Rpgnow creditcard information stolen

[Le Noir Faineant]

Okay, I googled my name. No stolen credit card information, but I did find out that there is a British rugby player who shares my name.

The list was available via the web until yesterday evening. Today, it seems that the page was removed, at least from the google index.

I have checked the list and made sure that I wasn't affected. (Or at least, didn't seem to be.)

Any googling past Saturday will most probably not help.

Again, I think the crisis mangement from RPGNow is poor. A public announcement would be the only thing to do, really.

I still have the list with the respective numbers saved on my pc and will check the names of those who are not sure if they were affected, if there's interest. (No, I am not a criminal nor a hacker, I just wanted to have a proof, should I be affected in the end.)

It seems, that sadly, checking an illegal paper oneself is the only way to make sure noone abuses one's credit card.
I repeat, I was always happy buying at RPGNow, and I was never unsatisfied with the quality of their scans, but here, I think they do wrong.

 

[two]

PayPalsucks.com

That's always the best bet online, whether you buy from an online mall or directly from a manufacturer's or publisher's store. Between ebay and everything else they handle (millions and millions of transactions each month), I hear almost no nightmare stories and there is usually more to it than what is heard (someone who didn't update information with their bank after a move, thus causing some possible suspicion in regard to a card or account, someone who stored their info on their computer, as well, and didn't maintina proper protection on their home or work system, someone who believes it is the only place they used a card but actually having gone to a shady site that asked for "verification" information, someone who made the mistake of giving information to a spoof emailer pretending to be paypal, etc.) Only using Paypal, through the secure Paypal interface, is about as foolproof as anything online, and much moreso than handing off your card in a restaurant or other business where it might be out of your sight for a number of minutes.

PayPal is under many federal and state investigations, has been the target of many successful class-action suits, and has caused a lot of pain for a lot of innocent people.

PayPal is not a bank, and not a credit card. If you lose money through a fraudulent paypay hack...transaction...whatever. It's gone. PayPal has no "money back guarantee".

Credit cards do!

You simply cannot lose money using a credit card even if it is hacked; the credit card company refunds the money.

There is no such safety net with PayPal.

One of the many common PayPal scams is to sell an item on Ebay, have somebody pay you with PayPal. Then the buyer gets the item, claims it is false or not as advertised to PayPal, and gets his money returned by claiming a charge-back. It is up to the seller to prove the item was as shipped and that the buyer recieved it... which is nearly impossible. PayPal simply has no interest in figuring out these scams; they collect their percentage, and tell the seller to contact...the police. Or some such.

To sum: always use a credit card, never use PayPal.

PayPal is not a bank; they are not regulated (currently); you have no legal rights when you give them money and access to your financial data. PayPal gets away with ALL kinds of stuff a regulated bank never could.

PayPalSucks.com is a good resource, once you wade through the spam.

 

[HinterWelt]

PayPal is under many federal and state investigations, has been the target of many successful class-action suits, and has caused a lot of pain for a lot of innocent people.

PayPal is not a bank, and not a credit card. If you lose money through a fraudulent paypay hack...transaction...whatever. It's gone. PayPal has no "money back guarantee".

Credit cards do!

You simply cannot lose money using a credit card even if it is hacked; the credit card company refunds the money.

There is no such safety net with PayPal.

One of the many common PayPal scams is to sell an item on Ebay, have somebody pay you with PayPal. Then the buyer gets the item, claims it is false or not as advertised to PayPal, and gets his money returned by claiming a charge-back. It is up to the seller to prove the item was as shipped and that the buyer recieved it... which is nearly impossible. PayPal simply has no interest in figuring out these scams; they collect their percentage, and tell the seller to contact...the police. Or some such.

To sum: always use a credit card, never use PayPal.

PayPal is not a bank; they are not regulated (currently); you have no legal rights when you give them money and access to your financial data. PayPal gets away with ALL kinds of stuff a regulated bank never could.

PayPalSucks.com is a good resource, once you wade through the spam.

That said, paypal will process credit cards as a merchant account. You do not store or transmit cc information between sites reducing risk and exposure.

 

[Michael Morris]

Let me clear up a few things about how payment gateways are normally set up.

1) OSCommerce and most all PHP platforms do not encrypt the CC information they are handling because they rely on Apache Webserver to do this task using SSL encryption. The webaddress on the page that takes the credit card information should start with https. If it doesn't DO NOT USE THAT MERCHANT because that is a clear sign they do not know what the hell they are doing when it comes to security.

2) Once the webform gathers the credit card info in must rely it to a payment processing agent. Paypal is one such agent, for better or worse. My company sets up it's clients with Verus. The server sends the information again over an SSL connection to the payment processor and will get a response code back from that agent of approved, declined, etc. This response is very brief but it's the same kind of response given by the little credit card readers.

3) PCI DSS has express guidelines for the storage of credit cards. A merchant who stores credit cards without that certification can lose his merchant account with Visa, Mastercard and Discovery even if he hasn't been hacked. It was first mentioned back in this post of the thread. The fines I mentioned are for those who haven't signed onto that standard and are the pertinent ones.

4) There is no reason to store an entire credit card number, but you can't encrypt it within the PHP code either because you have to extract it. PHP's internal encryption - md5, sha and one other are all one way processes. Here at ENWorld (or any vbulletin site) if you submit a password a javascript algorythm encrypts it before transfer. Once recieved a randomly determined salt string is added to the has and it all gets hashed AGAIN. md5 hashing is a one way process, there's no way to go back and figure out the password string used to determine the hash. It is for this reason recovery of passwords on this server is impossible - we can however reset the password to something else.

5) Typically this is what an online merchant should do with your card. The information is passed to the computer over an SSL encrypted connection (or an https address). The information is relayed to a payment gateway which then gives a response consisting of an approval code, and a reference code. The program then should store those at least two codes in the database for accounting reasons (they cannot be used to discover the credit card number). In addition I typically store a transaction number, customer number, serialized array of product number purchased, total amount of the transaction and the last 4 digits of the card used for the transaction (Not the entire card number). All this information is useful to the accounting office of the company but it is useless to a hacker out to steal.

 

[HinterWelt]

5) Typically this is what an online merchant should do with your card. The information is passed to the computer over an SSL encrypted connection (or an https address). The information is relayed to a payment gateway which then gives a response consisting of an approval code, and a reference code. The program then should store those at least two codes in the database for accounting reasons (they cannot be used to discover the credit card number). In addition I typically store a transaction number, customer number, serialized array of product number purchased, total amount of the transaction and the last 4 digits of the card used for the transaction (Not the entire card number). All this information is useful to the accounting office of the company but it is useless to a hacker out to steal.

And this (along with the SSL layer) is the important part. You can save yourself a lot of liability and your customers a lot of trouble with this bit of good design. If the information is not on your site, you cannot have it stolen.

And before anyone freaks, I meant you in the general all e-commerce sites not just the affected.

Bill

 

[molonel]

He is not, but I am. This is certainly a sensitive subject, and some amount of temper is understandable - all the more reason to ask for civil and respectful posts. Kindly take up further concerns with RPGnow directly and leave the motive-discerning off these boards.

To be completely honest, reading this didn't piss me off. Well, it did, but it was more than that.

It sent me off to Google to find the reporting pages for the fraud departments of Visa, Mastercard and American Express. I was halfway through an email to all three when I said to myself, "Self, you like James. Calm down, and don't let people telling you to hush up make you do something irrational."

Right now, this is the only place we can discuss this issue. This has affected a lot of people. I think it is more reasonable to allow the discussion to proceed than to simply tell people to be quiet, and take it elsewhere.

My two cents.

I had already emailed James yesterday, and received a reply that he had no record of a saved CC# for me.

 

[Mark CMG]

(snip)

Considering the vast amount of transactions, using your credit card with paypal is a much safer bet than using your credit card without it. I am sorry if you've had some problems but that puts you in a very small minority of people, a much smaller percentage than those who have troubles in other ways with online purchases, and smaller still than with credit card fraud offline.

 

[two]

warning, just a warning

Considering the vast amount of transactions, using your credit card with paypal is a much safer bet than using your credit card without it. I am sorry if you've had some problems but that puts you in a very small minority of people, a much smaller percentage than those who have troubles in other ways with online purchases, and smaller still than with credit card fraud offline.

I have never had any trouble. I investigated PayPal before signing up and never signed up after reading about it.

This is a verified insider posting about how PayPal works:

http://paypalsucks.com/forums/showthread.php?fid=6&tid=1529&old_block=0

(shivers)

Here is some typical info (from that thread):

"I'm amused by the posts that say, "But I've been a good customer of PP since the beginning and have paid thousands in fees.... why would they have done this to ME?" Let me answer that with a hypothetical question: If you were an unregulated financial services company so embittered by fraud losses that you, yourself, had completely lost whatever moral compass you might have once possessed, what would YOU rather have: a happy, content customer whos business might account for $5000 worth of fees over the next 10 years, or a person who's pissed off and will NEVER do business with you again, BUT you've got his $5000 up-front, TODAY- siezed directly out of his account with no appeal possible. Believe me, it's a no-brainer to these people. They have sort of developed a wierd corporate mindset wherein their past (and ongoing) victomization at the hands of con-artists somehow gives them license to "pass it along" to others."

Use your CC online, not PayPal, it's that simple. PayPal is unregulated... take the risk if you want.

I don't see any need to. I just use my CC

"using your credit card with paypal is a much safer bet than using your credit card without it" (your quote): absolutely false. PayPal offers no real fraud protection. And in fact giving PP your CC# is risky... What gave you the idea that PayPal makes you safer? Advertising?

With every legit biz accepting CC's these days, why bother bringing PP into it? Use your Visa/MC and if there is fraud, Visa refunds. Done.

Note: size means nothing. ENRON was huge, multi-billion, and rotten to the core. Size means nothing.

PPS: a reason why you should NOT give PayPal your info:

(from PayPalsucks.com thread)

"On another issue, I see lots of complaints from those who have BOUGHT things and paid through PP who find their credit cards suddenly drained and/ or billed multiple times for the same transaction. The answer is simple; PP has very lax hiring procedures, ESPECIALLY compared to the standards any bank would impose on anybody employed in a similar position of trust. But don't forget- PP ISN'T a bank, so they feel no obligation to hire (and, of course, compensate) people as if they were. Unlike the "account freezing" thing, the scams pulled on buyer's credit cards aren't a part of any "master plan" by the company, but simply the work of some dishonest employees who nonetheless have access to ALL of a customer's personal information. Yes, it's scary. Schemes are rampent where a PP employee has a cousin or friend set up an account to receive payments in another name. Since it's an "inside job", these "phantoms" will, of course, sail through the PP application process with flying colors- even if all of the infomation was simply "made up". Then your easily-accessable credit card number is used as payment for phony "auctions" and so forth done through the phantom account. The PP employee who actually approves this transaction might very be the one running the scheme"


+++++YUCK!+++++++

 

[rpghost]

Considering the vast amount of transactions, using your credit card with paypal is a much safer bet than using your credit card without it. I am sorry if you've had some problems but that puts you in a very small minority of people, a much smaller percentage than those who have troubles in other ways with online purchases, and smaller still than with credit card fraud offline.

Except that if you do a charge back on something you bought using paypal as a gateway, they will typically seize your paypal account if you have one. Keep the money and cancel it. Aren't they nice.

I bought some MTG cards for my store tournament prizes last year for $500. The jerk sent me collectors set version (worth only $50) and claimed he could call them beta cause they were black boardered too. Obviously a scam. His ebay account was canceled. He was reported by many people. I had proof of the cards. BUt since he had proof of delivery of SOMETHING, paypal would not intervien to give me my money back. I was out $450. Why? Cause I paid with paypal and not a credit card.

Not to say credit card companies are any nicer to merchants either. 3 years ago we got hit for fraud in the severa thousands. While I caught it the very next day, not a single person wanted to know what the card number was, who it was, where anything was going to be shipped, nothing. They instructed me to refund the money to the card. Ok, I did, but what about the $70+ VISA kept as a processing charge? Well they didn't have to return that. We're just out of luck.

What about the times when customers we know for sure got their products. Delivery confirmations say so. One even sent OUR products back to the WRONG company and claimed to have returned them? Well every single case we got stuck with hundreds of dollars of lost product, refunded money, and on top of each one was a $25 or more chargeback fee.

The only thing the credit card companies care about, is the customer being happy. They'll screw anyone along the way. And they'll even try to sell you on insurance for something they will cover even if you don't have it.

James



James

 

[Le Noir Faineant]

BTW, it might be of some importance to you all that, along the credit card info, the personal addresses (each one's home) are also listed.

Just to make clear that it is not only the credit card number plus name plus expiration date.

Again, I must say that I feel fooled here.

A public announcement is long overdue. Like posters before me have said, this is a question not only of professionalism, but of moral integrity.