<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Well...<br>
<br>
You could have a shared DB of MD5 hashed CC #'s (never store the actual
CC #) along with the first 4 numbers and last 4 numbers of the card.
You could count the number of merchants in the network the CC # has
been used with over a certain period of time, the IP address that the
CC # was used from, etc. One could then run some statistics on the CC
#'s. If there was too much traffic on a single card or on card
sequences, etc. you could alert the merchants and they could void the
charges or issue refunds.<br>
<br>
This would also be a good "single point of contact" for enhanced
verification techniques:<br>
- Debiting or crediting the account with a few pennies and getting to
user to enter the amount in another web site<br>
- Calling the user on the phone and getting them to answer a simple
math problem (what's 3 + 4) and recording their voice authorizing the
charge<br>
- Maybe more<br>
<br>
It could be an interesting project. Any thoughts on how many different
folks on this group would be willing to join a merchants group to build
something like this?<br>
<br>
snacktime wrote:
<blockquote cite="mid1f060c4c050619000972b7668e@mail.gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">Like SPEWS.org, maybe it's time for a CC blacklist for the iMerchant
community.
Anyone would be able to query the blacklist--a negative response would
indicate a merchant had chargebacks (or other trouble) on the CC#.
Anyone would be able to enter a CC# into the database. A legit. CC
holder would get off the list simply by changing his CC# with his bank.
The trouble with this is the vast community of underemployed lawyers.
</pre>
</blockquote>
<pre wrap=""><!---->
There aren't any legal issues with this as long as you have specific
defined critieria. You can't just put someone in a negative database
because you *think* they are fishy or you don't like them. negative
databases in the bankcard industry are common practice.
The problem is that negative databases don't make sense for stolen
cards. If a card is stolen get the bank to cancel it or investigate
it. Negative databases are usually for legitimate cardholders that
simply have a habit of charging back.
Chris
_______________________________________________
Asterisk-Biz mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Asterisk-Biz@lists.digium.com">Asterisk-Biz@lists.digium.com</a>
<a class="moz-txt-link-freetext" href="http://lists.digium.com/mailman/listinfo/asterisk-biz">http://lists.digium.com/mailman/listinfo/asterisk-biz</a>
</pre>
</blockquote>
</body>
</html>