Square

[Molgera]

Hey all, Molgera here. Lurker for a while, made an account to post this because I saw it this morning and thought it may be of some use.

I have not used this myself, just happened to come across it, but I figure it may be of use to carders; Not exactly sure how it works but I'm sure the message could be intercepted with little work since it's all set up on your device.

https://squareup.com/

This works on iOS devices and android, and best of all it's free. Using it legitimately charges 2.75% of the purchase made through it, but also deposit directly to your bank account.
Set up bank accounts with fake names

[skygear]

You need to read more! It works on android and has for years!

Also, It works with iOS - meaning - iPhone, iTouch, iPad, etc. Not just iPhone.

[Mordisk]

I just got one.
Now to people i sell Herbs too i can say i take cash or credit. <3

[Molgera]

Originally Posted by skygear

You need to read more! It works on android and has for years!

Also, It works with iOS - meaning - iPhone, iTouch, iPad, etc. Not just iPhone.

I apologize, I do need to read more; It had been a bit of a late night for me -- the monkey who lies on my back had been up all night with his white girlfriend and kept me up too ;P

I shall revise the OP; still wondering if there would be a way to use this to grab CVV2s

[shopping cart for brains]

so can I use this to convert the credit on my credit card to cash in my bank account without having to worry about all that cash advance shit?

[Pathfinder]

I have 2 of em. I use them for my photography business. I think there the greatest shit ever because I can take credit card payment right a wedding reception or on location at a shoot. Its amazing...

[Molgera]

Originally Posted by shopping cart for brains

so can I use this to convert the credit on my credit card to cash in my bank account without having to worry about all that cash advance shit?

Right, it would work off the purchase APR instead of the Cash advance APR, it would only cost you 2.75% of the amount.

[skygear]

Yes, you could use the Square reader to capture CC info. It has been done already. However, you would need to write your own code or get a copy of the .app/.apk that has been written already for the "hack." The security firm that wrote the initial code/ white paper is not sharing it publicly to my knowledge.

I looked hard when the initial paper was released, to no avail.

[shopping cart for brains]

Originally Posted by Molgera

Right, it would work off the purchase APR instead of the Cash advance APR, it would only cost you 2.75% of the amount.

Would that be shady/illegal though? Both the card and the bank account would have my name on it.

[skygear]

Basically, the program was intercepting the info being read when the card was swiped. So the square program had to be running as well as the modified piece of code. If I remember correctly, there was talk of closing the vulnerability in a new hardware version of square.

The code was "listening" to the harmonic output/ raw data of the reader and converting the info to readable numbers.

[skygear]

We actually had a thread about this awhile back in BI too.

[SBTlauien]

Is Square a payment processor like PayPal, or does the device have to be linked up to a payment processor?

[skygear]

Square is a payment processor, YES - But it is a person to person deal. You get a card reader (Square), install the app on your phone and log in. Now you can ring up money and swipe a card as payment. Think of a regular POS in a store, thats all it is, but mobile now.

[SBTlauien]

What are the limits in dollar amount?

I noticed that a person could enter a number manually. So it appears that if the square account is linked to a prepaid bank account for deposit, the owner could charge a bunch of stolen cards, and then have the funds deposited the next day.

[skygear]

I'm not sure on the limits yet. I haven't had any issues with mine, but the funds transfer might be different now. Kind of like the original PP accounts... I'm an original square account and TOS have changed a couple times.

I will say this though, It logs GPS data. So watch your asses

[SBTlauien]

Do they just mail the device in regular USPS mail?

Are any addition requirements needed(besides a bank account, valid SSN, phone number)?

Are the transaction from a customer, to square, then to the bank account, really just one day?

Sounds to good to be true.

[skygear]

Yes - in the mail. Or you can go to an APPLE store and get it for $10 then Square will reimburse you the paid amount.

Nope - sign up, you'll see

I imagine YES for accounts not limited

[SBTlauien]

Is this the only service of it's kind?

I know I've seen the swipe things on Amazon, but I think that goes through a PC and program. I guess this would be the same, just with a phone.

[SBTlauien]

Don't these go hand-in-hand with carding?

[skygear]

No theres plenty of vendors with similar services. Most cater to actual businesses. You can do the same thing with a Business class PP account. They have a bluetooth reader and printer option. Mind you, there hardware is costly!

Square is the first to target the general public as well as business.

I had a reader attachment in the 90's that did the same thing. It was an attachment for a cell phone and required separate power supply. Then the whole thing plugged into the data port of the phone to run transactions.

Do a search for small business mobile terminals. Mobile POS.

[SBTlauien]

Originally Posted by muffins

and require a valid ssn to register.

Originally Posted by muffins

They also report to the irs and issue some kind of 1099 form

Amazon is now doing this with seller accounts that sell over 50 items in a year.

A valid SSN would easy for some people to obtain(it would also be needed to open the bank accounts that receive the funds), and the 1099 comes at the end of the year.

How serious is the GPS issue? Isn't a GPS location, in a radius of nine yards?

Would a person need to run socks and programs to make the buyers(stolen card numbers) look correct? I know little about carding.

[StrictlyBusiness]

Bump

[skygear]

http://www.equinoxpayments.com/ is another system for CC transactions. They offer SIM / GPRS terminals too.

[Bradley]

I processed a lot of money in six months through Squareup, I always sent receipts with emails and manually put in card info, I don't send six receipts over teh course of six hours to customers who had purchased from me over and over? 3 week verification process I ended up losing thereby requiring me to refund all those customers and seek checks to be sent to me. The value of the 6 orders that I didn't send out receipts for? 350$.

Fuck Squareup.

[SBTlauien]

Originally Posted by BradleyB93

3 week verification process

Is this verification process only forbnew accounts, or are the payments always delayed 3 weeks?

[Bradley]

Originally Posted by SBTlauien

Is this verification process only forbnew accounts, or are the payments always delayed 3 weeks?

For new accounts it is minimum, they will put a 3k/month limit on you at first. I maxed the 3k, but only pushed it to about 3.3k (They hold the remainder till the 30 day billing period). They did not require an ID, if I remember correctly but I did need to have a bank account and give my SSN. The deposits are done every night except Sunday.

The telephone customer service didn't work, after 3-4 months I asked for my limit to be raised, it was to 5k which worked well for me. Usually I sent out emails with receipts after every order w/ my location sent via GPS (you need to have GPS turned on your phone/itouch), but I didn't cuz I was staying with family for that day, when they unverified me then I had those hundreds pending in my account and the reverification process was about 5-10x the info I originally needed (credit card invoices, information on my product, customers, where i sold my products on, etc). If you start doing a lot of business though, you'll have to work with them to prove yourself without giving tax info (websites, user accounts on ebay/amazon).

Good luck, they make it very hard for those trying to deceive them.

[ourkansas]

One good use for square is , at walmart if you have lots of gift cards saved up from "returns" buy those vanilla visa prepaid gift cards , square reads them and you can get all that store credit into normal cash you could , perhaps pay rent/bills vacation, more drugs with.

[Define-Security]

Could those plastic readers be used to carding gift cards? Like scanning the cards in the store and going home and reading the data.

[SBTlauien]

Originally Posted by Define-Security

Could those plastic readers be used to carding gift cards? Like scanning the cards in the store and going home and reading the data.

I would think so, but I'm not sure. Those readers are really cheap.

[skygear]

Originally Posted by Define-Security

Could those plastic readers be used to carding gift cards? Like scanning the cards in the store and going home and reading the data.

Yes, but you would need an intercept software to capture the data.

[INEEDMONEY]

oooooh a square cc reeder, it mist bez able to steals teh moneyz eezy

[Define-Security]

Originally Posted by skygear

Yes, but you would need an intercept software to capture the data.

I messed around with one and it would output as audio data. What kind of software would be useful for decrypting that? I was thinking someone could carry around a iphone or something and record the audio and play it back for another program.

[skygear]

I believe "The Jerm" has that feature... It's been awhile since I have played with it though.

[SBTlauien]

Originally Posted by Define-Security

I messed around with one and it would output as audio data. What kind of software would be useful for decrypting that? I was thinking someone could carry around a iphone or something and record the audio and play it back for another program.

[skygear]

Originally Posted by SBTlauien

Referring to the way the "square" transmits the read data. Its in an audio form. Think of an old cassette tape. Same thing

[Define-Security]

Originally Posted by SBTlauien

Okay when you swipe a card through a square reader, it makes a weird sound and that sound is played into the square program. That program then decodes it and accepts the card.

Someone could record those sounds using the memo app on a iPhone or something similar and play it back to a program.

If you connect audio out from one device to microphone in on another, it plays back the audio. This is what I'm talking about.

[Define-Security]

Sbtlauien, if you want to find one of these. Here is a link to find stores that sell them.
https://squareup.com/retail

They are not source tagged, and have very small boxes. My friend grabbed one to play with.

[skygear]

Theres a black one(I'd like this one) and a white version... Apple stores have the Black for sure.

[Define-Security]

The black ones supposedly have encryption that the white ones don't. Don't quote me on that though.

Almost every store here carries the black ones. It's very hard to find the white square readers.

Edit- Carries, Not Carried. Big Difference

[SBTlauien]

Originally Posted by Define-Security

Okay when you swipe a card through a square reader, it makes a weird sound and that sound is played into the square program. That program then decodes it and accepts the card.

Someone could record those sounds using the memo app on a iPhone or something similar and play it back to a program.

If you connect audio out from one device to microphone in on another, it plays back the audio. This is what I'm talking about.

I see what you're saying. Basically if someone had a phone that they were selling things through, theybcould record the sound when people swipe thier cards. Wouldn't it be easier to set the phone up to intercept the data?

I'm going to have to check these out. I have the program on an android phone, but I haven't signed up yet.

I read that the card data could just be entered manually. Wouldn't this be easier for cards that require no PIN? Or does Square(and the others) only allow cards that require a PIN?