Need someone to lead product or development at your software company? I lead product and engineering teams and I'm looking for my next opportunity. Check out my resume and get in touch.

Credit Card Activation a security risk

Freshness Warning
This blog post is over 14 years old. It's possible that the information you read below isn't current and the links no longer work.

You may have received a credit card with a sticker on it asking you to activate your card by calling a special number for your home phone.

The credit card verification system uses caller ID or ANI to check the number you’re calling from and checks to see if that’s the home number they have on record for you. The idea is that only the legitimate cardholder can call from their home phone. I mean you have to be inside my house to call from my home number, right?

I use a VoIP system as my home phone. Any calls I make are transmitted over the internet before they make it onto the regular telephone system. I’ve got a regular phone number—in fact it’s the same number I’ve had for five years, even before I used VoIP. My phone number shows up in caller ID, just like a "regular" phone. The difference is, for normal landlines, the caller ID information is set at the local phone office. For my VoIP system, the number is set in my phone system—a little box that sits on a shelf in my house.

That means I could change my caller ID to show any number I wanted. I can show mine. I could show yours. I could show up as anybody.

A bad guy that intercepts a new credit card only needs to know your home phone number to use a similar system. And it’s not hard to get someone’s home phone number.

So why are credit card companies using an easily-discovered and easily-spoofed token for authentication?

Dan
October 10, 2006 2:18 PM

Maybe because in the history of credit cards, voip is very new technology. They've been around in commercial/personal use for something like 50+years now, and voip? A few years, tops. Mind you, activating online requires you to enter, what, your phone number? postcode? digits on the card/paper? All this is verifiable through taking your maill (when they take your card in the first place). Social security number? Obtainable. Mothers maiden name? Same. Frequent fliers number? Easy. Makes you wonder what IS a safe way to verify personal information/identity. At least you're covered on a credit card for misuse :)

James
October 11, 2006 2:49 AM

It is a bit stupid of them to not test that is secure before using it and if they had this flaw should have been noticed and sorted lets hope they stop this form of activation soon.

Tama D.
October 12, 2006 4:46 PM

I don't think it is designed to deter the most sophisticated of criminals and hackers, but I think it is rather cost efficient and effective deterrent from petty thieves and what nots from snatching a new card in the mail and activating it.

Harald
October 14, 2006 8:16 AM

Telephone-based card activation has been around for a lot longer than VoIP systems. Credit card systems take a long time to change. And the coffin's nail: There are much easier ways to steal your credit card...

JOhn
May 20, 2010 12:36 AM

So are you guys saying anyone that got a card in the mail can just call the activation line show the card holders phone number and thats it, and its activated???

Adam Kalsey
May 20, 2010 9:50 AM

Yes, it's trivial to make a phone call as you or any other number. I can do it with two lines of code.

This discussion has been closed.

Recently Written

Domain expertise in Product Management (Nov 16)
When you're hiring software product managers, hire for product management skills. Looking for domain experts will reduce the pool of people you can hire and might just be worse for your product.
Strategy Means Saying No (Oct 27)
An oft-overlooked aspect of strategy is to define what you are not doing. There are lots of adjacent problems you can attack. Strategy means defining which ones you will ignore.
Understanding vision, strategy, and execution (Oct 24)
Vision is what you're trying to do. Strategy is broad strokes on how you'll get there. Execution is the tasks you complete to complete the strategy.
How to advance your Product Market Fit KPI (Oct 21)
Finding the gaps in your product that will unlock the next round of growth.
Developer Relations as Developer Success (Oct 19)
Outreach, marketing, and developer evangelism are a part of Developer Relations. But the companies that are most successful with developers spend most of their time on something else.
Developer Experience Principle 6: Easy to Maintain (Oct 17)
Keeping your product Easy to Maintain will improve the lives of your team and your customers. It will help keep your docs up to date. Your SDKs and APIs will be released in sync. Your tooling and overall experience will shine.
Developer Experience Principle 5: Easy to Trust (Oct 9)
A developer building part of their business on your product needs to believe that you're going to do the right thing for them and their customers.
Developer Experience Principle 4: Easy to Get Help (Oct 8)
The faster you can unblock a stuck developer, the better their experience will be.

Older...

What I'm Reading

Contact

Adam Kalsey

+1 916 600 2497

Resume

Public Key

© 1999-2020 Adam Kalsey.