al capone
Advanced
- Joined
- 13.09.20
- Messages
- 159
- Reaction score
- 2,106
- Points
- 93
Fraudsters in the USA have succeeded in using Apple Pay and stolen credit card data to purchase goods worth over 1.5 million US dollars. The leader of the fraud ring, a 30-year-old from Miami, has now been sentenced by a court to four and a half years in prison for wire fraud and identity theft, according to the Florida State Attorney’s Office.
477 stolen credit cards set up in Apple Pay
Another member of the Fraud Ring was sentenced to four years in prison at the end of 2018, and two other defendants have yet to be sentenced. All defendants – three men and one woman – have been found guilty.
The fraudsters used the “fraudulently obtained” data of at least 477 credit cards to deposit them in Apple’s contactless payment service Apple Pay, as the public prosecutor’s office explained. The group then went on a retail shopping spree with their iPhones and was able to use the credit card data without having to produce a physical credit card. The public prosecutor’s office did not provide any further details on the procedure.
Criticism of low protective measures
The scammers may have taken advantage of the fact that adding credit cards to Apple Pay is mostly easy. Depending on the issuing bank, the CV code (Card Validation Code) may be sufficient in addition to the card data. Although this code is usually missing from stolen credit card data, it was originally possible to try the only three-digit number combination until the right one was found, as a security researcher criticized in 2016. This vulnerability in Apple Pay should have been closed long ago.
Banks can use various methods to verify the card, such as sending a code to the user’s e-mail address, by banking app or by phone. When Apple approves a card for Apple Pay, it will check “information about the activation of certain device settings and the usage pattern of your device, such as how often the device is in motion and the approximate number of calls you make each week. According to reports of a high fraud rate with Apple Pay stressing banks and Apple in 2015, it is a rare phenomenon.
477 stolen credit cards set up in Apple Pay
Another member of the Fraud Ring was sentenced to four years in prison at the end of 2018, and two other defendants have yet to be sentenced. All defendants – three men and one woman – have been found guilty.
The fraudsters used the “fraudulently obtained” data of at least 477 credit cards to deposit them in Apple’s contactless payment service Apple Pay, as the public prosecutor’s office explained. The group then went on a retail shopping spree with their iPhones and was able to use the credit card data without having to produce a physical credit card. The public prosecutor’s office did not provide any further details on the procedure.
Criticism of low protective measures
The scammers may have taken advantage of the fact that adding credit cards to Apple Pay is mostly easy. Depending on the issuing bank, the CV code (Card Validation Code) may be sufficient in addition to the card data. Although this code is usually missing from stolen credit card data, it was originally possible to try the only three-digit number combination until the right one was found, as a security researcher criticized in 2016. This vulnerability in Apple Pay should have been closed long ago.
Banks can use various methods to verify the card, such as sending a code to the user’s e-mail address, by banking app or by phone. When Apple approves a card for Apple Pay, it will check “information about the activation of certain device settings and the usage pattern of your device, such as how often the device is in motion and the approximate number of calls you make each week. According to reports of a high fraud rate with Apple Pay stressing banks and Apple in 2015, it is a rare phenomenon.