The evolution of PAN enumeration attacks: Tackling a growing threat to payment security

By exploiting automated processes, fraudsters can bypass payment security measures at a faster, subtler rate. The authors explain how payment-processing companies can increase their defenses and better protect their customers against this growing threat to their security.

Last April, a California-based payment-processing company successfully foiled fraudsters’ repeated attempts to use its clients’ credit card numbers for illegal transactions. The fraudsters used brute-force methods to guess bank information numbers (BIN), the first six digits of a payment card that identify the issuing financial institution.

In this case, the attack on the company’s network of merchants strayed from conventional BIN-testing methods where attackers concentrate only on a small number of merchants. Instead, fraudsters attempted transactions with the payment card information at a few hundred small merchants, using each merchant for two authorization attempts before abandoning them, making the attack difficult to detect. Because each merchant processed such a low volume of fraudulent transactions, fraud detection measures that traditionally flag spikes in activity were ineffective.