Enumeration, carding and BIN attacks: What you need to know about Card Not Present fraud

Enumeration fraud is the act of establishing valid card details, by testing them on an ecommerce website. It is also known as carding or card testing.

It can have devastating consequences for both businesses and consumers. If an online firm fails to take steps to identify and prevent their site from being used in this manner, it could result in lower authorisation rates; increased transaction fees because of repeated declined transactions; and additional fees from Visa or Mastercard for excessive retry attempts 

But even more alarmingly, if someone tests and confirms stolen card details are valid using your site and then commits further fraud with those valid card details, you could be liable for that fraud. It could result in fines and fees and business-ending reputational damage.

Meanwhile your customers face emotional distress, loss of trust in your company and payments in general, financial hardship or identity theft.

Brian Kinsella, Senior Regional Fraud Manager at Elavon, said: “We often see that the types of businesses that fall victim to carding attacks are small companies that may not have invested heavily in website security. 

“By taking a few simple, low-cost steps, you can prevent your business from falling foul of carding and any card fees for excessive declines.”

What are BIN attacks

Your ecommerce site may also be targeted in a similar type of fraud called a BIN attack. The BIN or Bank Identification Number, is the first six to eight digits on a debit or credit card. This is the part of the card details that identifies the issuing bank, card scheme and the type of card being used.

Cyber-criminals acquire genuine BINs, through theft, buying lists on the dark web or using publicly available data. They then randomly generate the extra digits needed to make a complete card number, combining expiry dates and CVV numbers. 

Computer scripts can generate thousands of these card numbers and then test them against ecommerce sites to find one that works. It’s known as a brute force attack as it’s fairly low tech, but it can be effective. 

Again, cyber-criminals will often target websites that take low value transactions or services that don’t require an actual transaction. 

As reported above, once a valid card has been identified, it can be used to make fraudulent transactions and purchases until the fraud has been spotted by the cardholder or the issuing bank.

But don’t panic. There are some relatively simple and cost effective methods to protect yourself. 

Steps to take to stop carding on your website

You should speak to your developer about introducing security measures across your entire site, not just at the point of payment.

• Remove the copy and paste function will make it harder for a fraudster to run an automated script to generate these test transactions
• Introduce machine learning tools or other security methods that track customers behaviour and spotting suspicious activity early in the process
• Bot detection: Having a complex ‘CAPTCHA’ test on your website could frustrate a fraudster's carding attempts. A ‘CAPTCHA’ is a computer program or system used to determine the difference between a human and a robot.
   

For Authorisation based carding attacks: 

• 3-D Secure: This is the umbrella name for card issuer authentication services like Visa Secure and Mastercard SecureCode, which have been implemented by the card brands to add an additional level of security for online shopping. By implementing 3-D Secure for your ecommerce site, you can fully authenticate the cardholder. This may mean a shift in the liability for chargebacks arising on transactions under certain circumstances, even where the cardholder is not enrolled for 3-D Secure. While 3-D Secure cannot and does not eliminate chargebacks entirely, it does vastly reduce the incidence of fraud
• Seek out other fraud-management products that your payments gateway provider may have available, which will help identify and block such attacks from happening
• Address verification service (AVS): Compare the billing address for the transaction with the one registered to the card
• CVS or CVC: Card verification value or the card verification code is the three or four digit code on a card. Making customers enter this helps check the buyer is in possession of the card
   

For 3DS Authentication based carding attacks

• Ask your gateway provider to ensure there are session limits on the 3DS authentication server 
• Velocity checks: Implementing a BIN level velocity check can restrict the number of transactions or attempts from one IP address
• Enable an IP blocklist and proactively manage the list with your gateway provider. This can stop cybercriminals accessing your site from an IP address associated with fraud

Speak to your gateway provider about what fraud prevention and detection products they have or partners they recommend. If you are ever in doubt over your payment security, speak to your gateway provider for more information and help.