Testing McCain and Obama web sites – credit card fraud

After all of the activity concerning the Obama Web site and how it seems a bit “loose” in how it collects credit card donations, I’m taking one for the team and testing it myself.

Author note: While I’m away from the computer, I’m republishing my top 20 posts from 2008 each afternoon. -Steve (by the way, Obama still has my 10 bucks)

But instead of just testing Obama’s site, I’m testing the McCain site too. Note that neither of the sites ask for the credit card validation number – also know as the CVC – which is normal practice by other secure Web sites that collect credit card information for processing.

Updates at the bottom of this post…

My first step was to go to the McCain site and make a donation. Click on the image to see the full size. I’ve redacted my personal information.

After submitting at the McCain site, I was directed to the following page. It shows that there is something wrong with my form and asks me to check the information. Note that the credit card data field is now blank, but there is no specific indicator showing which field is throwing the error. Click on the image to see the full size.

Next step, head over to the Obama site and see what the user interaction is with the form using the exact same personal information. Here is the form, click on the image for the full view.

After hitting submit, the transaction seems to go through and I get the following thank you page.

Next, I headed over to my online bank account to check my card for activity. As of this moment, it looks like both Obama and McCain have a pending charge posted to my card.

I will keep readers updated if the “pending” status changes for either of the charges. I’m not impressed that McCain’s site showed an error but still seems to have posted the pending charge.

Keep in mind that for small amounts – usually under $25 – credit card companies don’t care as much about authorizations or signatures. Note that within the past year, when I buy lunch using my card my signature is no longer required.

Either way, both campaign sites have crappy authentication system for donations.

Other blogs on the story include Vicevich (Radio Vice Online), Malkin, LGF and Powerline. Whoops – of courseHot Air is on it too.

Update: Got an e-mail from the Obama campaign with a thank you note. Guess that car magnet will get “lost in the mail” since the address does not exist. After more than an hour, no e-mail from McCain campaign.

Update (2:11 p.m. ET): Credit card online account is now listing the McCain transaction (Edonation 1) as zero dollars. Also both Obama and McCain listed as pending. Note that a Radio Vice Online listener confirmed to me that McCain donations show up as Edonation 1on statements.

Update (Oct. 25, 7:40 a.m. ET): Overnight, I realized that I used my correct credit card expiration date. If you feel like testing the Obama site yourself, try it with an invalid expiration date. Also, checked the online statement this morning. The pending transaction for Edonation 1 (McCain) is now totally gone.

Update: (Oct. 25) Allah’s on it at Hot Air. Gaining traction. Question for the Obama campaign… How many donations under $200 did they reject? My $10 transaction is still listed as pending, but once it does go final – what’s the chance that they will refund the credit card account when they realize it’s all fake information? They probably will see this post and refund it.

Update: (Oct. 27) Lots of others testing the system. My transaction still listed as pending as of this morning.

Update: (Oct. 28) Obama now officially has my 10 bucks.