actually associated with a valid credit > > card but are > > > often used when testing new credit card services. For example, > > > "5105105105105100" for MasterCard. > > > > > > A client has been receiving online orders using the above > > credit card number > > > and would like to have these bogus orders removed automatically. > > > > > > > http://www.verisign.com/support/payflow/manager/selfHelp/testCardNum.h > > tml > > > > That being said, any credit card processor in "production" mode should > > > automatically be rejecting these numbers anyway. If not, switch > > vendors. That's awful security. > > > > Regards, > > Dave. > > > > > > > > ~| Message: http://www.houseoffusion.com/lists.cfm/link=i:4:237945 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
RE: Catching bogus credit card numbers
I don't really know how you're going to do that. Sure, there's a handful of test numbers that I know off the top of my head (4111 for instance) but anyone who has any understanding of the algorithm can make up any number they like. Heck, a couple years ago I created an Excel file that would generate as many fake credit card numbers you wanted. (We needed a bunch of unique invalid numbers that would pass the Luhn test.) -Original Message- From: Mosh Teitelbaum [mailto:[EMAIL PROTECTED] Sent: Monday, April 17, 2006 1:13 PM To: CF-Talk Subject: RE: Catching bogus credit card numbers Thanks Dave. Actually, this client's site is setup to not authorize the orders online. They prefer to manually authorize them. Once they ship the number to the authorizer, it gets rejected (so Authorize.net or whomever are doing their job). But because they don't want the authorization to happen online, the credit card number passes the LUHN check and gets passed on for processing. They'd like to catch these bogus orders before they get passed on. Again, thanks. -- Mosh Teitelbaum evoch, LLC Tel: (301) 942-5378 Fax: (301) 933-3651 Email: [EMAIL PROTECTED] WWW: http://www.evoch.com/ > -Original Message- > From: Dave Carabetta [mailto:[EMAIL PROTECTED] > Sent: Monday, April 17, 2006 12:44 PM > To: CF-Talk > Subject: Re: Catching bogus credit card numbers > > > On 4/17/06, Mosh Teitelbaum <[EMAIL PROTECTED]> wrote: > > All: > > > > Does anyone have or know of a list of bogus credit card numbers > that pass > > the LUHN test? Specifically, I'm looking for a list of "test" > credit card > > numbers that are never actually associated with a valid credit > card but are > > often used when testing new credit card services. For example, > > "5105105105105100" for MasterCard. > > > > A client has been receiving online orders using the above > credit card number > > and would like to have these bogus orders removed automatically. > > > > http://www.verisign.com/support/payflow/manager/selfHelp/testCardNum.h > tml > > That being said, any credit card processor in "production" mode should > automatically be rejecting these numbers anyway. If not, switch > vendors. That's awful security. > > Regards, > Dave. > > ~| Message: http://www.houseoffusion.com/lists.cfm/link=i:4:237931 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
RE: Catching bogus credit card numbers
Thanks Dave. Actually, this client's site is setup to not authorize the orders online. They prefer to manually authorize them. Once they ship the number to the authorizer, it gets rejected (so Authorize.net or whomever are doing their job). But because they don't want the authorization to happen online, the credit card number passes the LUHN check and gets passed on for processing. They'd like to catch these bogus orders before they get passed on. Again, thanks. -- Mosh Teitelbaum evoch, LLC Tel: (301) 942-5378 Fax: (301) 933-3651 Email: [EMAIL PROTECTED] WWW: http://www.evoch.com/ > -Original Message- > From: Dave Carabetta [mailto:[EMAIL PROTECTED] > Sent: Monday, April 17, 2006 12:44 PM > To: CF-Talk > Subject: Re: Catching bogus credit card numbers > > > On 4/17/06, Mosh Teitelbaum <[EMAIL PROTECTED]> wrote: > > All: > > > > Does anyone have or know of a list of bogus credit card numbers > that pass > > the LUHN test? Specifically, I'm looking for a list of "test" > credit card > > numbers that are never actually associated with a valid credit > card but are > > often used when testing new credit card services. For example, > > "5105105105105100" for MasterCard. > > > > A client has been receiving online orders using the above > credit card number > > and would like to have these bogus orders removed automatically. > > > > http://www.verisign.com/support/payflow/manager/selfHelp/testCardNum.html > > That being said, any credit card processor in "production" mode should > automatically be rejecting these numbers anyway. If not, switch > vendors. That's awful security. > > Regards, > Dave. > > ~| Message: http://www.houseoffusion.com/lists.cfm/link=i:4:237924 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
Re: Catching bogus credit card numbers
We authorize the transaction at the time the order is placed using a service called Authorize.net http://www.authorize.net/ This would solve your problem b/c those transactions would be rejected and the user would receive an "Invalid credit card number" error message. On 4/17/06, Mosh Teitelbaum <[EMAIL PROTECTED]> wrote: > All: > > Does anyone have or know of a list of bogus credit card numbers that pass > the LUHN test? Specifically, I'm looking for a list of "test" credit card > numbers that are never actually associated with a valid credit card but are > often used when testing new credit card services. For example, > "5105105105105100" for MasterCard. > > A client has been receiving online orders using the above credit card number > and would like to have these bogus orders removed automatically. > > TIA > > -- > Mosh Teitelbaum > evoch, LLC > Tel: (301) 942-5378 > Fax: (301) 933-3651 > Email: [EMAIL PROTECTED] > WWW: http://www.evoch.com/ > > > > > ~| Message: http://www.houseoffusion.com/lists.cfm/link=i:4:237923 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
Re: Catching bogus credit card numbers
On 4/17/06, Mosh Teitelbaum <[EMAIL PROTECTED]> wrote: > All: > > Does anyone have or know of a list of bogus credit card numbers that pass > the LUHN test? Specifically, I'm looking for a list of "test" credit card > numbers that are never actually associated with a valid credit card but are > often used when testing new credit card services. For example, > "5105105105105100" for MasterCard. > > A client has been receiving online orders using the above credit card number > and would like to have these bogus orders removed automatically. > http://www.verisign.com/support/payflow/manager/selfHelp/testCardNum.html That being said, any credit card processor in "production" mode should automatically be rejecting these numbers anyway. If not, switch vendors. That's awful security. Regards, Dave. ~| Message: http://www.houseoffusion.com/lists.cfm/link=i:4:237922 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
