Using My Python Skills To Punish Credit Card Scammers

so i got a scam text message today which isn't super uncommon i have an entire spam box full of these but when i get new spam text messages i haven't seen before i like to check them out i like to go through their entire process just to kind of see how the scam works and make sure that there isn't something new out there i use this info to advise my friends and family about these new scams and also to report these sites to whoever i can report them to and in nearly all cases i don't actually take any action on these particular scam messages however today was a little different the scammer did something that i wasn't expecting and i saw an opportunity for a clear and obvious way where i could punish him for his scammer behavior and naturally i'm a programmer so we're going to use programming to do that the exact scam message i got looks like this it says last car you still have 130 amazon bonus credit see what you can buy before it expires okay this is obviously a scam it's on amazon.com it's w1fbv.info so just to see how the scam works i take this url i copy it and i paste into an incognito window on brave browser which after about five redirects it lands me on this page it's got a counter offer expires whatever your customer do your survey you can claim a ps5 cool all right start survey click a bunch of garbage whatever here again it's all fake and i was saying ooh submitting answers i p check products available in stock whatever it's all a big scam it's all fake and then it says congratulations you get a free ps5 okay cool i get a free playstation 5 but what's the actual scam so i click claim reward oh fill in your shipping address pay a one dollar delivery fee so seeing this message is pretty clear what the scam is for those who are not familiar what they'll do is they'll ask you for your credit card you'll put your credit card in they'll say thank you for your order of course you will not get a playstation 5 but instead you'll get a bunch of fraudulent charges on that card when the person uses that card for some digital goods that can't be refunded okay so the question becomes how can i punish this scammer for his behavior so if i click continue it takes me to a new page so i landed on this page it says claim your one playstation 5 playstation today it's got shipping information payment information you put everything in and they steal it and that's kind of the end of the scam or so i thought so what typically do the situation is i fill in a bunch of junk data which you can see here i just put a bunch of numbers for the card number and cvb but when i click order now i saw a delay and then it said card is expired so this made me think are they using a real credit card processor to test the validity of the card instead of just storing it and trying it later so i dug a little deeper if it wants a non-expired card i'll change january to august i'll click order now and now i get a message invalid credit card number so the way payment process is check card validity is the use is called the lunds algorithm and having worked enough in e-commerce i know a bunch of test card numbers that aren't actually real cards but they do satisfy the lens algorithm and one of those numbers is four zero zero seven zero zero zero zero zero zero zero two seven so this is a valid card in that it's it passes that algorithm so when i click order now i actually get a completely new message transaction declined the cc payment type hyper card and or the currency usd is not accepted and it has a ref id and so i notice if i close this and i just click order now again of course it's going to decline again but i noticed that i get a completely different ref id and the reason this is so significant and here's where the punishment comes in is pretty much every payment gateway that i've ever used charges a very small fee for credit card to client so that means it's highly probable that every time i click that order now button it's charging him about five cents so it should be pretty clear at this point what my next move is and that's to create a program that just creates thousands of decline transactions and hopefully a huge bill for the scammer so first step pop open chrome console make another request and then actually analyze that request when it happens so that request appears be going to this url luckypro12.com ps5 includes slash whatever so we'll copy that over into our program as the url so next we have to imitate the actual request so look at the parameters that's being sent so if we scroll down we can see there's a whole bunch of form data we're probably only interested in just the cc information so cc number expiration and cvv so we will copy that into a variable called data and this will be our data that we're going to send to that endpoint and then finally we'll make the actual request so response equals request dot post url that equals data and then just print out response just to make sure everything's working so now we'll just come over to our terminal run the program and make sure everything's working so python 3 rec.pi it says blank fields okay so what this is telling me is that i can't just send the cracker information i also have to send all the other information so not a big deal we can just select all the remaining information as well we'll select all the way to the very top up to limelight character set come in here paste that into data use our little cursor magic create new fields for all these and that should be good so this is now an identical request so if we ride again everything should work properly let's give it a shot again and it worked great so we got that same message transaction declined every time i run it there's still about a two second delay but our script does work so what we could do now is we could just put this infinite loop but the problem with putting this in an infinite loop is that it's still taking two seconds to run so i run the programming infinite loop it it does keep making these these transaction decline requests but it's not quite going fast enough so i think we should scale this request rate up a little bit so for that we're going to need threads so we'll start by import threading and then we'll come back down here so start by creating a new thread target called do request and in d request we will put this infinite loop the goal here is to have say 50 threads sending requests all at once so we'll create a new list called threads we'll create a new loop for i in range 50 and then in here we will create a new thread threading.thread target equals d request with no args t dot damn equals true and then we will append t into threads then we need two additional loops one to start each thread i want to join each thread so we'll do i in range 50. we will do threads subscript i dot start then we will duplicate this again and do for join i have a small syntax error i forgot to put in so for i in range so we should see now is we should see 50 threads all running at once infinite loop and sending tons of transaction decline requests so we'll start this program over and see what it does so now oh yes now it's going very fast so you can see all these all these ref ids that are going up so we're sending tons and tons and tons of transaction declines so i'll let this run for a little bit now the transaction ids are like 20 000 higher than they were before and there was a point where it did freeze for a little bit but it does still seem to be running so i've continued to let it run it does seem to have slowed down a lot but i think we've pretty much sent them enough so i think we can stop it here anyway hope you enjoyed the video and hope you learned a little bit about programming python and remember the moral of the story is don't be a scammer because i'm not gonna let you get away with it thanks a lot for watching have a great rest of your day

Channel: Engineer Man

Views: 1,582,906

Rating: 4.9708304 out of 5

Keywords: python, credit card scammer, punish scammer, scam the scammer, programming, good deed, engineer man

Id: StmNWzHbQJU

Length: 7min 13sec (433 seconds)

Published: Sun Mar 28 2021

Reddit Comments

[u/WhyDoIHaveAnAccount9]

This is wonderful

[u/Scolli03]

I want to fight scammers so bad. I have plenty of programming skill in both python and c# but I don't know how to apply it in this situation. I wouldn't have made the ref id connection or know that they get charged for failed transactions. I want to learn how to fight back. I want to teach others how to fight back. I know scamming will never go away. But id like becoming a scammer to carry significantly more risk. I'm not a hateful person at all. I can't stand telemarketers and woukd love to reduce or stop the amount of telemarketing calls i get but they are just ppl doing thier job too. But scammers take advantage of innocent ppl. Stealing from the elderly and doing so with threats and fear. With the thousands they steal i woukd have no problem starting that script and getting up from my pc and going about my day. I'm sure It woukd get stopped some other way, probably fairly quickly, but if it didn't I wouldn't feel bad.

[u/iiMoe]

Honestly i still have no idea how to access the POST request data on other websites as in logging in to twitter or anything else

[u/levon9]

Ha .. this is great, going to share this with my classes! Thanks.