Tjyylli

I am testing a website which accepts invalid credit card numbers for reservations. The interesting thing is they do CC validation if the currency is USD, but not for any other currencies. Should I report this as a security issue or will it come under fraud management?

Should I report this as a security issue or will it come under fraud management?

There may be a business risk issue, which you can document under security, but how significant it is depends on the business.

You say the web site

accepts ... credit card numbers for reservations.

What are those reservations for?

If it's a hotel room, then there is limited potential for fraud, since the actual card would be required at check-in time. An attacker could attempt to impact service by blocking off rooms with bogus cards, thus reducing the pool legitimate visitors could reserve, but I see that as a minor concern based on scalability and sustainability issues.

If it's a game store that is purchasing stock based on pre-order reservations, then the store is extending actual capital to stock games they might then be stuck without buyers for. This sort of business is more threatened by invalid card reservations, because they're sinking real dollars into the expected sales those reservations indicate.

There are other businesses where 'reservations' are largely meaningless, a way to encourage engagement by the customer at no real cost. In these cases, the business impact is negligible.

The interesting thing is they do CC validation if the currency is USD,
but not for any other currencies.

And that may be reflective of business risk acceptance. If 99% of their reservations are in USD, then the risk of accepting invalid non-USD card reservations may be negligible. If implementing non-USD validation has any specific cost to it (fees from processor? coding time to handle if-then-else branches?) then it's a legitimate option to leave it out at 1% coverage.

There may be other controls and business processes that you are not aware of that mitigate the risk, such as verifying the credit card through a different processor, or calling the cardholder.

In all of the testing I've been involved with, there has always been a section of the report that lists interesting findings, but that are not necessarily security problems. I would expect this finding to be listed in that section.

Why do you assume an invalid credit card is either a security issue or fraud? It should be expected that users will sometimes enter the card number incorrectly. I've done it. Most everyone has done it.

If you aren't going to validate the card at the time of entry, then you lose two things:

1. The ability to correct an incorrect entry immediately


2. The ability to determine if it is a security/fraud issue

I would rather validate all cards than worry about fraud with the ones I don't validate.