Fraudulent Transactions Using Stolen Credit Card Continues

As hackers perform their campaigns, they continue to evolve their techniques by testing their attacks against a real-world target. This way they can further improvise their methodology and verify the effectiveness of their tools, giving them one-step ahead from the authorities and cybersecurity forensic professionals that hot on their trails. This is exactly the scenario that a group of hackers did against online merchants that are using Magento 2.1.x and 2.2.x shopping cart system.

The hackers used the attack as a means to verify if the payment cards they stole works, using a series of $0 transactions through the use of PayPal Payflow Pro module that is integrated with Magento 2.1.x and 2.2.x. PayPal Payflow Pro provides its users the capability for a hassle-free shopping, as the merchant stores can receive the payment without the user formally logging-in to the PayPal portal.

With a huge number of stolen credit card information in the hands of hackers, they were able to confirm what particular cards are still operational and those cards that are no longer valid, at the expense of websites that use Magenta online shopping cart. These stolen credit card information were from credit card skimmers, a small device that can copy the user information from a magnetic-stripe card for use in fraudulent transactions online. It is a fraud that skimms a credit card with a machine and creates and abuses a credit card of a clone based on the read magnetic information. Victims may lose control of their credit card info by using it in a store with hidden skimming devices, or someone may be able to see the PIN with a surveillance camera. In addition, there are cases where skimming machines are installed in ATMs, in which case it may be difficult to confirm with a layman’s eye.

The stolen credit card information usually are sold in bulk in the dark web as well, as people that wish to purchase illegal items have the motivation to bypass detection, the use of stolen cards is their way to evade the probe. Magento system have two variants, one is the community-maintained opensource Magento and the other is the cloud-hosted Magento cloud. The newest version Magento 2.3 is not seen as vulnerable to the same attacks as its previous version, hence the team highly recommends that any installation of Magento open source variant needs to upgrade as soon as possible. The cloud version is automatically using the latest Magento version available, as it is directly maintained by the Magento team.

Paypal offers a variant of the payment system with built-in anti-fraud protection, all merchants that have a substantial level of sales and cash flow are encouraged to sign-up in order to protect their business from fraudulent transactions. For credit card holders, don’t give the card to the clerk, or hide it with your hand when you type the PIN so that it does not appear on the security camera. If you don’t care about using a credit card, you may want to pay in cash. Newer cards that use an EMV chip is immune from current card skimming devices, banks are starting to issue it in order to discontinue the old magnetic-stripe cards.