4 school kids in France have been captured after stinging businesses on the Internet in 250,000 Euros. This is not the biggest story, the real story is that everybody can do that in 30 million and nobody can do anything to him/her and the credit card companies will not bother to fix this hole.
The credit cards companies exists since the 70's, their systems are that old and all the changes in the technology that appears in the last 35 years didn't change the way they work. Why would they spend money on security where they are defended by courts ? And they have the money to sue any poor businessmen that have been stung. But the truth is that they can loose everything is someone will have the guts to do it and here it how it goes:
The credit cards companies generate credit cards numbers using a special mathematical algorithm that hadn't changed for years and known to the public for at least 12 years. As the issuers of the credit cards are just franchises there is no collective database of existing credit cards and one franchise (BNP Paribas, CIC, etc.. for example) will not expose his customer lists to the others.
The result is that credit card deal are being confirmed by two ways: 1. If they suit the Algorithm 2. If they are not black listed (reported stolen or empty bank account.
On the Internet you can find credit card generation programs, these programs will generate a credit card using the same algorithm as the credit cards franchises use. This generated numbers will be confirmed as long as they are not black listed even if they do not exist at all !!
The laws support the credit cards company and put all the blame on the business owners, and thousands of them had to suffer frauds and closed their businesses because of this. The courts all over the world claims that the business owner has the ability to confirm the person behind the credit card, of course this is bullshit , only the issuer can do that, but the law is always on the side of the money.
So…
Lets set up a registered legal business that sell fresh air from France.
Lets buy envelopes and stamps, register the company legally, build a website and… accept credit cards.
We better have a partner or two that will keep on feeling orders based on real people name but with generated credit cards. We will receive the orders, send the envelopes with the fresh air from France. Every envelope costs 50 Euro.
We will go to the post office and send the envelopes to the American/English/Whatever addresses. We will pay taxes legally, we will keep the orders and the invoices as well as the proof we have shipped the products and we will keep half of the money in the bank…
A credit card that was generated and approved can either belong to someone that may later claim he didn't order air from France (and we will have the money to pay the credit card company back) or as we said it may not exist at all. In this case the credit card company have a problem. They approved the credit card deal and there is nobody that will say “I didn't purchase it” ! Which means they have no legal claim.
If the police or private investigator will arrive you will have all the proofs needed (Order, credit card approval, and shipment proof) you have paid the taxes and you manage a perfectly legal company.
The legitimate refund request will be handled and you will be perfectly capable of taking the rest to your pocket.
Another funny point, due to the bureaucracy it takes the credit card company 3-10 months to identify a problem. This is the perfect scum, and nobody can claim anything against you (as long as they do not capture you partner which supposed to stay in a different country and use wireless Internet access and jump from one coffee shop to another.
The truth is that I will not be surprise if it will happen and I will not cry for the credit cards companies, I was one of the business owners that were hit in court by them, The research I made brought me to this scenario which they ignores… They probably have insurance against it, until the insurance companies will understand the extent of the hole.