…During all this monitoring, I wasn’t anywhere near the rider. I didn’t even need to see them with my own eyes. Instead, I was sitting inside an apartment, following their movements through a feature on a Metropolitan Transportation Authority (MTA) website…
If they allow access without any other form of authentication, I wonder what kind of protections they have against brute forcing credit card numbers.
You could pick up a receipt, use the first and last digits and hammer away.
I would imagine there aren’t any. Whenever a product or service is created, there’s little to no foresight, it’s all about the ease of profits and the eventual lawsuits that come afterwards are usually seen to be a small percentage of what they’ll make.
Receipts usually only show last 4 digits. That leaves 12 more digits to brute force through. only 999,999,999,999 (basically, 1 trillion combinations). You’ll find lots of positive matches for other valid cards in that range, so you still wouldn’t know which one belongs to your mark.
eh…Not entirely. Lets start with a simple thing- whoever is stalking a specific person likely purchased a dossier with enough information to get a credit card check (or full on background check too). they likely know companies whose cards you have.
Credit card numbers follow a formatting guidelines (linked above). the first number is most likely going to be a 4, 5, or 6, and possibly a 3. (representing Visa, MC, Disc, and amex, respectively.) the next three digits are the bank identification number- so lets say you have a bank-issued visa check card.
The remaining digits except the last are your account information- the last digit is a check number. Most banks will use a process for numbers as well, identifying the type of account that the card goes to, etc, refining the number of possibilities even further.
All that said, though, chances are bad actors won’t be brute forcing anything at all- they’ll just buy the information. At worst, they try two or three numbers and convince the system they’re you.