Cross-Selling Online Scams and Security Issues

An anonymous reader writes "The site 12 Angry Men recently published a discussion of a widely used but little-known online scam called 'cross-selling'. Essentially, after-sale shops cut deals with shady online retailers in an attempt to make a quick buck off of you after you've already bought something. 'What actually happens is that instead of linking to the site as a separate session, they link internally as another page in the same session. Why is this important? When you do a credit card transaction, any reputable company will attempt to protect your credit card data. They do this by establishing an SSL session to encrypt sensitive data on-line.' What makes everything even more interesting is that now the company has responded, with the usual white washing and meaningless statements."

Comments

12 Angry men

[Bloke down the pub]

From the linked article:

As an aside, organ donors in Europe have to opt-out to NOT become an organ donor

Not so much angry as ill informed. That's certainly not the case in the UK or Italy which, last time I checked, are part of Europe. I doubt the authors could point to either on a map.

Rampant Fraud

[Yahma]

I used to get $1.00 charges on my credit card that would go unnoticed for a few months. When I checked the company, they had a website that stated something to the effect:

"If you received a charge to your credit card for us, it is for services that we provided and it is not a fradulent charge."

Now, I never have purchased anything from this company, and even though the total charges were less than $3, I reported it to my credit card company. Some of these fraudulent companies can be very deceptive.

Re:At least they responded

[VGPowerlord]

I thought it was more because white is generally considered by western civilization to represent purity, while black is the opposite of white.

bad habits

[fermion]

I wish that security was not so often sacrificed for selling opportunities. When one is going through an online transaction, which is still a risky process due to man-in-the-middle attacks, one should not create an expectation of the user to see things characteristic of such attacks. There are no reason to have ads on such pages. There is no reason to set third party cookies to ad sites, or direct to other offers between the time that user checks out and the time the order is complete. If attacks such as these are successful, it is the fault of the companies that design the faulty web pages, and such companies should compensate the consumer.

Even firms that should know better, such as banks, promote such practices. I recently logged into my highly secure bank account, and instead of being greeted with my bank information was greeted with a survey. This is such a fundamental breach of security I wonder why I bank with them. Oh, I know. Because every other bank is selling out customer security to make a buck. it is nothing new. I used to recieve many offers on my banks letter head. When I called to see if they were responsible, the agent said they have nothing to do with. Well, I would reply, it is on your letterhead, should I call my AG and state that someone is representing themselves as you? Nothing was said after that.

IN any case, as long as people are trying to squeeze every dime out of every customer, we are going to have these security issues. I guess the only thing to do is to not conduct business with the worst of the worst, no matter how tempting it is.

Re:At least they responded

[Mister Transistor]

OK, I'll bite.

Whitewash was a kind of paint used in the old days for fence and barn painting. It was called that (gasp) - because it was white! Think Tom Sawyer... Anyway, the term "whitewashing" means to cover up (as in with white paint).

Blacklisting comes from (also) old times, in Hollywood movie studios, if you were allowed on premises, you were on a list the security guards were given. If you pissed off the director or some studio exec, you got a line drawn through your name with a (you guessed it) - black - pencil - and were denied access from then on.

That's it, no racist overtones or conspiracies - except, perhaps in your mind!