1
00:00:00,620 --> 00:00:02,140
Can you guys see okay in the back?

2
00:00:02,140 --> 00:00:04,400
We have all this tech stuff for the black and white.

3
00:00:05,100 --> 00:00:05,880
Everybody's okay?

4
00:00:05,880 --> 00:00:06,620
Okay.

5
00:00:07,120 --> 00:00:09,340
Alright, thank you for attending.

6
00:00:10,000 --> 00:00:11,440
Credit cards and everything.

7
00:00:11,540 --> 00:00:12,920
This is the third year of this.

8
00:00:12,920 --> 00:00:18,140
The first year we did social engineering aspect, as long as some light Wi-Fi stuff.

9
00:00:18,320 --> 00:00:19,500
Can everybody hear me okay?

10
00:00:20,820 --> 00:00:21,620
No.

11
00:00:22,020 --> 00:00:28,540
Okay, and last year we did a live demo, where we actually had some people in the front row interacting, trying to break in.

12
00:00:28,540 --> 00:00:34,160
And at the very end, Spoonim was nice enough to do some cross-site scripting.

13
00:00:34,160 --> 00:00:35,840
So thank you, Spoonim, if you're out there.

14
00:00:37,180 --> 00:00:39,640
Okay, this year we're just going to kind of go over the basics.

15
00:00:39,820 --> 00:00:42,900
And when I say basics, I hope you guys don't go, ah, basics.

16
00:00:43,020 --> 00:00:47,260
It's like basics on like getting into the industry kind of level.

17
00:00:47,260 --> 00:00:49,580
So hopefully it's informative for everybody.

18
00:00:50,220 --> 00:00:52,880
So this is credit cards, everything you have ever wanted to know.

19
00:00:53,900 --> 00:00:57,320
And we're going to start off with a brief history of credit cards.

20
00:00:58,400 --> 00:01:02,240
1950 Diners Club was the first credit card style thing.

21
00:01:02,400 --> 00:01:10,500
I believe Sears Robux in the mid-20s did a credit where you can buy a washer, dryer, or something like that, and then pay later.

22
00:01:10,500 --> 00:01:12,120
But it was all on paper and books.

23
00:01:12,120 --> 00:01:16,680
It wasn't really in the format we're used to, which is plastic or some form thereof.

24
00:01:17,220 --> 00:01:20,040
1958 American Express was the next one to come out with it.

25
00:01:20,040 --> 00:01:25,420
It was exclusively in New York City, and it was mostly for restaurants and hotel stays.

26
00:01:25,420 --> 00:01:27,760
Kind of high society kind of people.

27
00:01:28,440 --> 00:01:36,480
And this is an interesting aspect here with American Express, because when they came in and Diners Club was already there, it was mostly for the high-end customers.

28
00:01:36,680 --> 00:01:46,580
So what people wanted to do was accept these credit cards so that they can draw on the high-end clients that were the only ones, the elitists, that were allowed to actually have credit cards.

29
00:01:46,760 --> 00:01:55,240
So the credit card industry created this weird paradox where if you want to accept a credit card, you have to pay us to accept credit cards.

30
00:01:55,240 --> 00:02:09,740
So when you swipe your card, 50 bucks goes through, about 35 cents on average goes directly to the credit card company for the luxury of having the ability to authorize credit cards for the merchant.

31
00:02:09,740 --> 00:02:18,960
And that kind of set a standard and a tone for the industry, and also automatically started some security concerns in and of itself.

32
00:02:18,960 --> 00:02:25,460
A 1958 Bank of America card started by Bank of America, which is now, as we all know, Visa.

33
00:02:25,460 --> 00:02:30,000
That was in the late 70s when it switched over to the Visa brand when they went international.

34
00:02:30,960 --> 00:02:43,600
1966 MasterCard International, ICA, the consortium of banks, got together and said, we want to also have a credit card to compete with Bank of America and American Express.

35
00:02:43,600 --> 00:02:58,700
And then way, way, way, way late in the game, 1986, Discover Card, which was originally started by Sears Roebuck, and now Payne Webber, they just got together and merged and now they're breaking apart.

36
00:02:58,700 --> 00:03:05,460
Payne Webber and a couple other financial institutions took over Discover Card and now they're selling it off to itself.

37
00:03:06,300 --> 00:03:09,480
So let's talk about the technology behind credit cards.

38
00:03:09,480 --> 00:03:13,860
Like we said before, back then it was all low-tech and everything like that.

39
00:03:13,860 --> 00:03:16,400
I seem to be getting some sort of interruption here.

40
00:03:19,360 --> 00:03:22,600
Hello, I am Ripshe with DC702.

41
00:03:22,640 --> 00:03:29,000
We are doing a scavenger hunt and I'm going to give you a brief discussion about the scavenger hunt.

42
00:03:29,160 --> 00:03:31,880
I'll read the introductory paragraph for you.

43
00:03:32,460 --> 00:03:36,420
Welcome again to the greatest DEF CON competition brought to you by DC801.

44
00:03:36,420 --> 00:03:40,360
On the back of this page is a list of items, tasks, and their point values.

45
00:03:40,740 --> 00:03:47,780
From the time you get this list until noon on Sunday, collect as many of those items and complete as many tasks as possible.

46
00:03:48,000 --> 00:03:50,840
The team with the most points at noon on Sunday wins the hunt.

47
00:03:50,840 --> 00:03:58,300
Prizes are donated from all the vendors, many thanks to all those that donate, and whatever we were able to come up with before getting here.

48
00:03:58,400 --> 00:04:05,780
Aside from the great time last year's teams had playing, first, second, and third place went home with plenty of shirts, books, hardware, stickers, and toys.

49
00:04:05,780 --> 00:04:09,560
First place took home black badges, but we can't promise anything.

50
00:04:09,640 --> 00:04:13,280
I really don't have anything original to talk about, so that's about all I'm going to do.

51
00:04:13,280 --> 00:04:13,960
Thank you.

52
00:04:13,960 --> 00:04:17,300
Thank you for interrupting the speech that you were not scheduled for.

53
00:04:18,640 --> 00:04:24,320
And somehow you were not scheduled for that speech and yet you're doing it because you're part of the scavenger hunt.

54
00:04:24,720 --> 00:04:26,100
Hint, hint, nudge, nudge.

55
00:04:27,740 --> 00:04:30,240
Alright, back on with the normal speech.

56
00:04:30,240 --> 00:04:31,960
Okay, so technology.

57
00:04:32,440 --> 00:04:37,900
They had the knuckle busters, as we all call them today, and American Express was the first to start this.

58
00:04:38,060 --> 00:04:42,520
And that was where the imposed imprints came on the cards originally.

59
00:04:42,680 --> 00:04:49,020
Because you put them on the, as we all know, whoever's worked in retail at least once in their life and had a card that did not swipe.

60
00:04:49,020 --> 00:04:57,620
You put the card down, you have a sheet of paper, and then you push over the sheet of paper and it imprints your credit card number, your name, expiration date, that kind of thing.

61
00:04:57,620 --> 00:05:03,280
And these receipts were all collected up at the end of every night and they were mailed off to the credit card company.

62
00:05:03,280 --> 00:05:07,560
And only when they were received by the credit card company did you actually get the money from that client.

63
00:05:07,640 --> 00:05:12,260
So if there was any fraud or anything like that, it took a very long time before it was discovered.

64
00:05:12,460 --> 00:05:18,060
They also did phone authorizations on certain credit cards or certain businesses of high risk.

65
00:05:18,060 --> 00:05:19,740
That kind of mitigated that risk.

66
00:05:20,100 --> 00:05:24,380
And then in the 80s is when dial-up authorization terminals came into play.

67
00:05:24,380 --> 00:05:35,260
Dial-up is pretty much those trans 380s or Ingenico devices that you see now where they just swipe the card, punch in how much money, and hit enter.

68
00:05:35,260 --> 00:05:39,800
And then it would pick up the phone line, dial out, connect to get authorization.

69
00:05:40,240 --> 00:05:44,020
And the interesting thing about this is they originally started off at 1,200 baud.

70
00:05:44,240 --> 00:05:49,460
And at 1,200 baud, you'd think, okay, that was so 1985, so 1991.

71
00:05:49,460 --> 00:05:55,060
But they still use, to this day, anybody who does dial-up, they still use 1,200 baud as their connection rate.

72
00:05:55,100 --> 00:05:59,820
Simply because they don't want to upgrade their servers or their mainframes for higher speeds.

73
00:05:59,980 --> 00:06:07,080
If anybody wants faster authorization, they say, well, just use lease lines or use direct connections to the bank.

74
00:06:07,840 --> 00:06:09,560
It's very fast transactions.

75
00:06:09,560 --> 00:06:14,820
You don't really need more than 1,200 anyways to connect in, get an authorization, and close out.

76
00:06:14,820 --> 00:06:29,200
The only time that it actually causes a problem is at the end of the night, if you have like 300, 500 credit cards that were authorized, you have to wait like 20 minutes as it slowly pushes across the 1,200 baud modem all the credit cards that need to be finalized.

77
00:06:29,980 --> 00:06:32,660
High-speed lease lines, we kind of just talked about that.

78
00:06:32,660 --> 00:06:43,280
High-speed lease lines is pretty much, I'm Walmart, and I have all my stores connected, and it doesn't make any sense to use any third-party people, just go straight to the bank and get authorizations.

79
00:06:43,280 --> 00:06:49,080
And so they have like Walmart, they have all their stuff consolidated into one source and then going out.

80
00:06:49,100 --> 00:06:55,360
Same thing with CSK Auto for those that are in the United States, which is Checkers, Shooks, Cragen, if any of those sound familiar.

81
00:06:55,420 --> 00:07:01,200
All theirs go down to Arizona, and then from Arizona, it goes out and gets authorization, comes back, and then goes to your respective store.

82
00:07:01,880 --> 00:07:10,140
So for high volume or big names that have a lot of weight to throw around, a lot of money and that kind of stuff, they can usually get direct lines.

83
00:07:10,140 --> 00:07:16,800
Gateway processors, these are like Go software, IC Verify, Shift 4, that sort of thing.

84
00:07:16,840 --> 00:07:26,060
They're for like the middle tier and the low-end clients that don't do more than like anywhere between 100 transactions a month to about 200,000 a month.

85
00:07:26,120 --> 00:07:27,800
And you usually use a front-end gateway.

86
00:07:27,800 --> 00:07:33,260
PayPal can technically be considered a front-end gateway because you have APIs for your websites.

87
00:07:33,620 --> 00:07:38,160
CC Bill and iBill and all those other blue light catering ones is also gateways.

88
00:07:38,960 --> 00:07:40,440
Co-op leased line.

89
00:07:40,440 --> 00:07:41,860
This is actually kind of unique.

90
00:07:41,860 --> 00:07:43,940
The only time I've ever seen a co-op leased line.

91
00:07:43,940 --> 00:07:45,300
Am I going too fast, guys?

92
00:07:46,340 --> 00:07:58,500
Okay, the only time I've ever seen a co-op leased line was here in town, like at the MGM and a few others that are not even directly associated with each other through business arrangements.

93
00:07:58,560 --> 00:08:00,020
They have like a direct line.

94
00:08:00,020 --> 00:08:01,880
And I'm going down.

95
00:08:02,940 --> 00:08:05,040
That's what I get for not plugging it in.

96
00:08:06,060 --> 00:08:08,580
So, well, that's coming back up.

97
00:08:08,840 --> 00:08:12,900
So what they did was they were all like, well, we have a direct line directly to the bank.

98
00:08:12,900 --> 00:08:19,600
So we can resell this line or we can all cooperate in paying for the leased line to go out and work that way.

99
00:08:19,600 --> 00:08:22,280
And it's still being stubborn.

100
00:08:23,060 --> 00:08:24,160
Oh, there you are.

101
00:08:28,920 --> 00:08:30,060
All right.

102
00:08:32,440 --> 00:08:33,360
Hush.

103
00:08:38,060 --> 00:08:39,440
I just enumerated.

104
00:08:39,440 --> 00:08:40,300
That was great.

105
00:08:41,540 --> 00:08:44,880
Luckily, there's no direct connects in, I don't think.

106
00:08:48,060 --> 00:08:49,460
You'll harbor brute force it.

107
00:08:49,460 --> 00:08:50,120
There you go.

108
00:08:51,020 --> 00:08:54,940
Okay, so these co-ops, they're just pretty much everybody just kind of gets together.

109
00:08:54,940 --> 00:08:56,820
We're a bunch of small businesses and we don't want to pay.

110
00:08:56,820 --> 00:09:02,720
It's like anything else where if we all buy like a sack of potatoes, we can get it for a cheaper price kind of thing.

111
00:09:02,720 --> 00:09:07,980
So everybody buys into the same lease line and gets better rates going through.

112
00:09:08,580 --> 00:09:13,340
And then we already talked about PayPal a little bit with online API gateways, CC auth and iBill.

113
00:09:13,340 --> 00:09:14,960
And I don't know.

114
00:09:15,200 --> 00:09:16,160
I don't go to those sites.

115
00:09:16,160 --> 00:09:17,140
What do you guys use?

116
00:09:17,520 --> 00:09:18,360
No, I'm just kidding.

117
00:09:20,080 --> 00:09:22,880
Okay, so marketing and technology.

118
00:09:22,880 --> 00:09:27,660
So some of these different technologies that are coming out that everybody kind of wants to know about.

119
00:09:27,660 --> 00:09:30,600
And I'm here to tell you guys, I'm going to burst your bubble.

120
00:09:30,600 --> 00:09:31,960
A lot of them mean nothing.

121
00:09:31,960 --> 00:09:34,460
Like the smart cards is the first one.

122
00:09:34,460 --> 00:09:37,720
We all know this with the American Express Blue.

123
00:09:37,720 --> 00:09:43,820
We have the little silver or gold smart card built into it and it's supposed to be more secure and all this other stuff.

124
00:09:44,960 --> 00:09:46,420
Nobody uses it.

125
00:09:46,600 --> 00:09:47,540
No vendors use it.

126
00:09:47,540 --> 00:09:49,420
There is an actual protocol out.

127
00:09:49,420 --> 00:09:51,920
There's a specification for how it works.

128
00:09:51,980 --> 00:09:56,080
I know NDC, VisaNet and FDC support it.

129
00:09:56,080 --> 00:10:00,200
But they're the only ones and that's not enough to actually get full on.

130
00:10:00,200 --> 00:10:04,560
And here's a couple reasons why smart cards are not working and why they're not coming to market.

131
00:10:05,120 --> 00:10:07,880
It's because the vendors are paying for all the equipment.

132
00:10:08,040 --> 00:10:11,220
If you want a terminal to swipe cards, you have to pay for it.

133
00:10:11,220 --> 00:10:14,020
If you want the ability to accept cards, you have to pay for it.

134
00:10:14,020 --> 00:10:18,480
If you want each individual one, like you want to accept Visa, you have to have an agreement with them.

135
00:10:18,480 --> 00:10:21,000
If you want to accept MasterCard, you have to have an agreement with them.

136
00:10:21,080 --> 00:10:22,220
So on and so forth.

137
00:10:22,300 --> 00:10:25,800
So the merchants are the ones that are really getting suckered out of a lot of money here.

138
00:10:25,800 --> 00:10:34,480
And then all the ISOs, Independent Sales Organizations and MSPs, Merchant Service Providers, they come to them and say, we have this smart card stuff.

139
00:10:34,480 --> 00:10:42,460
All you have to do is take out that one terminal that I just charged you $350 for and put this new one in that's $900 so you can accept smart cards.

140
00:10:42,460 --> 00:10:50,520
And then you'll be way more secure with only 1% of America actually having smart card on their cards.

141
00:10:50,520 --> 00:10:51,780
So it's a very hard bargain.

142
00:10:51,780 --> 00:10:54,200
So that's why smart cards just kind of floated along.

143
00:10:55,280 --> 00:10:57,000
Virtual one-time use cards.

144
00:10:57,140 --> 00:11:01,080
I wasn't even aware of these until somebody asked me about it after the speech last year.

145
00:11:01,080 --> 00:11:04,840
And then I looked into it a little bit and talked to some people about it.

146
00:11:04,840 --> 00:11:11,820
And these are pretty much... you're online and you're super, super, super paranoid that somebody's going to steal your credit card online.

147
00:11:11,820 --> 00:11:12,600
They're going to do it.

148
00:11:12,600 --> 00:11:14,500
I just know they're going to steal my credit card.

149
00:11:14,500 --> 00:11:16,780
I can't handle having my credit card online.

150
00:11:16,780 --> 00:11:24,080
So what they do is they go out and they register with... I think Bank of America supports this and Chase Bank supports it.

151
00:11:24,540 --> 00:11:25,620
And Citibank supports it.

152
00:11:25,620 --> 00:11:27,120
That's right, they're the big promoter of it.

153
00:11:28,740 --> 00:11:31,540
They pretty much say, we're going to give you a laundry list of cards.

154
00:11:31,540 --> 00:11:34,100
And you can use this card number exactly once.

155
00:11:34,100 --> 00:11:36,620
And as soon as you use it, it's now a dead card.

156
00:11:36,620 --> 00:11:46,360
Or I want to use this credit card for reoccurring billing, which means you're going to work out at the gym or you are part of the jello club or something like that.

157
00:11:46,740 --> 00:11:50,840
And you want them to keep on billing you $10 a month for all the great jellos in the world.

158
00:11:51,680 --> 00:11:56,300
So you can have a one-time use that will only be authorized to work at that merchant.

159
00:11:56,300 --> 00:11:57,840
It won't work at any other merchant.

160
00:11:57,840 --> 00:12:07,680
So somebody will know right away that the merchant's got a problem and that their credit card was hijacked from that merchant as soon as it gets used somewhere else.

161
00:12:08,900 --> 00:12:11,180
And some people ask, well, how does this work?

162
00:12:11,180 --> 00:12:12,480
How is this possible?

163
00:12:12,600 --> 00:12:17,720
Well, this kind of gets into a little bit of the more thicker realm of credit cards and how they work.

164
00:12:17,920 --> 00:12:22,160
And all your authorizations go all the way back to your bank.

165
00:12:22,160 --> 00:12:25,560
So when you swipe the card, it goes through what's called a front-end processor.

166
00:12:25,560 --> 00:12:30,680
And they pretty much aggregate all the credit cards and say, okay, we have all the phone numbers.

167
00:12:30,680 --> 00:12:32,920
We have all the direct links to all the banks.

168
00:12:32,920 --> 00:12:38,400
Because back in the day, you know, you had this small trans-380 terminal and had like 56K of memory.

169
00:12:38,400 --> 00:12:42,920
You can put one phone number, your merchant information, your BIN number in it, and that was it.

170
00:12:42,980 --> 00:12:50,680
So if you had to call a different bank every time that somebody with a different bank came along to get an authorization, you'd fill up all that memory.

171
00:12:50,680 --> 00:12:53,460
And it would just be a nightmare managing accounts with everyone.

172
00:12:53,460 --> 00:12:57,880
So what they said was, well, we'll manage our accounts with everyone, and you just connect to us.

173
00:12:57,880 --> 00:12:59,420
And that's the front-end processor.

174
00:12:59,540 --> 00:13:05,240
And then you connect to us, and then we'll hop onto what's called Merchant Link when you go into Visa or Bank of America.

175
00:13:05,320 --> 00:13:14,800
Or we'll hop onto the back-end processors, as they call them, which are shared networks that are just private networks that connect you directly to issuing banks.

176
00:13:14,960 --> 00:13:22,280
So when you use this credit card online, it goes through the front-end processor, through the back-end network, and then to the exact bank that issued it.

177
00:13:22,280 --> 00:13:28,660
So if you, say, generate a credit card online and it just generates it, the bank already has it in its database.

178
00:13:28,660 --> 00:13:35,540
So whenever you use it somewhere else, it goes directly back to the bank, and then the bank knows, oh, hey, I just created that card.

179
00:13:35,540 --> 00:13:40,660
Go ahead and send an authorization response back to the merchant.

180
00:13:40,660 --> 00:13:46,840
And that's how that's possible, is because everything touches the actual issuing bank in every transaction.

181
00:13:48,360 --> 00:13:49,640
Secured cards.

182
00:13:49,820 --> 00:13:54,600
These are kind of new technology and everything like that.

183
00:13:55,420 --> 00:13:56,780
There's... oh, I'm sorry.

184
00:13:56,780 --> 00:13:57,600
I'm on the wrong one.

185
00:13:57,600 --> 00:13:58,140
Easy Pay.

186
00:13:58,140 --> 00:14:04,900
Secured cards are those cheesy ones where it's like, hey, give us $200 and we'll give you a credit card with a $200 credit limit.

187
00:14:06,100 --> 00:14:06,980
Okay.

188
00:14:07,540 --> 00:14:10,600
I have $200 on your credit card.

189
00:14:10,600 --> 00:14:11,500
What does that mean?

190
00:14:11,500 --> 00:14:14,140
Well, we're going to charge you service fees and all this other stuff.

191
00:14:14,140 --> 00:14:21,880
So you get a credit card, so when you go to the bank or you go shopping or everything, you get to be like, I'm a proud credit card holder.

192
00:14:22,000 --> 00:14:23,080
Look at me.

193
00:14:23,140 --> 00:14:25,780
And you can be like 17, 18 and get these things.

194
00:14:25,800 --> 00:14:34,480
So I'm not promoting this, but theoretically online, over 18 authorization usually means if they have a credit card, they're over 18.

195
00:14:34,660 --> 00:14:41,220
And if you happen to go to Walgreens and get one of these secured credit cards for $200, you now have a credit card and you're 13.

196
00:14:43,060 --> 00:14:50,040
So that's just something I heard from somebody, but I do not promote you going and doing any online transactions under the age of 18.

197
00:14:50,040 --> 00:14:50,940
That would be bad.

198
00:14:51,380 --> 00:14:55,780
But these are pretty much for people who have bad credit, want to rebuild their credit, that kind of thing.

199
00:14:56,300 --> 00:14:59,500
You know, various different aspects of rebuilding credit.

200
00:14:59,500 --> 00:15:04,220
That's not really what this speech is about, but we'll touch upon it just really briefly because we're talking secured cards.

201
00:15:04,260 --> 00:15:07,460
It doesn't really help you out too much because people know.

202
00:15:07,460 --> 00:15:11,400
Before they were like, oh, he has a credit card and it has a $200 limit and he pays it on time.

203
00:15:11,400 --> 00:15:13,420
Well, yeah, he pays it on time because it's his money.

204
00:15:13,580 --> 00:15:18,100
So he gets better credit, but they got privy to who's doing this and how they're doing it.

205
00:15:18,100 --> 00:15:25,400
And so it really doesn't help your credit score to rebuild credit after a bankruptcy or foreclosure or things shutting down yet again.

206
00:15:27,820 --> 00:15:29,960
It is another second form of ID.

207
00:15:30,480 --> 00:15:33,900
And that does help out to get various different things.

208
00:15:33,900 --> 00:15:39,020
And it's easier to get it because you can just log on to our website and say, hey, I am Joe Bob.

209
00:15:39,020 --> 00:15:40,100
Give me this credit card.

210
00:15:40,100 --> 00:15:41,040
And it just gives it to you.

211
00:15:41,040 --> 00:15:41,920
Oh, you're Joe Bob.

212
00:15:41,920 --> 00:15:42,640
Sure thing.

213
00:15:42,640 --> 00:15:47,020
So you don't have to have actually any authorization or any proof to get that.

214
00:15:48,000 --> 00:15:48,800
All right.

215
00:15:49,080 --> 00:15:49,500
Okay.

216
00:15:49,500 --> 00:15:51,620
So the easy pay RFID cards.

217
00:15:51,800 --> 00:15:58,360
There was those guys out at the university that cracked the ones for mobile, if you guys are familiar with that.

218
00:15:59,540 --> 00:16:04,560
And the mobile cards were pretty much, you know, those swipe ones where you're like, I want gas really quick.

219
00:16:04,560 --> 00:16:06,520
So you just kind of wave your card, you know.

220
00:16:06,520 --> 00:16:08,400
It's just, yeah, I'm going to do that one more time.

221
00:16:08,460 --> 00:16:09,700
Wave your card.

222
00:16:10,020 --> 00:16:13,220
And boom, you get your gas and everything like that.

223
00:16:13,300 --> 00:16:15,380
And Chase also premiered these.

224
00:16:15,380 --> 00:16:22,500
And we're trying to get a hold of one of these Chase ones because we wanted to build a RFID sniper rifle.

225
00:16:23,060 --> 00:16:26,760
But we're working on it.

226
00:16:26,760 --> 00:16:28,700
So maybe by...

227
00:16:29,140 --> 00:16:30,780
Can I promote other events?

228
00:16:30,780 --> 00:16:31,860
Maybe by...

229
00:16:34,540 --> 00:16:37,320
Maybe by one of these other conferences we'll have it ready.

230
00:16:38,940 --> 00:16:40,680
So keep an eye out for that.

231
00:16:40,680 --> 00:16:45,880
But we're going to work on that with Chase and see if we can crack it just like the university guys did for easy pay.

232
00:16:46,000 --> 00:16:52,100
And these are just pretty much when you pass it over, the power is generated from the actual terminal you're waving over.

233
00:16:52,100 --> 00:16:54,920
And that's how it activates the card to get your information.

234
00:16:55,920 --> 00:16:58,980
And we'll talk about some security on that in a little bit.

235
00:16:59,200 --> 00:17:00,780
All right, physical fraud features.

236
00:17:00,780 --> 00:17:03,020
This is the interactive part of the demo.

237
00:17:03,400 --> 00:17:07,800
Go ahead and I'll pull out your credit cards and stare at them and mask them from everybody else.

238
00:17:07,800 --> 00:17:08,920
I'll do it myself.

239
00:17:13,700 --> 00:17:15,100
Oh, I'm dead serious.

240
00:17:15,520 --> 00:17:17,560
So I have my PayPal account here.

241
00:17:17,720 --> 00:17:18,100
So we can...

242
00:17:20,500 --> 00:17:21,300
It's 3348...

243
00:17:21,300 --> 00:17:22,180
No, I'm just kidding.

244
00:17:23,000 --> 00:17:24,600
33 would be JCB.

245
00:17:24,600 --> 00:17:28,560
I mean, I don't know what's going on right now.

246
00:17:29,980 --> 00:17:36,080
Okay, so if you actually want to toll it out and everything, if you're familiar with it, if you have photographic memory, you can think about your credit card for a minute.

247
00:17:36,420 --> 00:17:42,680
And for those of you in front who better not have photographic memories, you can kind of stare at mine.

248
00:17:42,680 --> 00:17:48,340
When we're looking at these, we're talking about the imposed numbers, those originally generated from the knuckle busters.

249
00:17:48,340 --> 00:17:52,060
But they became a fraud prevention mechanism.

250
00:17:52,280 --> 00:17:59,900
Because as long as the imposed one, which is a little difficult to push up, is the same as the magnetic strip, then you're okay.

251
00:17:59,900 --> 00:18:04,440
Some people, we've seen a lot of fraud where people actually push it down and then re-push up new numbers.

252
00:18:04,520 --> 00:18:05,980
And they're like really easy to spot.

253
00:18:05,980 --> 00:18:07,800
So that's a telltale sign.

254
00:18:08,420 --> 00:18:13,540
Also on them, as far as imposed is concerned, you're going to see the letter of the credit card that is on there.

255
00:18:13,540 --> 00:18:21,300
If you ever notice why there's a cursive M, or a cursive V, or a cursive D, or a cursive A, those are all saying, you know, I'm a MasterCard, I'm a Visa.

256
00:18:21,500 --> 00:18:29,840
So if you swipe it and it's a Visa card, and then you look on it and it says M, then you know there's something funny going on.

257
00:18:30,260 --> 00:18:34,400
Also on these things, you have the logos, which says MasterCard, that's another fraud feature.

258
00:18:35,140 --> 00:18:47,180
And the holograms, the hologram actually came in in the late 80s because of those guys who were watching people putting in their credit card number and phone booths to make phone calls, long distance phone calls.

259
00:18:47,540 --> 00:18:52,660
And they were just like memorizing, they can just like photographic memory, stare at your card and then boom, now.

260
00:18:52,660 --> 00:19:01,520
So the last four digits of your card goes over the hologram, so it's harder for these people to really visually see your card and take a snapshot and start doing fraud on that.

261
00:19:01,520 --> 00:19:04,500
Of course, you got the expiration date on there in many different forms.

262
00:19:04,500 --> 00:19:12,200
Some banks will have, it was issued on this day and then it was expiring on that day.

263
00:19:12,200 --> 00:19:14,220
And some just say it expires on this day.

264
00:19:14,680 --> 00:19:15,680
What else we got?

265
00:19:15,920 --> 00:19:17,500
The curse of letter we talked about.

266
00:19:17,820 --> 00:19:20,400
First four digits non-imposed.

267
00:19:21,120 --> 00:19:26,220
Okay, yeah, also on most cards, when you're looking at the first four digits, non-imposed is also printed on the card.

268
00:19:26,220 --> 00:19:30,180
The first four digits of the card, that's a little bit of a fraud thing there.

269
00:19:31,160 --> 00:19:34,040
Magnetic strip, of course, we're all privy to the magnetic strip.

270
00:19:34,040 --> 00:19:35,600
I happen to have a swiper here.

271
00:19:36,000 --> 00:19:39,700
There are $35 on eBay, from what I understand.

272
00:19:39,760 --> 00:19:41,460
They plug right into your keyboard.

273
00:19:41,940 --> 00:19:44,200
And you can just pretty much swipe any card you want.

274
00:19:44,200 --> 00:19:48,620
You want to see what's on your Blockbuster card, you want to see what's on your PayPal card, you can just swipe it.

275
00:19:48,620 --> 00:19:54,280
And we'll do a quick demo here, I think, if the software's going to work, that X's out my account number when I swipe.

276
00:19:54,720 --> 00:19:57,460
So, we'll see how that works out.

277
00:19:58,220 --> 00:20:00,220
The signature panel on the back.

278
00:20:00,220 --> 00:20:01,780
The signature panel says the card types.

279
00:20:01,780 --> 00:20:06,720
It'll say discover, discover, discover, and 45-degree angle, or MasterCard, MasterCard, MasterCard.

280
00:20:06,720 --> 00:20:11,020
And underneath that, if you scratch it with a coin, like it's a lottery ticket, it says void.

281
00:20:11,020 --> 00:20:14,260
So as soon as you see the void, merchants are not supposed to accept the card.

282
00:20:15,160 --> 00:20:17,300
CVV2 code, that's kind of relatively new.

283
00:20:17,300 --> 00:20:19,820
It means Card Verification Version 2.

284
00:20:20,300 --> 00:20:21,900
What was Version 1?

285
00:20:21,900 --> 00:20:24,420
Well, Version 1 was magnetic data.

286
00:20:24,420 --> 00:20:28,900
The unique data, discretionary data, as they call it, on the card itself.

287
00:20:29,760 --> 00:20:35,680
So, Card Verification Version 2 is mostly used in over-the-phone sales and online sales.

288
00:20:36,180 --> 00:20:38,240
Okay, credit card magnetic data.

289
00:20:38,240 --> 00:20:39,960
Two tracks for credit cards.

290
00:20:40,160 --> 00:20:44,100
I wasn't sure if I was going to talk about it last year, and people said, ah, just go ahead and do it.

291
00:20:44,260 --> 00:20:50,800
It's pretty much public knowledge, and since you can get one of these anywhere, and you can look up the specs, I'll give you guys the details of what's going on there.

292
00:20:50,800 --> 00:20:52,640
Okay, so you have three tracks.

293
00:20:52,640 --> 00:21:04,480
Each piece of information that gets swiped off of it on the magnetic strip card reader is a track of data, and they were originally specified throughout the years of what track 1 would be, what track 2 would be, and what track 3 would be.

294
00:21:04,740 --> 00:21:06,660
So let's talk about track 1.

295
00:21:06,660 --> 00:21:17,540
Track 1 is pretty much, if you're going to be parsing a credit card, it's going to be a caret, the shift 6 caret.

296
00:21:17,540 --> 00:21:21,000
That's your deliminator to parse it out.

297
00:21:21,580 --> 00:21:26,220
When you have a successful swipe on a credit card, it's going to be percent B, capital B.

298
00:21:26,220 --> 00:21:27,780
That's going to be the very first two digits.

299
00:21:27,780 --> 00:21:33,740
If you don't see that, it's probably not a credit card, or it's a fake, and it shouldn't go through in any credit card transaction.

300
00:21:34,440 --> 00:21:36,780
Next, you'll get the caret that says, hey, I'm going to start the next field.

301
00:21:36,780 --> 00:21:42,520
The next field is your name, and it's usually in all uppercase, and as much of your name as they can squeeze on there.

302
00:21:42,600 --> 00:21:44,640
Some people actually append the name.

303
00:21:44,640 --> 00:21:51,820
So if you have a really, really long name like mine, if you noticed on the cue cards, Imhoff Ducharme, they actually parsed mine, so it's Imhoff D.

304
00:21:52,740 --> 00:21:59,680
So that's how that works out, because they found that some readers can't read all the characters, and it actually drops it off.

305
00:21:59,700 --> 00:22:02,900
So they just said, well, and then it won't even authorize, because it breaks.

306
00:22:02,900 --> 00:22:04,740
It kind of crashes the box.

307
00:22:04,740 --> 00:22:09,820
So if you have a really long name, don't go to checkers, because your card won't work.

308
00:22:10,600 --> 00:22:15,040
Okay, so and then after that caret, you're going to have your credit card number.

309
00:22:15,040 --> 00:22:19,600
And then it's going to have the credit card number, which is anywhere between 13 and 16 digits.

310
00:22:20,100 --> 00:22:27,000
13 was the original American Express and Diners Club, and Visa cards were 14 and 15.

311
00:22:27,500 --> 00:22:30,980
And now American Express is 15 and 16.

312
00:22:31,160 --> 00:22:33,100
So you can have between 13 and 16.

313
00:22:33,100 --> 00:22:34,360
You're allowed up to 19.

314
00:22:34,360 --> 00:22:38,080
There's some cards that they're trying to put on the market that will be 19 digits long.

315
00:22:38,600 --> 00:22:39,980
So look forward to those.

316
00:22:40,380 --> 00:22:43,560
And then after that, you'll have equals, and then you'll have four digits.

317
00:22:43,560 --> 00:22:48,180
Now, these four digits are very special digits, because you have to really pay close attention.

318
00:22:48,180 --> 00:22:50,040
It'll be your expiration date.

319
00:22:50,040 --> 00:22:58,660
But if your expiration date is, I don't know, January 2008, so 01-08, it will not show up equals 01-08.

320
00:22:58,660 --> 00:23:01,180
It'll show up 08-01.

321
00:23:01,180 --> 00:23:06,100
So that's like their little security through obscurity thing, where they just kind of flip them around.

322
00:23:06,380 --> 00:23:09,100
And it's also susceptible to the Y2K bug.

323
00:23:09,100 --> 00:23:10,540
I know we all felt that.

324
00:23:12,660 --> 00:23:13,960
Notetakers on that joke?

325
00:23:13,960 --> 00:23:14,640
Okay.

326
00:23:15,000 --> 00:23:21,760
Okay, right after that, it's going to be your country code, your three-digit country code, because there's two-digit country codes, two-letter country codes, all that fun stuff.

327
00:23:21,760 --> 00:23:23,900
So your three-digit country code, which...

328
00:23:23,900 --> 00:23:30,860
So you'll usually see the expiration date, and you'll immediately see 101 for everybody here in the United States, because that's our international three-digit country code.

329
00:23:30,860 --> 00:23:32,560
And after that's the fun data.

330
00:23:32,560 --> 00:23:34,420
That's the stuff that everybody really wants.

331
00:23:34,420 --> 00:23:36,900
Because you can get the credit card number off the front.

332
00:23:36,900 --> 00:23:39,100
You can get the expiration date off the front.

333
00:23:39,100 --> 00:23:40,900
You even know which country it came from.

334
00:23:40,900 --> 00:23:42,360
Okay, so what's next?

335
00:23:42,360 --> 00:23:44,420
Well, that's the card verification version 1.

336
00:23:44,420 --> 00:23:45,960
That's the discretionary data.

337
00:23:46,300 --> 00:23:48,640
And that's immediately following all that.

338
00:23:48,700 --> 00:23:51,360
And after that, you get a caret, which says, I'm done.

339
00:23:51,360 --> 00:23:56,400
And then when track 2 starts, you get a semicolon saying, I'm now ready for track 2.

340
00:23:56,480 --> 00:23:58,380
Credit cards only use track 1 and track 2.

341
00:23:58,380 --> 00:23:59,660
They do not use track 3.

342
00:23:59,660 --> 00:24:07,360
That's mostly used for, like, players' club cards here in town at the casinos and the Moose Lodge, if you're into that sort of thing.

343
00:24:08,000 --> 00:24:10,240
You know, they have your pin there, maybe.

344
00:24:10,240 --> 00:24:10,980
I don't know.

345
00:24:11,300 --> 00:24:16,600
So track 2 now switches the format in which you're going to have discretionary data.

346
00:24:16,600 --> 00:24:20,200
It's going to be semicolons separating everything.

347
00:24:20,200 --> 00:24:23,140
So you're going to parse everything out based on semicolons instead of carets.

348
00:24:23,480 --> 00:24:26,320
And so you're going to get, once again, the full credit card number.

349
00:24:26,320 --> 00:24:29,800
Then you're going to get equals, and then you're going to get the expiration date, which is traversed.

350
00:24:29,800 --> 00:24:31,700
Then the country code, 101.

351
00:24:31,700 --> 00:24:33,380
Then your discretionary data.

352
00:24:34,240 --> 00:24:35,200
That's it.

353
00:24:36,340 --> 00:24:38,480
Okay, so you guys are like, well, that's just like track 1.

354
00:24:38,480 --> 00:24:39,360
What's GIVS?

355
00:24:39,380 --> 00:24:41,440
Well, I don't know.

356
00:24:41,740 --> 00:24:44,500
You get less... nobody knows the answer to that.

357
00:24:44,500 --> 00:24:46,720
They added track 2 as a security feature.

358
00:24:46,720 --> 00:24:51,780
They're like, well, that's card verification version 1, even though it's the same exact discretionary data as track 1.

359
00:24:51,780 --> 00:24:57,100
And by having that, pretty much what that meant is we're tired of using these old and busted.

360
00:24:57,120 --> 00:24:58,220
You know, so old and busted.

361
00:24:58,220 --> 00:25:01,180
These new hotness and genicodes.

362
00:25:01,920 --> 00:25:05,640
So we want you to switch over to those, which are giving us more revenue.

363
00:25:05,640 --> 00:25:10,220
Which means that you can accept track 2, which will give you a better rate on your transactions.

364
00:25:10,920 --> 00:25:11,920
So you have track 2.

365
00:25:12,100 --> 00:25:12,940
And that's what that's all about.

366
00:25:12,940 --> 00:25:15,760
And it ends with a semicolon, and that's the end of the story there.

367
00:25:15,760 --> 00:25:26,180
If it doesn't work, if you swipe your card and kind of half swipe, or you swipe it too quick, or it's a dirty scanner, then you're going to get a percent E semicolon percent E semicolon, which means error reading card.

368
00:25:26,180 --> 00:25:26,900
Try again.

369
00:25:28,440 --> 00:25:29,080
Okay.

370
00:25:29,380 --> 00:25:30,340
Transaction flow.

371
00:25:30,580 --> 00:25:31,120
Authorization.

372
00:25:31,120 --> 00:25:32,560
There's two flows, we should say.

373
00:25:32,560 --> 00:25:34,680
I didn't really put a slide before this.

374
00:25:35,280 --> 00:25:38,960
Flow 1 is authorizing the card.

375
00:25:38,960 --> 00:25:40,080
Flow 2 is settling the card.

376
00:25:40,080 --> 00:25:41,480
And we'll talk about the differences.

377
00:25:41,980 --> 00:25:47,040
So when you swipe the credit card and you have the dollar amount and all that fun stuff, you're going to get an initial authorization.

378
00:25:47,040 --> 00:25:53,460
And when that initial authorization goes through, like we said, it goes through the front-end processor, which is our local loop that connects everybody.

379
00:25:53,680 --> 00:26:05,820
If we had a yardstick, and we're talking about processors, by the way, and you have a big, huge, long yardstick, we'd say the entire bit of that yardstick, except for one inch, is First Data Corporation, FDC.

380
00:26:05,920 --> 00:26:09,240
They are the biggest front-end processor out there, hands down.

381
00:26:09,240 --> 00:26:16,080
And then everybody else, Nova, NDC, MAP, Citco Alliance, all those guys, they're one inch.

382
00:26:16,180 --> 00:26:18,700
And that's the competition you have to work with out there.

383
00:26:19,380 --> 00:26:23,420
So that's something I'll leave aside, a little extra nugget for you guys.

384
00:26:23,920 --> 00:26:26,160
So then you get to the front-end processor.

385
00:26:26,160 --> 00:26:27,940
Front-end processor checks the card number.

386
00:26:27,940 --> 00:26:32,400
First six digits are going to tell you, on the credit card number, who the issuing bank is.

387
00:26:32,640 --> 00:26:38,620
So when you have, I don't know, five, you automatically know that's a MasterCard.

388
00:26:38,620 --> 00:26:43,240
When you have six, you automatically, or 6011, you automatically know that's Discover.

389
00:26:43,360 --> 00:26:46,680
When you have four, you automatically know that that's Visa.

390
00:26:46,680 --> 00:26:50,060
When you have three, eight, it's American Express.

391
00:26:50,060 --> 00:26:51,640
Three, six, it's JCB.

392
00:26:51,640 --> 00:26:57,600
Three, five, it's old-school Visas that were 13 digits long.

393
00:26:57,720 --> 00:27:01,720
And I don't believe there's any cards that's now still in existence that had two.

394
00:27:01,720 --> 00:27:05,380
There were some people that played around with it, but that was mostly reserved.

395
00:27:05,380 --> 00:27:12,480
00 and 10 are reserved for private label cards and stuff like that, which we'll get into in a little bit.

396
00:27:13,000 --> 00:27:16,200
So the first digit, right off the bat, tells you what type of credit card it is.

397
00:27:16,280 --> 00:27:22,220
Then the next five digits, or the first six-digit chunk, will tell you exactly which bank it's coming from.

398
00:27:22,300 --> 00:27:26,180
And I believe there's somebody that's actually working on a project out there right now.

399
00:27:26,180 --> 00:27:27,900
It was on Slashdown about six months ago.

400
00:27:27,900 --> 00:27:31,480
Who is trying to get everybody's first six digits and say, which bank do you have?

401
00:27:31,480 --> 00:27:37,660
And trying to reverse enumerate everybody's credit card banks and everything.

402
00:27:38,960 --> 00:27:42,240
So far, what we know is that there's some specifications.

403
00:27:42,240 --> 00:27:52,000
If you ask really, really nicely and say you're an ISO bank, they will give you some customer service places that you can just call and say, I need the list, and the list will email it to you.

404
00:27:52,420 --> 00:27:54,700
So, yeah, it's kind of goofy.

405
00:27:54,700 --> 00:27:56,720
We'll get into that in a little bit, too.

406
00:27:57,900 --> 00:28:00,080
FEP, the front-end processor, this is the beauty.

407
00:28:00,080 --> 00:28:01,200
These are the awesome guys.

408
00:28:01,200 --> 00:28:03,880
They're like, we have a lot of money, and we want to get a lot of more money.

409
00:28:03,880 --> 00:28:05,820
How can we possibly do that?

410
00:28:06,280 --> 00:28:09,160
Well, we're going to just authorize people's credit cards.

411
00:28:09,340 --> 00:28:12,740
And then not even have to worry about doing anything with them.

412
00:28:12,740 --> 00:28:16,240
So that's why I say FEPs are hands-off, because they're bonded.

413
00:28:16,240 --> 00:28:21,040
They have like, you know, $1 billion insurance policies on all the cards that go through.

414
00:28:21,340 --> 00:28:28,000
And all they do is say, I have the money to say that I can vouch for this process going through, and nothing bad will happen.

415
00:28:28,000 --> 00:28:30,260
And then they just let transactions float by them.

416
00:28:30,260 --> 00:28:38,900
They just pretty much, you know, grab the card, take it, hand it off to the issuing bank, get the response from the issuing bank, record the result, and then send it back.

417
00:28:38,900 --> 00:28:47,040
And they record the result on behalf of the merchant, because they have these little trans-tradies, only got 56K of memory, don't have enough to remember everything.

418
00:28:48,480 --> 00:28:54,800
Which is now changing with the new virtual world and the front-end processor gateways and everything like that, which they're losing revenue on.

419
00:28:54,800 --> 00:29:00,260
But they pretty much just say, oh, I'll just remember that you had an authorization, and just let me know when to close it out.

420
00:29:00,260 --> 00:29:02,260
So they're just handing money back and forth.

421
00:29:02,340 --> 00:29:06,580
That's their only purpose, is we connect you to us and us to them.

422
00:29:06,580 --> 00:29:15,020
And they charge you to connect to them, and then front-end processors like FDC will charge them, because they have all the clients.

423
00:29:15,580 --> 00:29:21,380
So they get money from leasing the lines, they get money from the merchants, they get money from the transactions, and they get money from the banks.

424
00:29:21,400 --> 00:29:23,880
And all they do is just say, thank you, you're welcome.

425
00:29:23,880 --> 00:29:29,160
So it's a pretty sweet gig to get into if you want to get on the new hotness there.

426
00:29:29,160 --> 00:29:32,380
Just have like $1 billion laying around to bond yourself, and you'll be all set.

427
00:29:33,460 --> 00:29:35,660
Okay, back-end merchant link.

428
00:29:35,660 --> 00:29:37,480
We kind of briefly talked about that earlier.

429
00:29:37,600 --> 00:29:39,480
How are we doing on time, by the way?

430
00:29:40,420 --> 00:29:41,800
Where are my folks?

431
00:29:41,800 --> 00:29:43,620
Because I can just ramble for a while.

432
00:29:46,020 --> 00:29:46,820
Where's my...

433
00:29:46,820 --> 00:29:48,180
20 more minutes?

434
00:29:48,180 --> 00:29:49,860
We should probably speed up then.

435
00:29:50,040 --> 00:29:51,400
You guys ready to go into high gear?

436
00:29:51,900 --> 00:29:52,900
All right.

437
00:29:52,900 --> 00:29:54,400
So back-end processor merchant link.

438
00:29:54,400 --> 00:29:55,960
We already talked about it, so we're skipping it.

439
00:29:55,960 --> 00:29:58,220
Issuing banks, we already talked about it, so we're skipping it.

440
00:29:58,740 --> 00:30:00,480
Front-end processor record updates.

441
00:30:00,480 --> 00:30:02,120
We kind of just talked about it.

442
00:30:02,720 --> 00:30:06,120
They just update the records, say, hey, I know that you did a transaction.

443
00:30:06,120 --> 00:30:06,800
All right.

444
00:30:07,420 --> 00:30:11,500
And then in return, the terminal prints out a receipt having the authorization code.

445
00:30:11,500 --> 00:30:12,660
You see that authorization code?

446
00:30:12,660 --> 00:30:14,280
It's a six-digit code on all the receipts.

447
00:30:14,280 --> 00:30:16,000
It comes directly from the issuing bank.

448
00:30:16,000 --> 00:30:18,020
Your bank itself gave that authorization code.

449
00:30:18,020 --> 00:30:21,900
Not the back-end processor, not the front-end processor, not the merchant itself.

450
00:30:21,900 --> 00:30:24,040
But your actual issuing bank talked to them.

451
00:30:24,800 --> 00:30:25,100
All right.

452
00:30:25,100 --> 00:30:26,360
Transaction flow settlement.

453
00:30:26,360 --> 00:30:29,180
Now, at the end of the night, you want to settle everything out.

454
00:30:29,180 --> 00:30:30,240
Has anybody ever had this?

455
00:30:30,240 --> 00:30:33,140
Because I certainly haven't, because I'm really responsible with my money.

456
00:30:33,320 --> 00:30:41,340
Has anybody ever had this where it says available balance is $500, but it says that your account balance is $800?

457
00:30:41,620 --> 00:30:44,820
You're like, how in the heck can I have two separate balances in my account?

458
00:30:44,820 --> 00:30:45,940
How is this possible?

459
00:30:45,940 --> 00:30:55,660
And this is because when CheckCard switched over to Visa and MasterCard to accept that logo, they went through an authorization and settlement cycle that they now acquired from the banks.

460
00:30:55,660 --> 00:31:02,700
And authorization pretty much means I authorize this money on your account and I hold it on your account, but I don't actually take it out of your account.

461
00:31:02,720 --> 00:31:05,500
That's the important thing to remember about authorization and settlement.

462
00:31:05,500 --> 00:31:06,780
I'm just going to hold it.

463
00:31:06,780 --> 00:31:08,120
I'm not going to do anything with it yet.

464
00:31:08,120 --> 00:31:14,420
I'm just making sure... well, I can't say that's derogatory, but I'm C-blocking you from actually using that money.

465
00:31:15,620 --> 00:31:19,520
So you have that money held, but let's say they don't take it out in a timely manner.

466
00:31:19,520 --> 00:31:20,700
Let's say a week or two.

467
00:31:20,820 --> 00:31:28,940
Well, then that money just absorbs away and just disappears and it no longer is held because they can only hold it out of your account for so long before they take it out.

468
00:31:28,940 --> 00:31:31,480
So they say, okay, they never took it.

469
00:31:31,480 --> 00:31:32,800
Maybe they were just kidding.

470
00:31:32,880 --> 00:31:33,580
I don't know.

471
00:31:33,660 --> 00:31:35,480
And so then they just release the authorization.

472
00:31:35,480 --> 00:31:38,460
So now your money comes back available to you.

473
00:31:38,460 --> 00:31:42,460
So you're like, wow, they forgot to charge me.

474
00:31:42,600 --> 00:31:44,160
How cool is that?

475
00:31:44,160 --> 00:31:46,640
I'm going to go pick me up a new pair of pants.

476
00:31:46,640 --> 00:31:47,240
I don't know.

477
00:31:47,240 --> 00:31:50,360
I'm going to go get some pantalones and all that fun stuff.

478
00:31:50,480 --> 00:31:52,960
And so then they go, oh, we forgot to charge them.

479
00:31:52,960 --> 00:31:53,580
Oh, my goodness.

480
00:31:53,580 --> 00:31:54,660
Close that terminal.

481
00:31:54,680 --> 00:31:55,540
And then they charge you.

482
00:31:55,540 --> 00:31:56,320
And then what happens?

483
00:31:56,320 --> 00:31:57,180
You overdraw.

484
00:31:57,180 --> 00:31:59,820
You incur bank fees and all that stuff.

485
00:31:59,820 --> 00:32:01,000
Why are you irresponsible?

486
00:32:01,300 --> 00:32:02,340
Although they were.

487
00:32:02,420 --> 00:32:03,840
Well, we're still going to charge you.

488
00:32:03,900 --> 00:32:08,320
So that's how that comes into play because of this authorization and settlement thing.

489
00:32:08,320 --> 00:32:11,000
And this has happened since the beginning of credit cards.

490
00:32:11,000 --> 00:32:12,920
And it's like a very bad process.

491
00:32:12,920 --> 00:32:16,000
And it's impossible to get rid of because it's just so thick.

492
00:32:17,720 --> 00:32:20,340
So we just kind of went through that whole thing right here.

493
00:32:20,340 --> 00:32:21,840
So we're going to go on to the next slide.

494
00:32:21,840 --> 00:32:22,860
Data storage.

495
00:32:25,960 --> 00:32:29,220
So there's a lot of grab ass going on with your personal data.

496
00:32:29,820 --> 00:32:31,340
Especially by MasterCard.

497
00:32:31,380 --> 00:32:33,880
What they like to do is do a lot of data mining.

498
00:32:33,880 --> 00:32:44,860
If you guys ever subscribe to a network security magazine or networking magazine, one of those CMP press ones, it's just like there's a whole bunch of ads and fluff and one good article every month.

499
00:32:45,260 --> 00:32:47,100
Sorry to CMP if you're out there.

500
00:32:48,080 --> 00:32:53,120
So they actually had a really great article about MasterCard and everything.

501
00:32:53,120 --> 00:32:56,940
And after reading it, I had to like go dive in and call them and see if this was true.

502
00:32:56,940 --> 00:33:03,760
And they have like terabytes upon terabytes upon terabytes of every single transaction that you ever did stored at MasterCard International.

503
00:33:03,900 --> 00:33:08,580
Even though it's going to the issuing bank, we kind of talked briefly about that back-end processors.

504
00:33:08,580 --> 00:33:10,180
Who are those back-end processors?

505
00:33:10,180 --> 00:33:12,480
Well, MasterCard is just this entity.

506
00:33:12,740 --> 00:33:14,320
They're just on paper.

507
00:33:14,320 --> 00:33:15,380
They don't really exist.

508
00:33:15,380 --> 00:33:16,240
They don't do anything.

509
00:33:16,240 --> 00:33:18,120
They just sell their MasterCard name.

510
00:33:18,120 --> 00:33:20,680
Visa just sells its Visa name.

511
00:33:20,680 --> 00:33:22,460
It doesn't really do anything.

512
00:33:22,560 --> 00:33:24,460
Well, they're like, well, we can still do stuff with it.

513
00:33:24,460 --> 00:33:27,440
So MasterCard decided it's going through us anyways.

514
00:33:27,900 --> 00:33:31,340
And it just goes through us because it has to because we're MasterCard.

515
00:33:31,340 --> 00:33:34,620
We might as well store that data and do some data mining.

516
00:33:34,620 --> 00:33:41,460
So every single transaction you've ever done in your whole life on a MasterCard starting from 2004 is recorded in their database.

517
00:33:41,460 --> 00:33:43,540
And it's there for the highest bidder.

518
00:33:43,660 --> 00:33:45,580
They can say, hey, what's going on?

519
00:33:45,580 --> 00:33:49,380
I want to know more about people who like cheesecake.

520
00:33:49,820 --> 00:33:50,800
What else do they like?

521
00:33:50,800 --> 00:33:51,820
And they can make correlations.

522
00:33:51,820 --> 00:33:56,620
Well, guys who like cheesecake also like to buy lipsticks that vibrate for their wives.

523
00:33:56,620 --> 00:33:57,600
How about that?

524
00:33:57,940 --> 00:34:00,180
So let's have a special.

525
00:34:00,180 --> 00:34:03,380
Let's go down to Deja Vu and have Cheesecake and Lipstick Vibrator Day.

526
00:34:03,380 --> 00:34:05,000
Oh, wow, how did they know?

527
00:34:05,000 --> 00:34:06,380
That's just amazing.

528
00:34:08,180 --> 00:34:13,180
So if you ever wondered like, wow, how do they really know that I like this and that?

529
00:34:13,180 --> 00:34:17,600
It's because they data mine all of your credit cards and they see the trends in everything you do.

530
00:34:17,600 --> 00:34:20,020
And this has two good benefits, believe it or not.

531
00:34:20,020 --> 00:34:27,660
One of the good benefits is if you're just a guy who just goes to Starbucks every single day and gets a latte every single day.

532
00:34:27,660 --> 00:34:31,540
And then afterward you pick up the newspaper and a carton of milk from the store.

533
00:34:31,540 --> 00:34:33,660
And it's just repetitive over and over.

534
00:34:33,660 --> 00:34:40,400
And then one day you're like, I want 18 Starbucks coffees and I bought a big screen TV.

535
00:34:40,400 --> 00:34:42,820
They're going to be like, well, wait a minute, that's kind of funny.

536
00:34:42,820 --> 00:34:44,500
So it does have a benefit there.

537
00:34:44,700 --> 00:34:54,920
And those of you with MasterCards actually do get better call responses than some of the other issuing banks or card associations that license their name out.

538
00:34:55,020 --> 00:34:56,460
So you do get that benefit.

539
00:34:56,460 --> 00:35:00,920
But mostly it's just for, hey, we want to sell telemarketers your information.

540
00:35:00,920 --> 00:35:04,840
We want to sell marketing firms your stuff because they've got to do a new commercial this month.

541
00:35:05,200 --> 00:35:06,740
So who else holds it?

542
00:35:06,740 --> 00:35:08,700
The front-end processor we talked about, right?

543
00:35:08,840 --> 00:35:15,100
They temporarily hold it, but they have to actually hold it for five years for auditing and accounting purposes and accountability.

544
00:35:15,220 --> 00:35:17,380
So the front-end processor has your information.

545
00:35:17,380 --> 00:35:27,300
And of course, you know, if you guys were ever like driving across country, because that's always fun, just kind of cruise from Florida to Texas, you know, pick two obscure states.

546
00:35:27,300 --> 00:35:30,180
And somewhere in between there, there's this place called Louisiana.

547
00:35:31,040 --> 00:35:34,440
And, you know, you go into the gas station and they don't have a cooler.

548
00:35:34,440 --> 00:35:38,480
They have like an igloo cooler for their sodas and everything like that.

549
00:35:38,480 --> 00:35:40,820
And, you know, they just got stuff all over the place.

550
00:35:40,820 --> 00:35:46,300
And you're swiping your card and it's an old terminal and your credit card data is just showing up on all the receipts.

551
00:35:46,300 --> 00:35:52,480
And they're just stuffing it in a shoebox because they were told to do that, but they didn't know that they only had to stuff it in a shoebox for two years.

552
00:35:52,480 --> 00:36:01,760
So they got ten years of like, you know, every guy that traveled from Florida to wherever else through Louisiana who just wanted a cola out of their igloo cooler.

553
00:36:02,280 --> 00:36:04,940
They got all their credit card information is sitting there.

554
00:36:05,280 --> 00:36:06,840
So they're holding your data.

555
00:36:08,300 --> 00:36:11,520
Hotels, auto rental, the worst of the worst.

556
00:36:11,520 --> 00:36:14,980
Because hotels, very high rate for fraud.

557
00:36:14,980 --> 00:36:18,280
Auto rentals, it's a car, you're going to break it, that kind of stuff.

558
00:36:18,280 --> 00:36:19,580
It's probably no good.

559
00:36:20,240 --> 00:36:25,060
So you're running into these two things where they take a bunch of information from you.

560
00:36:25,060 --> 00:36:26,180
I need your address.

561
00:36:26,180 --> 00:36:27,640
I need your zip code.

562
00:36:27,640 --> 00:36:29,460
I need your first born.

563
00:36:29,580 --> 00:36:31,620
I need, you know, all this other stuff.

564
00:36:31,740 --> 00:36:39,600
And you're just like, oh my god, they have my address, my full name, social security number, I don't know, all this other goofy stuff just for me to check in.

565
00:36:39,600 --> 00:36:42,200
And that's bundled right there with your credit card.

566
00:36:42,660 --> 00:36:49,740
So if I were some guy who's a carter, as they're called in this scene, the test scene, right?

567
00:36:50,840 --> 00:36:56,160
If I was one of those guys, I would go out and I would probably be going after a hotel or an auto rental.

568
00:36:56,260 --> 00:37:03,440
Especially one of those podunk ones way out in the middle of Louisiana that has all their stuff sitting in a shoe box along with your full address and everything like that.

569
00:37:03,440 --> 00:37:05,880
And they can just mine all your stuff and you'll never know.

570
00:37:06,560 --> 00:37:08,940
So there you got some information there.

571
00:37:08,940 --> 00:37:12,000
And of course your issuing bank also keeps a record of everything.

572
00:37:12,000 --> 00:37:17,100
So you got issuing bank, you got the card association, you got the front end processor, and you got the merchant.

573
00:37:17,100 --> 00:37:19,000
All these people have your information.

574
00:37:19,880 --> 00:37:21,280
Is that a good thing?

575
00:37:21,340 --> 00:37:22,440
Probably not.

576
00:37:22,460 --> 00:37:23,640
Are they changing it?

577
00:37:23,640 --> 00:37:25,120
Not in the least bit.

578
00:37:25,480 --> 00:37:27,400
But that's just the way things are.

579
00:37:27,520 --> 00:37:28,160
Time?

580
00:37:29,040 --> 00:37:31,000
Where's my speaker goon guy at?

581
00:37:34,340 --> 00:37:35,540
He's supposed to tell me.

582
00:37:35,540 --> 00:37:36,380
How much?

583
00:37:37,700 --> 00:37:39,340
Twelve minutes, okay.

584
00:37:39,920 --> 00:37:41,380
Oh, hey, there you go.

585
00:37:41,380 --> 00:37:43,660
We actually are at the questions and answers section.

586
00:37:43,660 --> 00:37:45,580
So we actually made it in time.

587
00:37:46,620 --> 00:37:49,480
We are at the questions and answers section.

588
00:37:50,860 --> 00:37:52,480
Hint, hint, nudge, nudge.

589
00:37:58,840 --> 00:37:59,640
RFID.

590
00:38:00,020 --> 00:38:02,760
RFID, what exactly do you want to know about RFID?

591
00:38:09,020 --> 00:38:10,400
They want to make money.

592
00:38:11,120 --> 00:38:12,240
They really want to make money.

593
00:38:12,240 --> 00:38:13,740
It's all about marketing and money.

594
00:38:13,740 --> 00:38:22,540
They want RFID because you have to pay for, you know, you have to have new vendors come in to get the RFID enabled.

595
00:38:22,720 --> 00:38:24,500
And it's going to speed up the process.

596
00:38:24,540 --> 00:38:26,560
McDonald's wants RFID really, really badly.

597
00:38:26,560 --> 00:38:27,100
Why?

598
00:38:27,100 --> 00:38:31,100
Because I can sling you a microwaved hamburger and get you the hell out of there.

599
00:38:31,100 --> 00:38:34,560
So I can get somebody else to sling him a microwaved hamburger and get him the hell out of there.

600
00:38:34,560 --> 00:38:35,600
So it just swipes.

601
00:38:36,060 --> 00:38:36,760
So does Walmart.

602
00:38:36,760 --> 00:38:37,360
They're working on it.

603
00:38:37,360 --> 00:38:38,320
Yes, right there.

604
00:38:38,960 --> 00:38:39,560
Bees!

605
00:38:39,620 --> 00:38:40,840
Bees everywhere!

606
00:38:43,460 --> 00:38:46,160
I believe that man has bees on him.

607
00:38:47,000 --> 00:38:49,020
Damn scavenger hunt kids.

608
00:38:50,480 --> 00:38:51,520
Okay, I'm sorry.

609
00:38:51,520 --> 00:38:52,480
You were saying?

610
00:39:03,130 --> 00:39:09,350
Well, I can't repeat what you said to everybody else because that's not supposed to be disseminated.

611
00:39:10,110 --> 00:39:15,750
But yes, he was talking about encryption and stuff like that.

612
00:39:15,750 --> 00:39:17,450
We didn't really get into debit cards.

613
00:39:17,450 --> 00:39:18,650
I really wish we could.

614
00:39:18,650 --> 00:39:22,790
They didn't have enough room for a two-hour because we can talk about Duck Put.

615
00:39:22,790 --> 00:39:26,730
By the way, Duck Put and all that fun stuff is the encryption used for debit pin cards.

616
00:39:26,730 --> 00:39:29,890
So if you know how to crack that one, which is super easy, it's like a one-way.

617
00:39:29,910 --> 00:39:33,270
You can get people's pin numbers flying across the line.

618
00:39:33,270 --> 00:39:33,990
Yes, sir?

619
00:39:39,260 --> 00:39:43,140
I cannot give you a concrete answer personally, but I would assume so.

620
00:39:43,500 --> 00:39:44,460
Oh, for sure.

621
00:39:44,460 --> 00:39:50,520
Personally, that would be a much easier way to data mine because it takes time for...

622
00:39:50,520 --> 00:39:53,540
The question was, do they data mine pin cards and debit cards?

623
00:39:53,540 --> 00:39:54,800
And I'd probably say yes.

624
00:39:54,800 --> 00:39:56,740
I'm not going to say yes, but probably yes.

625
00:39:56,760 --> 00:40:02,780
Because as soon as you swipe, it doesn't say this was at some place somewhere and we'll tell you later where it was.

626
00:40:02,780 --> 00:40:05,820
It says right away, he bought cookies at an a.m.

627
00:40:05,820 --> 00:40:06,340
p.m.

628
00:40:06,340 --> 00:40:07,340
Like right away.

629
00:40:07,400 --> 00:40:09,420
So it's actually more data in that.

630
00:40:09,420 --> 00:40:11,740
Because it's a newer technology, they can add more data.

631
00:40:11,740 --> 00:40:16,240
So I would believe that that would be the juicy nugget, so-called, that they would really want.

632
00:40:17,540 --> 00:40:19,760
Anybody else that doesn't have B problems?

633
00:40:19,760 --> 00:40:21,720
That gentleman right back there.

634
00:40:32,630 --> 00:40:34,790
It's similar and easier.

635
00:40:35,150 --> 00:40:44,130
The question was, the EasyPay, is the new ones that are coming out from RFID in general, and Chase has been promoting theirs.

636
00:40:44,130 --> 00:40:47,790
Is it anything like the EasyPay that's promoted by mobile?

637
00:40:47,790 --> 00:40:50,290
It's not exactly like it.

638
00:40:50,290 --> 00:40:56,250
But it's actually easier because the mobile one actually has strong encryption that was Texas Instruments proprietary.

639
00:40:56,250 --> 00:40:58,730
Until those cats over at the university broke it.

640
00:40:59,110 --> 00:41:01,550
But this one is not even proprietary.

641
00:41:01,630 --> 00:41:05,690
I don't remember it off the top of my head because you put me on the spot there.

642
00:41:05,690 --> 00:41:08,570
But it would be the equivalent of like ROT13.

643
00:41:08,570 --> 00:41:09,870
It's almost embarrassing.

644
00:41:13,010 --> 00:41:31,590
Actually, if you want to do some war driving fun with gas stations and stuff like that, which I would not promote, but if on the off chance you wanted to do something like that, all the terrible herps here in town use radio frequencies to throw all those LCD video onto those screens.

645
00:41:31,590 --> 00:41:33,490
And it's push, not pull.

646
00:41:33,490 --> 00:41:39,330
So if you just push data to it, you can push, you know, Goatsy onto all the screens.

647
00:41:39,330 --> 00:41:41,150
And we'd get a crack out of that.

648
00:41:41,530 --> 00:41:43,990
I've got to give my friend Ripsy here shouts out.

649
00:41:43,990 --> 00:41:46,630
He's the one that actually war drived that one and found out all that.

650
00:41:47,370 --> 00:41:48,310
Yes, sir.

651
00:41:50,190 --> 00:41:51,870
Actually, no.

652
00:41:52,390 --> 00:42:02,350
We actually had a hard enough time to actually get to the laptop because we screwed up with a lot of stuff organizing, getting here, like dropping off cars and picking new ones up, and it was in it.

653
00:42:02,390 --> 00:42:04,470
And we didn't get the program on here.

654
00:42:04,470 --> 00:42:08,110
I can swipe it and you can see it, but then you'd all see my credit card that's still active.

655
00:42:08,590 --> 00:42:09,870
And that wouldn't be fun.

656
00:42:10,390 --> 00:42:12,990
If you have a canceled credit card, I would be more than happy.

657
00:42:12,990 --> 00:42:13,370
Thank you.

658
00:42:13,370 --> 00:42:14,910
This is a team player right here.

659
00:42:20,960 --> 00:42:21,760
And now...

660
00:42:27,260 --> 00:42:29,200
A dingo ate her baby.

661
00:42:30,760 --> 00:42:31,680
All right.

662
00:42:31,780 --> 00:42:34,540
Dance scavenger hunt kids, I tell you what.

663
00:42:35,880 --> 00:42:36,680
Awesome.

664
00:42:37,100 --> 00:42:40,280
So, okay, if you guys just noticed up on the screen, I just opened up...

665
00:42:40,280 --> 00:42:41,920
Hey, how are we doing on time?

666
00:42:42,760 --> 00:42:43,700
He doesn't know.

667
00:42:44,540 --> 00:42:45,900
Six minutes, all right.

668
00:42:45,900 --> 00:42:48,900
If you noticed, I just opened up a notepad.

669
00:42:48,940 --> 00:42:50,400
Notepad, nothing special.

670
00:42:50,440 --> 00:42:53,800
Hell, I can make a new file and just, like, rename it and then swipe my card.

671
00:42:53,800 --> 00:42:56,100
So we're just going to swipe this really quick and see what happens.

672
00:43:05,300 --> 00:43:07,200
And somehow his name is not there.

673
00:43:07,200 --> 00:43:09,320
Is this a, like, ghost card or something killer?

674
00:43:09,780 --> 00:43:12,340
I don't know if your corporate would like that too much.

675
00:43:12,880 --> 00:43:16,100
Okay, so your name didn't pop up at the very beginning there.

676
00:43:16,700 --> 00:43:19,620
For whatever reason, is it just font issues?

677
00:43:22,820 --> 00:43:25,580
Well, we'll try this Vons card as well and show you the differences.

678
00:43:30,820 --> 00:43:32,460
All right, there's that Vons card.

679
00:43:32,460 --> 00:43:34,580
Well, at the very beginning, the first one you see there...

680
00:43:34,580 --> 00:43:39,100
And we probably should do this for you people with the Coke bottle glasses.

681
00:43:47,060 --> 00:43:49,180
Okay, I'm just kidding.

682
00:43:50,680 --> 00:43:52,880
All right, let's do 36.

683
00:43:54,820 --> 00:43:56,080
That's good enough.

684
00:43:56,900 --> 00:43:58,840
So we can kind of see this discretionary data.

685
00:43:58,840 --> 00:44:00,120
And I'll go through this.

686
00:44:00,120 --> 00:44:04,340
If we notice right here, right, this is not an expired card.

687
00:44:05,180 --> 00:44:08,260
Oh, it's canceled, okay.

688
00:44:08,260 --> 00:44:11,100
If we notice, we talked before about how they reverse them.

689
00:44:11,100 --> 00:44:13,760
So can everybody shout out what the expiration date is?

690
00:44:15,740 --> 00:44:18,320
Oh, that's right, February 2007.

691
00:44:18,520 --> 00:44:20,740
And then what did we say was the next three digits?

692
00:44:22,160 --> 00:44:23,440
March, I know my...

693
00:44:24,460 --> 00:44:26,280
Valentine's Day, I get suckered every time.

694
00:44:26,280 --> 00:44:27,660
I thought it was the third month.

695
00:44:27,660 --> 00:44:28,980
Come on, give me some slack.

696
00:44:30,040 --> 00:44:32,140
March, March 2007.

697
00:44:32,140 --> 00:44:34,820
Okay, so then what did we say was the next three digits?

698
00:44:35,840 --> 00:44:37,860
Country code, and 101 is?

699
00:44:38,540 --> 00:44:41,120
U.S., don't ask me to call anything else.

700
00:44:41,120 --> 00:44:42,960
And then here's all this discretionary data.

701
00:44:42,960 --> 00:44:46,940
It's just a bunch of zeros, and then there's that 5, 6, 4, 0, whatever.

702
00:44:47,500 --> 00:44:48,900
And then you see there's the question mark.

703
00:44:48,900 --> 00:44:50,620
That's actually, good thing we swiped it.

704
00:44:50,620 --> 00:44:53,000
Good thing we swiped this, because I left out that delimiter.

705
00:44:53,000 --> 00:44:55,200
Question mark means end of track one.

706
00:44:55,400 --> 00:44:56,660
Then you have the semicolon.

707
00:44:56,680 --> 00:44:58,940
Then once again, you have the credit card number in full.

708
00:45:00,460 --> 00:45:03,320
Equals 0703, which is backwards, just as we said.

709
00:45:03,320 --> 00:45:04,760
101, international code.

710
00:45:04,760 --> 00:45:07,740
And look, the discretionary data is exactly the same.

711
00:45:07,820 --> 00:45:09,720
And then question mark to say it's done.

712
00:45:09,840 --> 00:45:11,320
And then the next one is a bonds card.

713
00:45:11,320 --> 00:45:17,980
As you can see, you know, private label cards and stuff, and fun stuff to get discounts on stuff that should already be that cheap.

714
00:45:20,020 --> 00:45:22,320
It has its own format and everything.

715
00:45:22,760 --> 00:45:24,640
So that's your swipe code.

716
00:45:24,640 --> 00:45:26,500
And once again, let me remind you.

717
00:45:26,500 --> 00:45:29,640
If you go to the Hackajar eBay sale for $35...

718
00:45:29,640 --> 00:45:30,220
No, I'm just kidding.

719
00:45:30,220 --> 00:45:31,060
I don't have one.

720
00:45:31,580 --> 00:45:34,300
For like $35 to $40, you can get these online.

721
00:45:34,360 --> 00:45:40,220
Believe it or not, the PS2 ones are more expensive than the USBs.

722
00:45:40,220 --> 00:45:40,660
I used the...

723
00:45:42,920 --> 00:45:43,640
Excuse me.

724
00:45:43,640 --> 00:45:46,440
I used PS2 ones because they're universal across everything.

725
00:45:46,440 --> 00:45:51,240
You don't have to deal with USB drivers or stuff that thinks it needs drivers but doesn't really need drivers and all that.

726
00:45:51,240 --> 00:45:52,600
So that's why they're a little bit more expensive.

727
00:45:52,600 --> 00:45:53,940
And they're also harder to find.

728
00:45:54,340 --> 00:45:55,560
So, are we done?

729
00:45:55,560 --> 00:45:56,300
Are we got more time?

730
00:45:56,300 --> 00:45:58,000
We got a couple more questions maybe?

731
00:45:58,680 --> 00:45:59,400
Time check?

732
00:46:00,880 --> 00:46:01,920
Four minutes.

733
00:46:01,920 --> 00:46:02,720
Yes, sir.

734
00:46:06,100 --> 00:46:08,560
The one-time virtual cards, do they recycle their numbers?

735
00:46:08,780 --> 00:46:10,440
The numbers, one thing we didn't get into.

736
00:46:10,440 --> 00:46:13,940
We should probably cover that real fast for all you guys that are team players that stuck around.

737
00:46:14,900 --> 00:46:15,960
LUNMOD10 check.

738
00:46:16,820 --> 00:46:21,000
It's pretty much just barcodes, UPC codes.

739
00:46:21,020 --> 00:46:22,760
You put the number through an algorithm.

740
00:46:22,760 --> 00:46:25,120
And if it returns one, then that means that it's valid.

741
00:46:25,120 --> 00:46:26,040
If it doesn't, it's not.

742
00:46:26,040 --> 00:46:28,980
LUNMOD10 is the algorithm they use to verify the cards.

743
00:46:29,200 --> 00:46:31,160
So, it's very possible.

744
00:46:31,160 --> 00:46:32,220
It's just like MD5.

745
00:46:32,220 --> 00:46:33,500
You know, you're going to have some collisions.

746
00:46:33,500 --> 00:46:39,640
It's very possible that, you know, you go through so many cards and that have to conform to this LUNMOD10 that you're going to run into it again.

747
00:46:39,640 --> 00:46:42,760
It's not too much of an issue right now because there's so many combinations.

748
00:46:42,960 --> 00:46:51,380
But when those things get really popular, it might be an issue for those individual banks for credit cards colliding when you have virtual cards.

749
00:46:51,460 --> 00:46:54,360
And I think we can do one more question and then that way we can get everybody out.

750
00:46:54,360 --> 00:46:57,660
So, there's some guy waving like a banshee back there.

751
00:46:57,660 --> 00:46:59,220
I think it's a girl, actually.

752
00:47:01,560 --> 00:47:07,240
The CISSP, C-I-S-S, or C-I-S-P, the Cardholder Information Security Program.

753
00:47:07,280 --> 00:47:11,480
That's nothing like the Cubix information security stuff.

754
00:47:12,100 --> 00:47:14,960
CISSP, it was created by Visa.

755
00:47:14,960 --> 00:47:16,300
And it sucks.

756
00:47:16,700 --> 00:47:17,680
Hands down.

757
00:47:17,680 --> 00:47:20,700
They have what's called the Dirty Digital Dozen.

758
00:47:20,700 --> 00:47:29,640
And it's stuff like, you have to conform to this in order to authorize credit cards in an internet world or in a brick-and-mortar to internet authorization world.

759
00:47:30,440 --> 00:47:33,620
And they're like stuff like, do you have a firewall?

760
00:47:34,280 --> 00:47:36,300
Does everybody log in with their own account?

761
00:47:36,300 --> 00:47:38,180
It's like, well, thank you, Captain Obvious.

762
00:47:39,480 --> 00:47:42,580
But they certify these independent auditors.

763
00:47:42,580 --> 00:47:45,300
No offense to you guys because it's good money for you, I know.

764
00:47:46,200 --> 00:47:55,220
They certify these independent auditors to go out and be CISSP certified auditors that charge $25,000 to $40,000 per site just to say, yep, you have a firewall.

765
00:47:55,220 --> 00:47:56,720
Yep, you have limited access.

766
00:47:56,720 --> 00:47:58,940
Yep, you have individual account names.

767
00:47:59,040 --> 00:48:00,820
Great, you're certified.

768
00:48:00,860 --> 00:48:02,260
Give us $25,000.

769
00:48:02,820 --> 00:48:06,300
And you've got to do this every year in some cases.

770
00:48:06,520 --> 00:48:08,020
So I think it sucks.

771
00:48:08,020 --> 00:48:14,020
I think they're just using it as another way to grab money and not using what it's supposed to be used for, to secure credit cards.

772
00:48:14,020 --> 00:48:15,880
Make sure our transactions are safe.

773
00:48:16,460 --> 00:48:17,720
All that fun stuff.

774
00:48:17,840 --> 00:48:21,920
And I believe that's the last question we're going to have unless you're like, no, no, what about that last thing?

775
00:48:21,920 --> 00:48:22,440
Anybody?

776
00:48:24,520 --> 00:48:25,320
The who's?

777
00:48:25,320 --> 00:48:26,040
The bees?

778
00:48:26,080 --> 00:48:28,600
These scavenger hunt guys, man, I tell you what.

779
00:48:28,740 --> 00:48:30,200
You know, they just go nuts.

780
00:48:30,300 --> 00:48:32,900
All right, well, thank you so much, guys, for your patience and everything.

781
00:48:32,900 --> 00:48:35,760
And I appreciate everything you've done.