In the age when merchant breaches are an alarmingly common part of consumer life, among the few comforts available is that once a card has been compromised and the problem identified, fixing the problem is as easy as canceling the card in question and having it reissued. But for American Express customers, it looks like, going forward, things many not be so easy. According to recent reports, security researcher Samy Kamkar managed to crack the code on how Amex generates replacement card numbers and was thus able to build a device to generate a new card number from an old one. After doing some research with his own replacement card numbers — and those of some friends found via Facebook — Kamkar realized that any hacker who saw the same pattern would be able to use a stolen card to predict what its replacement card number would be — down to the new card’s expiration data. “The day that card is canceled, as soon it gets rejected, two seconds later, I know what your new number and expiration date will be,” Kamkar says.

“If I were doing fraud, that would be pretty useful.” Kamkar also noted the trick works in sequence and can generate as many new numbers as American Express can generate cards. A few months later, after a $10 investment, Kamkar built a watch-sized gadget capable of stealing as many as 100 card numbers from any card reader sensor within close proximity by sending a signal as a card is swiped. Kamkar even built his fraud tool with a button that uses his algorithm to generate a new card number once the previous card is canceled. “As soon as the card gets declined, you press a button, and it switches to the next number,” Kamkar says. “It sucks for [Amex users], because they could have their new credit card stolen almost instantly.” The attack is limited by its inability to access the four-digit CVV code, and the mag spoof device does not resemble a credit card and would be harder to use in a physical store. But Kamkar also noted that he could use his device to store cards in a digital credit card device like Coin to make the stolenness much less apparent.

“If you don’t want to hand someone this thing, you can just hand them a Coin instead,” he says.jack pyke hoodie Coin noted using its device would not be quite so easy.hemi hoodie “We require several security steps before a credit card can be used with a Coin payment device,” Coin spokesperson Kayla Abbassi wrote to Wired in a statement. kwantlen hoodie“These steps allow us to verify identity, as well as the validity and ownership of each card, based on information such as the last four digits of the cardholder’s Social Security number and billing zip code.”propper v2 hoodie sizing Kamkar notes that Coin security measures have been proven to be beatable.

Kamkar noted his attempts to alert American Express to the issue have not yielded any promises to fix the problem. Kamkar stated that Amex told him it did not pose a significant security risk. “Simply knowing a card number wouldn’t allow a fraudster to complete a purchase face to face, because a card product would need to [be] dipped at many of the stores with EMV chip portals or swiped. In addition, the security code embedded in the card product would need to be verified. For both EMV chip and magnetic stripe cards, the security code changes with the card number and is impossible to predict,” wrote Amex spokesperson Ashley Tufts. She also noted that the company uses other security measures that it declined to detail. Kamkar confirms that Amex’s extra security magstripe code does seem to block his prediction attack in some cases, but he argues American Express nonetheless needs to fix the problem before other hackers find a clever way to use it. “It’s not like I cracked some crazy pseudorandom number generator.

This is really obvious,” Kamkar says of his card number prediction technique. “I’ve never heard of anyone finding this, but I’d be surprised if someone hadn’t figured it out.” How to avoid buying fake headphonesLet friends in your social network know what you are reading aboutTwitterGoogle+LinkedInPinterestPosted!A link has been posted to your Facebook feed. The Senate passed a bill Monday night aimed at making it easier for states to collect sales taxes for online purchases, but its final prospects remain uncertain.Even so small online retailers are already thinking about the bill's potentially large impact on their operations.Nancy Mashragi would seriously consider reducing her sales to less than $1 million a year so she'd be exempt from collecting sales tax from customers.STAKES: Who would win or lose on online sales taxMashragi sells refurbished electronics through her eBay store, Concept Electronics. Last year she sold roughly $3 million worth of merchandise. But if the Senate passes the Marketplace Fairness Act tonight, she may cut iPads, which have a high cost but low profit margin, from her inventory so she'd fall within the proposed $1 million small-seller exemption.

FIRST TAKE: Internet taxation shapes Amazon-eBay battlePROSPECTS: Bill faces hurdles in House"That's something off the bat we'd cut out because it's not worth it for us," says Mashragi, who is based in Clearwater, Fla., and collects sales taxes for purchases made by Florida residents. "Why would we go through the hassle of going over that threshold and being responsible for all those taxes on something that has a very low profit margin?"CONSUMERS: Advocacy groups largely silent on sales taxIt's a concern she and other small online retailers share. The bill, which passed the Senate 69-27, now heads to the House, where it faces an uncertain future because some Republicans view it as a tax increase. President Obama has said he supports the bill.The act would overturn decades-long precedent and leave many small online sellers with the task of figuring out how to manage collecting and remitting sales tax to nearly every state.A 1992 Supreme Court case ruled that states could only require businesses to collect sales tax if the business had a physical presence in the state, such as a store or warehouse.

Out-of-state retailers — back then the likes of catalogs more than websites — did not have to collect sales tax because it was deemed too difficult for them to abide by so many different tax jurisdictions and rules.Now that online shopping has grown into a $226 billion-a-year business, and software makes collecting online sales tax across states easier, proponents of the Marketplace Fairness Act say requiring online businesses to comply with the same rules as bricks-and-mortar businesses is long overdue. The act would also require states to simplify their tax codes and provide retailers the software to assist in tax collection at no charge."Not being able to compete on this is a frustration for retailers," says David French, senior vice president of government relations at the National Retail Federation. "(Avoiding sales tax) may not be a primary reason customers shop online, but it's one of them."The issue pits retail behemoths such as Walmart and Amazon against small online sellers such as those on eBay in a fight for price and industry dominance.

Those in support of the bill, which include Walmart, Amazon and Target, argue they're at a 5% to 10% price disadvantage by having to charge sales tax. States argue they're missing out on much-needed revenue. Last year, states could have collected more than $11 billion in online sales tax revenue, according to a study by the University of Tennessee."The attempt to do this was almost inevitable given the billions of dollars of transactions that are now being conducted electronically," says Dan Effron, a partner in the tax services group of Marcum LLP, an accounting and consulting firm. But, he says, "I in no doubt agree that the burden of complying with this law on small to medium-size businesses would be a real hindrance."Online retailers say the administrative burden of collecting sales tax would curb business growth and make it harder to compete. Perhaps the most contentious provision is a $1 million small-seller exemption — anyone with less than $1 million a year in out-of-state sales wouldn't have to collect sales tax.

Small sellers and their advocates say that number is too small.EBay is at the helm arguing for a small seller exemption of $10 million in sales, or businesses with fewer than 50 employees."It's going to make it harder for small businesses to compete, because it will raise the price of their product," says Brian Bieron, eBay's head of global public policy. "We think the current situation is actually quite fair when you're talking about small business online and small business in stores. The small brick-and-mortar business and small online business both collect sales taxes where they operate."At question is whose responsibility it is to collect sales tax, and when that responsibility should kick in. Technically, consumers are already supposed to pay taxes on out-of-state or online purchases as use taxes — many states require them to disclose these purchases on their tax return forms. But most people don't."The issue is really, does the seller have an obligation to collect the tax that the consumer owes?" says Harley Duncan, managing director and state and local tax leader of KPMG's Washington National Tax practice.

"I think it's clear that if the tax is going to be effectively collected it's going to have to be collected by the seller."A BIG JOB FOR LITTLE GUYSThe bigger issue for many small business e-tailers isn't necessarily losing a price advantage, but dealing with the extensive administrative and logistical costs of collecting and remitting sales taxes for every state."You need manpower to overlook this," says Mashragi of Concept Electronics, which employs eight people plus herself and her husband. Since the business is based in Florida, Mashragi already collects sales tax from Florida residents. She explains that despite software that automatically charges Florida customers sales tax, an employee still has to go through every transaction and every refund made to determine how much sales tax the company collected. She anticipates the same process for every state should the Marketplace Fairness Act pass."Unfortunately, we're probably going to have to downsize," she says, in order to hire someone solely to focus on tax collection.

"It's a challenge for us to employ this many people and keep our heads above water."Ann Whitley Wood, whose eBay store Willow-Wear does just under $1 million in sales a year, is also worried about continuing to grow her business and hire employees if she eventually has to collect sales tax."Even if it was simplified to one (tax) rate per state, that is still 45 tax-collecting states, and that is an incredible burden of time," she says.Alaska, Delaware, New Hampshire, Oregon and Montana do not have sales taxes.Small online sellers are also worried about the potential to be audited by nearly every state. Others wonder why they should be expected to collect sales tax for jurisdictions where they won't benefit from the services the taxes go toward."They're not imposing the cost that the tax is offsetting," says Brad Wilson of online-only retailers. , a website that helps shoppers find the best online deals. ", Chicago doesn't even know," he says as an example. "(Online retailers) don't need more cops or streets paved or whatever else goes into supporting (local) retail."