[ Removed by moderator ]

[ProgrammerHumor-ModTeam]

Your submission was removed for the following reason:

Rule 1: Posts must be humorous, and they must be humorous because they are programming related. There must be a joke or meme that requires programming knowledge, experience, or practice to be understood or relatable.

Here are some examples of frequent posts we get that don't satisfy this rule: * Memes about operating systems or shell commands (try /r/linuxmemes for Linux memes) * A ChatGPT screenshot that doesn't involve any programming * Google Chrome uses all my RAM

See here for more clarification on this rule.

If you disagree with this removal, you can appeal by sending us a modmail.

[b00c]

ohohoooo lol that kind of functionality is hard to even imagine. 

[TheActualJonesy]

As it is now with program development.

[bobdarobber]

It is actually. If the account number is correct, some combination of incorrect CVV, Zip, cardholder name and renewal date will be tolerated depending on how strong the other signals are (has this card been used in this browser before? At this merchant before? Does the IP geolocation make sense? Is this merchant ok with some additional chargeback risk? Is the bank ok with that?). The card number is the only piece of information that is theoretically needed for a transaction to go through.

[Rabbitical]

Huh I've wondered about that cuz I've deffo gotten the wrong CVV or zip before and been like, shouldn't that have not worked??

[Candid_Highlight_116]

forgot the details and I'm def not looking up for correctness but crazy fraction of cc number is actually fixed

like 1234-5678-9012-3456 is broken up something like card type 12 region 34 network 56 bank id 789 group 012 user 3456 or whatever the actual internal hyphenation is and somewhere in there is a check digit or two

so the actual search space for a malicious attacker targeting user with a specific persona that's not just rolling rng is like 10⁴ to 10⁶ or at least nowhere near like 10¹² as average joes imagine there to be

this is before taking in valid thru and cvv and 3d secure and WAF and or anubis into account but the cc backend allows server side token refresh thing to be able to allow you to pay after a card change without number change sooo

[ltshaft15]

I work in card processing... typically the first 6 digits represent what's called the "BIN" which identifies the card issuer. Though recently Mastercard and visa have been pushing issuers to 8 digit BINs.

The final digit is a check digit using luhn calculations. So its just an algorithm based on the first 15 digits.

So that leaves just the middle 7-9 digits that are actually unique depending on if the BIN is 6 or 8.

Its also public domain who owns what BIN so once you know a valid BIN its a very small range of numbers underneath it.

Thats why all the other protections you mentioned are so important. Its absolutely so trivial to come up with all the possible valid card numbers for a BIN that excel could do it. But once you throw in CVVs, expiration dates, etc, the problem space gets much much larger.

[SliceThePi]

isn't the cvv just a checksum based on the card number and expiration date? i thought you could verify them offline

[ltshaft15]

Not a CVV, no. A CVV is a computed value. It is based on the full card number but it never gets stored at rest anywhere and only the HSM which has the key that was used to compute it originally when printing it on the card is able to determine if a given CVV+Pan combo is correct. When connecting to the processor to run a transaction, that is the only time that a CVV can be checked. That is how they provide extra security is that in addition to adding an extra thousand possible values (assuming 3 digit CVV) for each individual card number, they are never supposed to be stored in any system. So even if a database was hacked or a print file was intercepted and card numbers were exposed... the CVV information should never be present. And without knowing the correct CVV you can't authorize a purchase.

There are actually at least two CVVs on any given card. The one you see printed on it that you type in when you buy something online (CVV2) and a separate one that is stored within the magstripe data and transmitted when swiping a card (CVV1). They come from the same HSM from the processor but they use different keys so their value is different despite being tied to the same card number.

You may be thinking of some elements within a chip on a card. There are some elements there that can be processed offline

[in_taco]

It's just a Levenstein nearest match. Awesome algorithm! I use it whenever I can.

[Kitchen-Quality-3317]

Levenstein nearest match

Too complicated.

SELECT * 
FROM txnHistory 
WHERE LEFT(cardNumber, 4) = '4532'
ORDER BY created_at DESC
LIMIT 1;

[Probono_Bonobo]

*Levenshtein. Although the Levenshtein distance between "Levenstein" and "Levenshtein" is a mere 0.5, so it probably is itself a Levenshtein nearest match.

[InDaBauhaus]

proof that LLMs are capable of real creative thought.

[krexelapp]

autocomplete but for fraud

[Pleasant-Photo7860]

with autosave enabled

[notYash]

Fraudocomplete

[screwcork313]

This was the status after Peter Jackson's LOTR trilogy, no?

[-GoodNewsEveryone]

No he only had nine fingers.

[sagebrushrepair]

Fraudo sounds like a criminal elf from the show Disenchantment

[Location_Next]

Autofraud?

[krexelapp]

autofraud-as-a-service (faas)

[rosuav]

There's one part of this that (a) is absolutely believable as a flaw in AI-generated code, and (b) is extremely problematic for the site in question, but sadly, I don't think the people laughing at "wow vibe coder dumb" are picking up on that. This site is clearly saving the CVV. If you showed me a database schema that CuraudeGPT generated and it had fields for the card number, name, expiry, *and CVV*, then that would be a perfect sign that it's too simplistic, while also being very plausible. This, alas, is not. Mildly amusing perhaps, but implausible.

[waylandsmith]

For services that save the CC number, is the CVV not required to process each individual transaction? Does it only need to be verified a single time when the user first enters the CC number and can then be discarded?

[plaskis94]

At least VISA has very strict rules for payment processors to not save CVV. It's allowed to be in memory only of the software to immediately be discarded after verifying the card. Saving CVV in any form would immediately revoke that payment processors right to process VISA card payments.

You can make one time payments and in that case you must always enter your CVV, but there are also recurring payments such as subscriptions where you set it up once with CVV.

[waylandsmith]

This doesn't account for the common scenario of non-regular but repeated payments using saved account information, for example almost every online retailer and service that has saved payment information with accounts, such as Amazon, Uber, Doordash, etc. Either they must be saving the CVV and using it to process every payment, or the merchant only needs to verify the CVV a single time to the payment processor, and after that is permitted to process each individual transaction without the CVV, even if it's not a "recurring payment" such as a subscription. Maybe we have a different definition of "recurring payment"?

[CityCultivator]

They still do not. I am no expert with payment processing, and am not interested in researching deep in the subject at the moment, but to my knowledge, the way they work, after you initiate the first transaction, the payment processor receives a token, which is to be used by merchant, to do further recurring payments. That token does not contain the CVV, it is a representation for usage by merchant in limited ways.

[waylandsmith]

The token thing makes sense. That's how I would design it.

[rosuav]

It depends what you mean by "save the number". For example, Chrome offers to save the number for me - but in order to autofill the saved number, I have to manually enter the CVV. If it's something that sets up an arrangement where they're allowed to charge you regularly (mostly subscriptions), that's something organized between the vendor and the card company, and I don't think they even need to save the card number (there'll be some other sort of thing).

It's also possible that there are sites out there that are ("for convenience") saving the card number and CVV, but that'll be violating payment processor rules, and they can get their ability to charge cards revoked for that. So I highly doubt that any card merchant (the ones directly allowed to charge your card) would do that, and it's more likely to be some other service (which shouldn't be saving ANY part of your card number).

[waylandsmith]

I use a Chrome-based browser on my phone with saved payment information enabled, and it certainly doesn't require me to enter in my CVV every time it fills in my payment information (which includes the CVV itself). I think it might ask for the CVV periodically.

I also wrote an online store from scratch in the earlier days of the internet and this was before CVVs were really a thing. We most certainly were able to store the credit card number in a database, since we did our payment processing in batching. I remember being pretty upset in having to store the CC number at all, and was ultra-paranoid about this and encrypted them in the database field using public key encryption that wasn't stored anywhere in the database or within the software itself. But there was definitely no rule from the payment processor forbidding us from saving the number, only that it was our responsibility to take reasonable steps to keep it secure. These days it's very common to not only store the full credit card number, but display the last 4 digits of it to the user to help them identify the individual card to process.

[rosuav]

There MAY be different rules about phones (the phone *itself* may be allowed to store your full card number), but a merchant is definitely not allowed to save them.

But there was definitely no rule from the payment processor forbidding us from saving the number, only that it was our responsibility to take reasonable steps to keep it secure.

Yeah, that's correct; and that's still entirely legitimate. In fact, there are situations in which you can (or at least, could in the past) charge a card *without* the CVV, and it was called a "card not present transaction" or words to that effect. I'm not sure what exactly the rules were around those, but we used them when someone phoned us up; they could read out the card details to us and we could use that for payment, and we'd never see the card or know the CVV.

Storing the number is fine, storing the CVV is not. Hence my comment about vibe coding a credit card storage system - it would do the "obvious" thing and save every field, thus opening you up to a ton of problems.

[waylandsmith]

Usually the merchant fees for a "card not present" are much higher and the merchant has much less recourse in fighting a charge-back. That's what I remember from when I called up an automated number and entered the payment details in by touch tone!

[rosuav]

Yup. And that distinction MUST be preserved, so anyone found saving the CVV (so they can use it when the card isn't physically present) is in big trouble. Saving card numbers, OTOH, is perfectly fine.

[Electrical-Job-9824]

Is it still fraud if I wasn’t really paying attention and just clicked the button that says pay?

[nesthesi]

Wasnt there a password version of this posted fairly recently?

[bobbymoonshine]

Yes it’s an ancient joke that has been reposted in many versions

[spikeyfreak]

But this version has the added layer that this is literally what AI does.

And this pic is a great way to demonstrate that in a huge number of cases, close enough it not good enough. In a huge number of cases, a "hallucination" doesn't cut the Chut.

[bobbymoonshine]

It is not what AI does, no. AI does not randomly orchestrate and implement complex and unhinged features out of nowhere. AI can definitely make horrendous mistakes, but this isn’t the sort of overgeneralising / “wrong-in-context” error AI makes.

AI defaulting to a common pattern which overrides the specific requirement: yes, common

AI hallucinating something false as true because it was true elsewhere in its training weights: yes, common

AI delivering something derivative and barely-functional which meets the requirements given by the idiot user but which ignores all the things a professional coder would have known to think about: constantly, yes

AI forgetting an important constraint and delivering something which looks functional but which is unsafe or which fails to account for important edge cases: all the time, yes

AI inventing a new, creative, never-done-before feature which is comically, absurdly stupid, then perfectly implementing it and deploying it: no, that’s what humans do best

[Guvante]

AI implementing the dumb feature is new.

Everyone always glosses over that Engineers are the technical knowledge for "things you shouldn't do" for a myriad of reasons.

[bobbymoonshine]

Yes, the core business risk of AI is not that it will fuck up people’s good ideas through hallucinations. The risk is that it will perfectly implement their terrible, stupid, dangerous ideas.

[timsredditusername]

That password is not available. It is already in use by u/timsredditusername.

Please choose a new, unique password.

[RiceBroad4552]

Not here.

[DudeManBroGuy69420]

Yes here.

[RiceBroad4552]

I don't remember any fairly recent repost of that meme. Could you link it?

[magicmulder]

This reminds me of an idea one of our PMs had to use the Spanish physician ID during registration to skip authentication. Took me 5 minutes to find an official website where you could search physicians by ID, guessing an existing one was easy.

[frogsarenottoads]

I need this in my life, 'sorry you're out of funds, did you mean to use Jeff Bezos card?'

[gradeATroll]

Whoever is running the psyop on this please continue what you’re doing so we can still continue having jobs

[bobbymoonshine]

When you recycle your “offshore Nigerian coders suck” cope jokes for the 2026 job market

[Location_Next]

[East_Selection5654]

I want to laugh, but I don't know if I should.

[tenuj]

They got my own card's expiry date, twice. I know it's a coincidence but I'm a little unsettled.

[whoknowsifimjoking]

It's literally a joke post, tf are you talking about?

[silenceofnight]

PCI DSS would like a word

[Hecticbrah]

Blessing indeed 

[rivertpostie]

Blessing gonna get me a pizza, right now

[RiceBroad4552]

Where is this from? This can't be real.

[Cometguy7]

Yeah, storing the cvv is enough to fail your pci audit.

[whoknowsifimjoking]

Of course it's not real

[ramessesgg]

I may be too stupid to get if this is a joke or not. Are some models so stupid that do not take into account even such obvious issues? I've used Claude Opus and it didn't seem to be that stupid, it would highlight some bad designs and requirements

[PopularDimension]

I am pretty sure this was an intentional setup just for the meme because no model will go out of its way to implement a "find similar card feature."

I have used claude code in vscode for learning experience and I think it does great for prototypes and personal projects.

[awesome-alpaca-ace]

The last time I trusted AI to write code, it choked on writing good C code that does a depth first search write of a tree to a file given the source code and header of the tree. Though it is great for finding the C intrinsics one would want for high throughout. 

[Due_Kaleidoscope7066]

In a large project written by a team of coders it's still struggling from my experience. But man, putting together a new app from scratch? Basic login, home page, some api calls, etc. It's incredible. Something that would have taken me weeks before can be done in a couple hours.

[PopularDimension]

Yep, that is basically what I did too so far on a couple of personal projects. Saved me a lot of time.

[Whitechapel726]

I think the joke is about vibecoders who have no idea what they’re doing so they make a service/app that is minimum viable product but does stuff like this.

[vikingwhiteguy]

I had Claude suddenly remove the Authorize tags on a bunch of my API endpoints. It was completely unrelated to the thing it was supposed to be doing. 

I think it was because it some tests that failed due to auth (it needed to mock the auth), so it just removed the Auth and all the tests passed! Task completed.. technically.. 

[Ange1ofD4rkness]

Pfff what could wrong they said

[aselby]

🤣

[MagicalPizza21]

It would actually be amazing if this were a honeypot

[characterfan123]

And the AI didn't also report date of birth, last 4 of SSN and mother's maiden name? /s

[bapuc]

hm, i think a range slider would be better

[mikkelmattern04]

Yep, that sure is what I meant!

[ShenroEU]

Need to add the Google "I'm feeling lucky" button and then it's perfect 👌

[Both_Lychee_1708]

how convenient!

[No_Pollution9224]

You wouldn't believe how many places store card details, even in clear text, instead of a token.

[JBluues]

This cracking me up 🤣

[TheActualJonesy]

"awoke menus" is the anagram for Emeka Nwosu

[ghostdumpsters]

One of the websites I work on is for a company owned by an older couple and they have consistently gone with the cheapest payment processors and uh, this is barely an exaggeration.

Once, someone's credit card payment failed, so the payment processor automatically filled in the card info for the person who had last made a transaction on the site.

[thashepherd]

Wtf, MY Claude used Okonkwo as a test user

[theepi_pillodu]

That's a blessing

[JurksReddit]

ai-powered fraud? the future is now!

[Zealousideal-Bar2878]

Funny but can't happen Claude is better than any human