To: Puck who wrote (544 ) 4/29/2002 3:49:58 PM From: Dan Hamilton Respond to of 787 Here's an article about scammers targeting Authorize.Net. Epaynews.com is a good site for ecommerce (including mcommerce) articles, statistics and company info. New Credit Card Scam Hits Authorize.Net MSNBC Apr 25 2002 : In a new scam, named "'brute force' credit card thievery" by MSNBC, criminals are running thousands of tiny charges through merchant accounts, to find legitimate credit card numbers. Merchants with accounts at Authorize.Net, the largest payment gateway system in the US, are being charged up to 35 cents for each attempt, resulting in bills in the thousands of dollars. One e-tailer, Brian Harlin, tells how "the hackers tested over 13,000 card numbers on [his] account alone" with charges amounting to USD 7000, only some of which was refunded. Tom Arnold, of Authorize.Net, confirms, "we are aware of the specifics of the issues striking several of the merchants. In chat rooms, hackers are talking about it, and we are monitoring that". However, Scott Zielenski, a consultant for Sebenza Studios, notes, "a hacker can just keep running credit card numbers until it comes back approved. Ninety-five per cent, even more, come back declined". Other merchants believe Authorize.Net is to blame for using only a login name, and not a password, for merchants to 'run' a credit card check on its systems. "Once criminals get a merchant ID, they can test as many card numbers as they want", MSNBC reports, and pose as merchants requesting authorization on Authorize.Net's system. While Arnold says Authorize.Net is moving to cancel 'victimized' merchant IDs, and blames the problem on poor configuration by Web host providers, Harlin says the hackers first "got into the Authorize.Net system" last February. Security consultant, Ivo Truxa, likens the issue to a bank renting a safety box to a customer, but offering the choice of one "without doors".